claude-code-session-manager 0.62.0 → 0.63.0

package/src/main/ipcSchemas.cjs

@@ -25,17 +25,6 @@ const ptyTabId = z.object({ tabId: z.string().min(1).max(128) });
 // have a live PTY? Bounded so the renderer can't ask about unbounded lists.
 const ptyAlive = z.object({ tabIds: z.array(z.string().min(1).max(128)).max(500) });
 
-// v2 mobile: subscribe to a session's live state + summary. cwd is needed to
-// locate the transcript JSONL (transcriptPath); validated against home-dir boundary
-// in webRemote before any fs access.
-const sessionSubscribe = z.object({
-  // tabId becomes a transcript FILENAME (`<tabId>.jsonl`) — restrict to a
-  // session-id charset (no '/', no '.', so it can't traverse out of the project
-  // transcript dir). sessionId is a UUID, which satisfies this.
-  tabId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/),
-  cwd: z.string().min(1).max(4096),
-});
-
 // 64 KiB cap per pty:write — typewriter input is bounded; a renderer firing
 // megabytes per call is either a bug or an attack. Block it at the boundary.
 const PTY_WRITE_MAX_BYTES = 64 * 1024;
@@ -50,115 +39,12 @@ const ptyResize = z.object({
   rows: z.number().int().min(3).max(1000),
 });
 
-// ──────────────────────────────────────────── Browser (WebContentsView embed)
-// viewId is a renderer-generated identifier; restrict to a safe charset (no
-// '/', no '.') since it keys the in-process Map<viewId, WebContentsView> —
-// not used as a filesystem path, but kept consistent with tabId conventions.
-const BROWSER_VIEW_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
-const browserViewId = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-});
-
-const browserCreate = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  // Non-persistent partition string (PRD 400 run-mode isolation). No leading
-  // 'persist:' enforced here — callers choose persistence explicitly.
-  partition: z.string().min(1).max(256),
-});
-
-const BOUNDS_INT = z.number().int().min(0).max(100000);
-const browserSetBounds = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  x: BOUNDS_INT,
-  y: BOUNDS_INT,
-  width: BOUNDS_INT,
-  height: BOUNDS_INT,
-});
-
-const browserNavigate = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  url: z.string().min(1).max(8192),
-});
-
-// PRD 407: DOM/text capture from the active browser sub-tab.
-const browserCaptureDom = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  kind: z.enum(['text', 'html']),
-});
-
-// PRD 404: filter -> prune -> summarize -> chunk capture of a picked
-// selection (browser:capture). selectors comes from the PRD 403 picker.
-const browserCaptureSelection = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  selectors: z.array(z.string().min(1).max(2048)).min(1).max(50),
-  mode: z.enum(['agent', 'html', 'a11y', 'selector']),
-});
-
-// PRD 407: clipboard image write (browser:copy-image). dataUrl is a PNG data
-// URL from webContents.capturePage() — capped well above any realistic
-// screenshot so a malformed/huge payload can't wedge the IPC channel.
-const browserCopyImage = z.object({
-  dataUrl: z.string().min(1).max(50_000_000),
-});
-
 // Recorder export (PRD 412): write arbitrary recorded-flow text to the OS
-// clipboard, separate from the image-only browserCopyImage above.
+// clipboard.
 const clipboardWriteText = z.object({
   text: z.string().max(1_000_000),
 });
 
