claude-code-session-manager 0.76.0 → 0.78.0

package/src/main/__tests__/scheduler-worktree-cap-defer.test.cjs

@@ -0,0 +1,194 @@
+/**
+ * scheduler-worktree-cap-defer.test.cjs — PRD 1112: a job that cannot get
+ * worktree isolation because the concurrency cap is currently exhausted must
+ * be DEFERRED (left 'pending', retried on the next dispatch pass), never
+ * spawned in a shared working tree the way every OTHER worktree.ok===false
+ * reason (e.g. "not a git repository") still falls back to running in place.
+ *
+ * Drives spawnJob end-to-end against a real git fixture repo, forcing the
+ * cap via SM_JOB_WORKTREE_MAX=1 plus a real occupying worktree (so the cap
+ * check itself, not a mock, is what defers the job).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-worktree-cap-defer.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+let tmpHome;
+let originalHome;
+let originalMax;
+let spawnJob;
+let gitWorktree;
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' });
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
+
+// See scheduler-quiet-machine-lease.test.cjs's identical helper: readQueue()'s
+// per-project discovery walks ~/.claude/projects/*/*.jsonl transcripts for a
+// `cwd` field to find known project queue.json shards.
+function registerActiveProject(cwd) {
+  const projectsDir = path.join(tmpHome, '.claude', 'projects');
+  const slugDir = path.join(projectsDir, `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+function writeProjectQueue(cwd, jobs) {
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  return path.join(stateDir, 'queue.json');
+}
+
+// Stub `claude` binary: writes a marker file into its OWN process.cwd() so a
+// test can prove whether — and where — it was actually spawned, then emits a
+// clean stream-json success result.
+function writeClaudeStub() {
+  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-capdefer-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
+  const body = `
+    const fs = require('fs');
+    const path = require('path');
+    const { execFileSync } = require('child_process');
+    fs.writeFileSync(path.join(process.cwd(), 'ran-here.marker'), 'yes', 'utf8');
+    // Land a real commit + finish-protocol sentinel when possible, so a run
+    // that actually reaches the finish protocol lands 'completed' — a
+    // best-effort no-op when the cwd isn't a git repo (e.g. the non-git
+    // fallback case), where the run parks in needs_review instead, which is
+    // fine — this test only cares whether it ran in place, not its verdict.
+    try {
+      execFileSync('git', ['add', '-A'], { cwd: process.cwd() });
+      execFileSync('git', ['commit', '-q', '-m', 'stub commit'], { cwd: process.cwd() });
+    } catch { /* not a git repo — best-effort only */ }
+    process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok\\nSCHEDULER_VERDICT: PASS' }) + '\\n');
+    process.exit(0);
+  `;
+  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
+  return stubPath;
+}
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-worktree-cap-defer-'));
+  process.env.HOME = tmpHome;
+  originalMax = process.env.SM_JOB_WORKTREE_MAX;
+  ({ spawnJob } = require('../scheduler.cjs'));
+  gitWorktree = require('../lib/gitWorktree.cjs');
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  if (originalMax === undefined) delete process.env.SM_JOB_WORKTREE_MAX;
+  else process.env.SM_JOB_WORKTREE_MAX = originalMax;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+afterEach(() => {
+  delete process.env.SM_CLAUDE_BIN;
+  delete process.env.SM_JOB_WORKTREE_MAX;
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+});
+
+test('a job held behind the worktree cap stays pending with a heldReason, is never spawned in place, and dispatches once the cap frees up', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-worktree-cap-defer-project-'));
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const slug = `1112-test-held-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Held behind the worktree cap.', 'utf8');
+  const queuePath = writeProjectQueue(projectCwd, [{ slug, status: 'pending', cwd: projectCwd }]);
+
+  process.env.SM_JOB_WORKTREE_MAX = '1';
+  process.env.SM_CLAUDE_BIN = writeClaudeStub();
+
+  // Occupy the single worktree slot with a REAL checkout, so the cap check
+  // spawnJob relies on is exercising the actual gitWorktree plumbing, not a
+  // mock.
+  const occupier = await gitWorktree.createJobWorktree({ cwd: projectCwd, slug: 'occupier' });
+  expect(occupier.ok).toBe(true);
+
+  const runId = `run-${slug}`;
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+
+  try {
+    await spawnJob({ slug, cwd: projectCwd }, runId, runDir, projectCwd);
+
+    // Held: still pending, never spawned, heldReason visible on the row.
+    let jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+    let row = jobs.find((j) => j.slug === slug);
+    expect(row.status).toBe('pending');
+    expect(row.heldReason).toMatch(/worktree cap reached/);
+    expect(fs.existsSync(path.join(projectCwd, 'ran-here.marker'))).toBe(false);
+    expect(fs.existsSync(path.join(occupier.dir, 'ran-here.marker'))).toBe(false);
+
+    // Free the cap (mirrors cleanupJobWorktree releasing the counter), then
+    // retry — the held job dispatches on this next pass, exactly like a
+    // sessionSlots-blocked job retries once a slot frees up.
+    await gitWorktree.cleanupJobWorktree({ cwd: projectCwd, dir: occupier.dir, branch: occupier.branch });
+
+    await spawnJob({ slug, cwd: projectCwd }, `${runId}-2`, runDir, projectCwd);
+
+    jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+    row = jobs.find((j) => j.slug === slug);
+    expect(row.status).toBe('completed');
+    expect(row.heldReason).toBeUndefined();
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+}, 30_000);
+
+test('a non-git cwd still falls back to running in place (unchanged behaviour — only cap-reached is a deferral)', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-worktree-cap-defer-nongit-'));
+  fs.mkdirSync(projectCwd, { recursive: true }); // deliberately NOT a git repo
+  registerActiveProject(projectCwd);
+
+  const slug = `1112-test-nongit-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Non-git cwd, must run in place.', 'utf8');
+  const queuePath = writeProjectQueue(projectCwd, [{ slug, status: 'pending', cwd: projectCwd }]);
+
+  process.env.SM_CLAUDE_BIN = writeClaudeStub();
+
+  const runId = `run-${slug}`;
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+
+  try {
+    await spawnJob({ slug, cwd: projectCwd }, runId, runDir, projectCwd);
+
+    const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+    const row = jobs.find((j) => j.slug === slug);
+    // Not held/deferred — it actually ran (a non-git cwd can't commit, so it
+    // parks in needs_review rather than completed; this test only cares that
+    // it was dispatched in place, not its exact verdict).
+    expect(row.status).not.toBe('pending');
+    expect(row.heldReason).toBeUndefined();
+    expect(row.worktreeFallbackReason).toMatch(/not a git repository/);
+    // Ran IN PLACE — the marker landed directly in projectCwd, not a worktree.
+    expect(fs.existsSync(path.join(projectCwd, 'ran-here.marker'))).toBe(true);
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+}, 30_000);

package/src/main/__tests__/seedAgentPersonas.test.cjs

@@ -54,22 +54,20 @@ function silentLogger() {
   return { log: () => {}, warn: () => {} };
 }
 
-test('fresh seed writes both persona files', async () => {
-  await seedAgentPersonas({ logger: silentLogger() });
+const ALL_PERSONAS = ['architect', 'dev-lead', 'project-home-builder'];
 
-  const architect = path.join(agentsDir(), 'architect.md');
-  const devLead = path.join(agentsDir(), 'dev-lead.md');
-  expect(fs.existsSync(architect)).toBe(true);
-  expect(fs.existsSync(devLead)).toBe(true);
+test('fresh seed writes every persona file', async () => {
+  await seedAgentPersonas({ logger: silentLogger() });
 
-  const bundledArchitect = fs.readFileSync(
-    path.join(__dirname, '..', '..', 'seed', 'agents', 'architect.md'),
-    'utf8'
-  );
-  expect(fs.readFileSync(architect, 'utf8')).toBe(bundledArchitect);
+  for (const name of ALL_PERSONAS) {
+    const dest = path.join(agentsDir(), `${name}.md`);
+    expect(fs.existsSync(dest)).toBe(true);
+    const bundled = fs.readFileSync(path.join(__dirname, '..', '..', 'seed', 'agents', `${name}.md`), 'utf8');
+    expect(fs.readFileSync(dest, 'utf8')).toBe(bundled);
+  }
 
   const marker = JSON.parse(fs.readFileSync(markerPath(), 'utf8'));
-  expect(marker.done).toBe(true);
+  expect(marker.seeded.sort()).toEqual([...ALL_PERSONAS].sort());
 });
 
 test('a pre-existing persona file is left byte-identical', async () => {
@@ -81,20 +79,83 @@ test('a pre-existing persona file is left byte-identical', async () => {
   await seedAgentPersonas({ logger: silentLogger() });
 
   expect(fs.readFileSync(architect, 'utf8')).toBe(customContent);
-  // dev-lead had no pre-existing file, so it should still be seeded.
+  // dev-lead and project-home-builder had no pre-existing file, so they should still be seeded.
   expect(fs.existsSync(path.join(agentsDir(), 'dev-lead.md'))).toBe(true);
+  expect(fs.existsSync(path.join(agentsDir(), 'project-home-builder.md'))).toBe(true);
 });
 