-// Recorder export (PRD 412): native "Save As" dialog write, bypassing the
-// config.cjs write-boundary since the path is user-chosen via OS dialog.
-const browserSaveRecording = z.object({
-  defaultName: z.string().min(1).max(255),
-  text: z.string().max(1_000_000),
-});
-
-// PRD 407: binary-safe atomic write (browser:save-binary) for screenshot
-// captures — config:write-text is utf8-only.
-const browserSaveBinary = z.object({
-  path: z.string().min(1).max(4096),
-  base64: z.string().min(1).max(50_000_000),
-  // Single-writer law (lib/opsOwnership.cjs) — required for ops-root paths.
-  writer: z.string().min(1).max(64).optional(),
-});
-
-// PRD 410: replay a recorded step list against a live view. The renderer
-// owns the step list (main never persists recorded steps), so every call is
-// self-contained. `select` is accepted for forward-compat even though the
-// live recorder engine doesn't emit it yet.
-const browserReplayStep = z.object({
-  n: z.number().int().min(1),
-  verb: z.enum(['navigate', 'click', 'type', 'select', 'wait-for']),
-  target: z.string().max(2000),
-  value: z.string().max(2000).optional(),
-  variable: z.string().max(64).nullable().optional(),
-  kind: z.enum(['nav', 'assert']).optional(),
-  masked: z.boolean().optional(),
-  variableSuggestion: z.string().max(64).optional(),
-});
-
-const browserReplay = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  steps: z.array(browserReplayStep).max(500),
-  values: z.record(z.string().max(64), z.string().max(2000)).optional(),
-  continueOnError: z.boolean().optional(),
-});
-
-// PRD 402: address-bar zoom control. factor is clamped again in
-// browserView.cjs's setZoom — this just bounds the wire payload.
-const browserSetZoom = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  factor: z.number().min(0.1).max(10),
-});
-
-// PRD 402: Cmd/Ctrl+F find bar.
-const browserFind = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  text: z.string().max(2000),
-  forward: z.boolean().optional(),
-});
-
 // ──────────────────────────────────────────── Transcripts
 const SESSION_UUID_RE = /^[a-zA-Z0-9-]{1,64}$/;
 
@@ -203,6 +89,14 @@ const transcriptReadRef = z.object({
 // ──────────────────────────────────────────── Config
 const configPath = z.object({ path: z.string().min(1).max(4096) });
 
+// maxBytes: optional bounded prefix-read length in bytes. Capped at 8 MiB —
+// generous for any legitimate "peek at the start of a file" caller while
+// still blocking a renderer from asking for an effectively-unbounded read.
+const configReadText = z.object({
+  path: z.string().min(1).max(4096),
+  maxBytes: z.number().int().min(1).max(8 * 1024 * 1024).optional(),
+});
+
 // `writer` carries the renderer's declared owner id for the single-writer law
 // (lib/opsOwnership.cjs). Optional on the wire because most writes target
 // ~/.claude, not a project ops root; writes INSIDE the ops root are refused
@@ -680,6 +574,15 @@ const exchangesList = z.object({
 // this one lives here per PRD 638 so it's reusable without importing files.cjs.
 const filesDuplicate = z.object({ path: z.string().min(1).max(4096) });
 
+// files:save-binary — binary-safe atomic write (formerly browser:save-binary,
+// re-homed off the Browser tab). Mirrors the retired browserSaveBinary shape.
+const filesSaveBinary = z.object({
+  path: z.string().min(1).max(4096),
+  base64: z.string().min(1).max(50_000_000),
+  // Single-writer law (lib/opsOwnership.cjs) — required for ops-root paths.
+  writer: z.string().min(1).max(64).optional(),
+});
+
 // ──────────────────────────────────────────── Doc Edit (PRD 638 rewrite runner)
 // docedit:run — consumed by docEdit.cjs's registerDocEditHandlers.
 const docEditRun = z.object({
@@ -744,23 +647,6 @@ const chatExternalSend = z.object({
   ),
 });
 
-// ──────────────────────────────────────────── Web Remote
-// OTP is 8 uppercase alphanumeric chars (case-insensitive entry, normalised to upper in handler).
-const WEB_REMOTE_OTP_RE = /^[A-Z0-9]{8}$/i;
-const DEVICE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-
-const webRemotePair = z.object({
-  otp: z.string().regex(WEB_REMOTE_OTP_RE),
-}).strict();
-
-const webRemoteRevokeDevice = z.object({
-  deviceId: z.string().regex(DEVICE_ID_RE),
-}).strict();
-
-const webRemoteAuditTail = z.object({
-  lines: z.number().int().min(1).max(500).optional(),
-}).strict();
-
 // ──────────────────────────────────────────── History
 const DATE_YYYY_MM_DD = /^\d{4}-\d{2}-\d{2}$/;
 
@@ -892,96 +778,19 @@ function validated(schema, handler) {
   };
 }
 
-// ──────────────────────────────────────────── Web Remote command allowlist
-// Commands are split into three tiers:
-//   READ_COMMANDS      — return data; allowed when remoteEnabled=true.
-//   SAS_GATED_READS    — return sensitive user data (sessions, PRDs, logs,
-//                        transcript summaries); additionally require
-//                        _e2eAuthenticated=true (SAS confirmed by user).
-//                        A compromised relay cannot exfiltrate this data from
-//                        a session that has not been SAS-confirmed.
-//   MUTATE_COMMANDS    — write files, spawn processes, or mutate persisted
-//                        state; gated behind remoteControlEnabled=true AND
-//                        _e2eAuthenticated=true.
-// ALLOWED_COMMANDS is the union, kept for existing import compatibility.
-//
-// Ungated READ_COMMANDS (justify each):
-//   cmd:app:version      — exposes only the app semver string; no user data.
-//   cmd:session:unsubscribe — teardown lifecycle; returns nothing sensitive.
-const READ_COMMANDS = new Set([
-  'cmd:app:version',
-  // v2 mobile: unsubscribe is a teardown lifecycle call with no data payload.
-  'cmd:session:unsubscribe',
-]);
-
-// Sensitive reads — return user data; require SAS confirmation same as MUTATE.
-const SAS_GATED_READS = new Set([
-  'cmd:sessions:load',
-  'cmd:history:aggregate',
-  // subscribe initiates a live stream of session state/summary — sensitive.
-  'cmd:session:subscribe',
-  // NOTE: cmd:exchanges:list is intentionally NOT allowlisted — webRemote.cjs has
-  // no dispatch handler for it, so an allowlist entry would only fail closed with
-  // an opaque reject. Re-add here together with the handler when remote exchanges
-  // are wired, so the allowlist always mirrors an actual capability.
-  //
-  // Scheduler/Epics commands (cmd:schedule:*) were removed here deliberately
-  // (core scheduler/Epics redesign) — Remote no longer reaches into scheduler
-  // internals at all; a future Remote rebuild will talk to Scheduler/Epics
-  // through whatever higher-level surface that redesign lands on, not this
-  // per-command allowlist.
-]);
-
-const MUTATE_COMMANDS = new Set([
-  'cmd:sessions:save',
-  'cmd:pty:spawn',
-  'cmd:pty:write',
-  // pty:kill terminates a live session; pty:resize drives the geometry of the
-  // user's interactive PTY — both write live process state, so they are gated
-  // behind remoteControlEnabled + SAS like every other mutation. A read-only
-  // mobile mirror has no business killing or resizing the desktop's session.
-  'cmd:pty:kill',
-  'cmd:pty:resize',
-  // Pushes a prompt into an open tab's chat queue — a real mutation of that
-  // tab's session, same tier as pty:write.
-  'cmd:chat:send',
-]);
-
-const ALLOWED_COMMANDS = new Set([...READ_COMMANDS, ...SAS_GATED_READS, ...MUTATE_COMMANDS]);
-
 module.exports = {
   // Centralized slug regex — used by scheduler.cjs and queueOps.cjs for
   // direct test()/match() containment checks alongside the zod parses.
   SCHEDULE_SLUG_RE,
   SCHEDULE_RUN_ID_RE,
   PRD_CREATE_SLUG_RE,
-  READ_COMMANDS,
-  SAS_GATED_READS,
-  MUTATE_COMMANDS,
-  ALLOWED_COMMANDS,
   schemas: {
-    webRemotePair,
-    webRemoteRevokeDevice,
-    webRemoteAuditTail,
     ptySpawn,
     ptyTabId,
     ptyAlive,
     ptyWrite,
     ptyResize,
-    sessionSubscribe,
-    browserViewId,
-    browserCreate,
-    browserSetBounds,
-    browserNavigate,
-    browserCaptureDom,
-    browserCaptureSelection,
-    browserCopyImage,
-    browserSaveBinary,
     clipboardWriteText,
-    browserSaveRecording,
-    browserReplay,
-    browserSetZoom,
-    browserFind,
     transcriptSubscribe,
     transcriptTabId,
     transcriptPath,
@@ -989,6 +798,7 @@ module.exports = {
     transcriptPage,
     transcriptReadRef,
     configPath,
+    configReadText,
     configWriteJson,
     configWriteText,
     configListDir,
@@ -1049,6 +859,7 @@ module.exports = {
     watchersRemove,
     watchersKillTab,
     filesDuplicate,
+    filesSaveBinary,
     docEditRun,
     docEditRunInSession,
     chatRun,

package/src/main/lib/opsOwnership.cjs

@@ -48,8 +48,6 @@ const OWNERS = Object.freeze({
   'scheduler': 'scheduler',
   // Project Home owns the synthesized Brief (generate + hand-edit).
   'project-brief': 'project-home',
-  // Browser tab scratch saves (DOM captures, screenshots, recorded flows).
-  'browser': 'browser',
   // Structured per-tab error log lines (JSONL), tagged for tracing/analysis.
   'logs': 'logs',
   // Host on Bilko.run tab's deterministic bundle prep (dist/index.html +

package/src/main/lib/runLogRetention.cjs

@@ -0,0 +1,358 @@
+'use strict';
+
+/**
+ * runLogRetention.cjs — computes (and, only when explicitly opted in,
+ * applies) a retention policy over `scheduled-plans/runs/`.
+ *
+ * That directory is a machine-level Session-Manager runtime artifact store
+ * (execution logs of the scheduler's own `claude -p` runs), not anything
+ * governed by the per-project single-writer law in opsOwnership.cjs — see
+ * queueStore.cjs's header comment, which draws the same line for
+ * scheduler-machine.json.
+ *
+ * Directory shape: one subdirectory per tick (`RUNS_DIR/<iso-ts>/`, minted by
+ * scheduler.cjs's pickRunDir), which commonly holds MANY different PRD
+ * slugs' artifacts side by side — `<slug>.log`, `<slug>.meta.json`, and an
+ * optional `root-cause-<slug>.md` (rcaReport.cjs) per slug. Retention is
+ * therefore computed per (runId, slug) ENTRY, not per directory: a directory
+ * is only "fully removable" once every entry it holds is independently
+ * eligible AND every file physically present in it is claimed by one of
+ * those entries. Definition-of-done reports
+ * (`definition-of-done-<batchKey>.md`, definitionOfDone.cjs) are keyed by a
+ * hash of a job batch, not a single slug, so they are deliberately left
+ * unclaimed by any entry — their presence in a directory blocks that
+ * directory from being fully removed, but never blocks removal of a claimed
+ * slug's own files.
+ *
+ * SAFETY MODEL (the point of this module — see the PRD that added it):
+ *   - Nothing is ever deleted unless the caller passes settings with
+ *     `schedulerRunLogRetention.enabled === true` AND a non-empty policy.
+ *     Everywhere else (computeReport, and applyRetention with no opt-in)
+ *     this module only READS the filesystem.
+ *   - An entry belonging to a job that is currently live — status `pending`
+ *     (queued), `running`, `needs_review`, or `investigating` (the exact
+ *     literals scheduler.cjs uses; see LIVE_STATUSES) — is never eligible,
+ *     regardless of age or count policy.
+ *   - The most recent entry for any given slug is never eligible, even past
+ *     an age cap — every PRD keeps at least its latest evidence.
+ *   - Age and count policies are COMBINABLE and combine conservatively
+ *     (AND): when both are set, an entry must clear both floors to be
+ *     eligible. A policy is a safety floor, not a removal trigger — setting
+ *     one dimension should never make the other one weaker.
+ */
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const DEFAULT_RUNS_DIR = path.join(
+  os.homedir(),
+  '.claude', 'session-manager', 'scheduled-plans', 'runs'
+);
+
+// Any status that is not yet a terminal outcome. Mirrors the status literals
+// used throughout scheduler.cjs (see e.g. its DOD_SLUG_RE-adjacent status
+// checks) — 'completed' and 'failed' are the only terminal ones.
+const LIVE_STATUSES = new Set(['pending', 'running', 'needs_review', 'investigating']);
+
+const META_SUFFIX = '.meta.json';
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function isLiveJob(job) {
+  return !!job && LIVE_STATUSES.has(job.status);
+}
+
+/**
+ * Build the `${slug}|${runId}` protection set from a scheduler job list
+ * (queueStore.readMergedSync().jobs, or any array with the same shape). Jobs
+ * with no runId yet (never started) have no run directory to protect.
+ *
+ * A `needs_review` job can lose its `runId` (an old queue-schema gap —
+ * scheduler.cjs's own `resolveRunId` backfill exists for the same reason)
+ * while a run directory for its slug still exists on disk. When `runsDir` is
+ * given, every run directory containing `<slug>.log` is protected for such a
+ * job — not just scheduler.cjs's single newest match, since this module has
+ * no way to know which one the job actually corresponds to and protecting
+ * too many is always safe here, never protecting too few.
+ */
+function liveKeysFromJobs(jobs, opts) {
+  const runsDir = opts && opts.runsDir;
+  const keys = new Set();
+  for (const job of jobs || []) {
+    if (!isLiveJob(job) || !job.slug) continue;
+    if (job.runId) {
+      keys.add(`${job.slug}|${job.runId}`);
+      continue;
+    }
+    if (!runsDir) continue;
+    let dirs;
+    try {
+      dirs = fs.readdirSync(runsDir);
+    } catch {
+      continue;
+    }
+    for (const d of dirs) {
+      try {
+        if (fs.existsSync(path.join(runsDir, d, `${job.slug}.log`))) keys.add(`${job.slug}|${d}`);
+      } catch {
+        // skip
+      }
+    }
+  }
+  return keys;
+}
+
+/**
+ * Scan RUNS_DIR into one entry per (runId, slug) pair found via its
+ * `<slug>.meta.json` file. Read-only; never throws on a missing runsDir.
+ */
+function scanRunEntries(runsDir) {
+  let dirEntries;
+  try {
+    dirEntries = fs.readdirSync(runsDir, { withFileTypes: true });
+  } catch (e) {
+    if (e && e.code === 'ENOENT') return [];
+    throw e;
+  }
+
+  const entries = [];
+  for (const de of dirEntries) {
+    if (!de.isDirectory()) continue;
+    const runId = de.name;
+    const dir = path.join(runsDir, runId);
+    let files;
+    try {
+      files = fs.readdirSync(dir);
+    } catch {
+      continue; // vanished between readdir calls
+    }
+
+    const metaFiles = files.filter((f) => f.endsWith(META_SUFFIX));
+    for (const metaFile of metaFiles) {
+      const slug = metaFile.slice(0, -META_SUFFIX.length);
+      const relatedNames = files.filter(
+        (f) => f === metaFile || f === `${slug}.log` || f === `root-cause-${slug}.md`
+      );
+
+      let sizeBytes = 0;
+      let mtimeMs = null;
+      const filePaths = [];
+      for (const name of relatedNames) {
+        const fp = path.join(dir, name);
+        filePaths.push(fp);
+        try {
+          const st = fs.statSync(fp);
+          sizeBytes += st.size;
+          if (mtimeMs === null || st.mtimeMs > mtimeMs) mtimeMs = st.mtimeMs;
+        } catch {
+          // file vanished mid-scan — skip its contribution
+        }
+      }
+
+      let recordedAtMs = null;
+      try {
+        const meta = JSON.parse(fs.readFileSync(path.join(dir, metaFile), 'utf8'));
+        const candidate = meta.finishedAt ?? meta.startedAt;
+        if (typeof candidate === 'number' && Number.isFinite(candidate)) recordedAtMs = candidate;
+      } catch {
+        // corrupt/unreadable meta.json — fall back to file mtime below
+      }
+
+      entries.push({
+        runId,
+        slug,
+        dir,
+        files: filePaths,
+        sizeBytes,
+        timeMs: recordedAtMs ?? mtimeMs ?? 0,
+      });
+    }
+  }
+  return entries;
+}
+
+/**
+ * Evaluate eligibility for each entry against a policy. Returns entries
+ * augmented with { ageDays, rank, isMostRecent, isLive, eligible }.
+ *
+ * @param {Array} entries          Output of scanRunEntries().
+ * @param {{maxAgeDays?: number, keepPerSlug?: number}} policy
+ * @param {{now?: number, liveKeys?: Set<string>}} opts
+ */
+function computeEligibility(entries, policy, opts) {
+  const { maxAgeDays, keepPerSlug } = policy || {};
+  const now = (opts && opts.now) ?? Date.now();
+  const liveKeys = (opts && opts.liveKeys) ?? new Set();
+  const hasPolicy = maxAgeDays != null || keepPerSlug != null;
+
+  const bySlug = new Map();
+  for (const e of entries) {
+    if (!bySlug.has(e.slug)) bySlug.set(e.slug, []);
+    bySlug.get(e.slug).push(e);
+  }
+  const rankOf = new Map();
+  for (const list of bySlug.values()) {
+    list.sort((a, b) => b.timeMs - a.timeMs);
+    list.forEach((e, i) => rankOf.set(e, i));
+  }
+
+  return entries.map((e) => {
+    const rank = rankOf.get(e) ?? 0;
+    const isMostRecent = rank === 0;
+    const isLive = liveKeys.has(`${e.slug}|${e.runId}`);
+    const ageDays = (now - e.timeMs) / DAY_MS;
+    const ageOk = maxAgeDays == null || ageDays > maxAgeDays;
+    const countOk = keepPerSlug == null || rank >= keepPerSlug;
+    const eligible = hasPolicy && !isLive && !isMostRecent && ageOk && countOk;
+    return { ...e, ageDays, rank, isMostRecent, isLive, eligible };
+  });
+}
+
+/**
+ * Read-only report: current usage against runsDir, plus what the given
+ * policy WOULD remove. Never writes or deletes anything.
+ */
+function computeReport(runsDir, policy, opts) {
+  const now = (opts && opts.now) ?? Date.now();
+  const liveKeys = (opts && opts.liveKeys) ?? new Set();
+  const entries = scanRunEntries(runsDir);
+  const evaluated = computeEligibility(entries, policy || {}, { now, liveKeys });
+
+  const totalBytes = entries.reduce((sum, e) => sum + e.sizeBytes, 0);
+  const dirSet = new Set(entries.map((e) => e.dir));
+  const oldestRunAt = entries.length ? Math.min(...entries.map((e) => e.timeMs)) : null;
+
+  const eligible = evaluated.filter((e) => e.eligible);
+  const eligibleBytes = eligible.reduce((sum, e) => sum + e.sizeBytes, 0);
+
+  // A directory is fully removable only when every file physically present
+  // in it belongs to an eligible entry — an unclaimed file (a DoD report, or
+  // a slug entry that isn't eligible) keeps the directory itself alive even
+  // though the eligible entries' own files can still be unlinked.
+  const removableDirs = [];
+  for (const dir of dirSet) {
+    let actualFiles;
+    try {
+      actualFiles = fs.readdirSync(dir);
+    } catch {
+      continue;
+    }
+    if (actualFiles.length === 0) continue;
+    const claimedEligible = new Set();
+    for (const e of evaluated) {
+      if (e.dir !== dir || !e.eligible) continue;
+      for (const fp of e.files) claimedEligible.add(path.basename(fp));
+    }
+    if (actualFiles.every((f) => claimedEligible.has(f))) removableDirs.push(dir);
+  }
+
+  return {
+    generatedAt: now,
+    runsDir,
+    policy: policy || null,
+    usage: {
+      totalBytes,
+      dirCount: dirSet.size,
+      runCount: entries.length,
+      oldestRunAt,
+    },
+    eligible,
+    eligibleSummary: { count: eligible.length, bytes: eligibleBytes },
+    removableDirs,
+  };
+}
+
+/**
+ * True only when settings carry an explicit, well-formed opt-in:
+ * `schedulerRunLogRetention.enabled === true` plus a non-empty policy.
+ */
+function isRetentionEnabled(settings) {
+  const cfg = settings && settings.schedulerRunLogRetention;
+  if (!cfg || cfg.enabled !== true) return false;
+  const policy = cfg.policy;
+  return !!policy && (policy.maxAgeDays != null || policy.keepPerSlug != null);
+}
+
+/**
+ * Resolve the live-job protection set for applyRetention. Prefers whatever
+ * the caller supplied (opts.liveKeys, or opts.jobs to derive it from); if
+ * neither is given AND deletion is actually about to happen, falls back to
+ * reading the real scheduler queue itself via queueStore.cjs (plain Node, no
+ * Electron deps — safe to require here) rather than silently treating no
+ * jobs as live. This is deliberately defense-in-depth: a future caller that
+ * forgets to thread live-job info through must not thereby lose live-job
+ * protection.
+ */
+function resolveLiveKeysForApply(runsDir, opts, enabled) {
+  if (opts && opts.liveKeys) return opts.liveKeys;
+  if (opts && opts.jobs) return liveKeysFromJobs(opts.jobs, { runsDir });
+  if (!enabled) return new Set(); // dry-run path never deletes; no live read needed
+  try {
+    const queueStore = require('./queueStore.cjs');
+    const state = queueStore.readMergedSync();
+    return liveKeysFromJobs(state.jobs || [], { runsDir });
+  } catch {
+    return new Set();
+  }
+}
+
+/**
+ * Compute the report, and — ONLY when isRetentionEnabled(settings) — delete
+ * the eligible files and rmdir any directory left fully empty. With no
+ * opt-in (the default), this is exactly computeReport(): read-only,
+ * `deleted: false`, nothing removed.
+ */
+function applyRetention(runsDir, settings, opts) {
+  const cfg = (settings && settings.schedulerRunLogRetention) || null;
+  const policy = (cfg && cfg.policy) || {};
+  const enabled = isRetentionEnabled(settings);
+  const liveKeys = resolveLiveKeysForApply(runsDir, opts, enabled);
+  const report = computeReport(runsDir, policy, { now: opts && opts.now, liveKeys });
+
+  if (!enabled) {
+    return {
+      deleted: false,
+      reason: 'dry-run: schedulerRunLogRetention.enabled is not true (or has no policy)',
+      report,
+    };
+  }
+
+  let removedFiles = 0;
+  let freedBytes = 0;
+  const errors = [];
+
+  for (const entry of report.eligible) {
+    for (const fp of entry.files) {
+      try {
+        const st = fs.statSync(fp);
+        fs.unlinkSync(fp);
+        removedFiles += 1;
+        freedBytes += st.size;
+      } catch (e) {
+        if (e && e.code !== 'ENOENT') errors.push({ path: fp, error: e.message });
+      }
+    }
+  }
+
+  for (const dir of report.removableDirs) {
+    try {
+      if (fs.readdirSync(dir).length === 0) fs.rmdirSync(dir);
+    } catch (e) {
+      if (e && e.code !== 'ENOENT') errors.push({ path: dir, error: e.message });
+    }
+  }
+
+  return { deleted: true, removedFiles, freedBytes, errors, report };
+}
+
+module.exports = {
+  DEFAULT_RUNS_DIR,
+  LIVE_STATUSES,
+  isLiveJob,
+  liveKeysFromJobs,
+  scanRunEntries,
+  computeEligibility,
+  computeReport,
+  isRetentionEnabled,
+  applyRetention,
+};

package/src/main/lib/summarize.cjs

@@ -5,7 +5,6 @@
  *
  * Single source of truth for the Anthropic summarization call. Used by:
  *   - exchanges.cjs (records durable per-exchange summaries)
- *   - webRemote.cjs (mobile summary push — refactored to import from here)
  *
  * Degrade contracts (never throw — always return a record):
  *   no API key → { summary: text.slice(0,600), model:'raw', degraded:'no_api_key' }