-test('done:true marker short-circuits without touching agents dir', async () => {
+test('a machine already fully seeded under the old done:true marker only picks up a newly added persona', async () => {
   const mPath = markerPath();
   fs.mkdirSync(path.dirname(mPath), { recursive: true });
+  // Legacy marker shape from before the seeded-set change — no `seeded` array.
   fs.writeFileSync(mPath, JSON.stringify({ done: true, attempts: 1, ts: '2026-01-01T00:00:00.000Z' }));
+  fs.mkdirSync(agentsDir(), { recursive: true });
+  fs.writeFileSync(path.join(agentsDir(), 'architect.md'), 'old architect content\n');
+  fs.writeFileSync(path.join(agentsDir(), 'dev-lead.md'), 'old dev-lead content\n');
+
+  await seedAgentPersonas({ logger: silentLogger() });
+
+  // Pre-existing files from the old run are untouched...
+  expect(fs.readFileSync(path.join(agentsDir(), 'architect.md'), 'utf8')).toBe('old architect content\n');
+  expect(fs.readFileSync(path.join(agentsDir(), 'dev-lead.md'), 'utf8')).toBe('old dev-lead content\n');
+  // ...but the newly added persona is delivered.
+  expect(fs.existsSync(path.join(agentsDir(), 'project-home-builder.md'))).toBe(true);
+
+  const marker = JSON.parse(fs.readFileSync(mPath, 'utf8'));
+  expect(marker.seeded.sort()).toEqual([...ALL_PERSONAS].sort());
+});
+
+test('a machine already seeded under the new seeded-set marker picks up a newly added persona', async () => {
+  const mPath = markerPath();
+  fs.mkdirSync(path.dirname(mPath), { recursive: true });
+  fs.writeFileSync(mPath, JSON.stringify({ seeded: ['architect', 'dev-lead'], attempts: 0, ts: '2026-01-01T00:00:00.000Z' }));
+
+  await seedAgentPersonas({ logger: silentLogger() });
+
+  expect(fs.existsSync(path.join(agentsDir(), 'project-home-builder.md'))).toBe(true);
+  const marker = JSON.parse(fs.readFileSync(mPath, 'utf8'));
+  expect(marker.seeded.sort()).toEqual([...ALL_PERSONAS].sort());
+});
+
+test('a machine with every known persona already in the seeded set short-circuits without touching agents dir', async () => {
+  const mPath = markerPath();
+  fs.mkdirSync(path.dirname(mPath), { recursive: true });
+  fs.writeFileSync(mPath, JSON.stringify({ seeded: ALL_PERSONAS, attempts: 0, ts: '2026-01-01T00:00:00.000Z' }));
 
   await seedAgentPersonas({ logger: silentLogger() });
 
   expect(fs.existsSync(agentsDir())).toBe(false);
 });
 
+test('a corrupt/unparseable marker file still seeds correctly', async () => {
+  const mPath = markerPath();
+  fs.mkdirSync(path.dirname(mPath), { recursive: true });
+  fs.writeFileSync(mPath, '{ not valid json');
+
+  await seedAgentPersonas({ logger: silentLogger() });
+
+  for (const name of ALL_PERSONAS) {
+    expect(fs.existsSync(path.join(agentsDir(), `${name}.md`))).toBe(true);
+  }
+});
+
+test('the bundled project-home-builder persona contains no session-manager-repo paths', () => {
+  const content = fs.readFileSync(
+    path.join(__dirname, '..', '..', 'seed', 'agents', 'project-home-builder.md'),
+    'utf8'
+  );
+  const forbidden = [
+    'session-manager-operations/architecture/',
+    '.claude/agents/',
+    'session-manager-operations/design-mocks/',
+    'scripts/',
+    'npm run build:project-pages',
+  ];
+  for (const substr of forbidden) {
+    expect(content).not.toContain(substr);
+  }
+});
+
 test('SM_SEED_AGENT_PERSONAS_DISABLE=1 short-circuits', async () => {
   process.env.SM_SEED_AGENT_PERSONAS_DISABLE = '1';
 

package/src/main/config.cjs

@@ -148,6 +148,9 @@ function validateWrite(realAbs) {
       //                    (PRD 825; scheduler.cjs remote.writePrd)
       //   project-brief    projectBrief.cjs's brief.json (PRD 837)
       //   bilko-host       bilkoHost.cjs's bundle prep
+      //   project-pages    projectHomeAdminRoutes.cjs's app-side render path
+      //                    (summary.json/picks.json/output/*; PRD:
+      //                    project-home-admin-routes)
       // Paths come from opsOwnership.opsPath (PRD 1082) — the one ops-root
       // resolver — which THROWS for an ephemeral root (a linked worktree that
       // pty.cjs registered as an allowed root for its spawn cwd, or
@@ -155,7 +158,7 @@ function validateWrite(realAbs) {
       // never a writable destination, so its exemptions simply do not exist.
       let opsSubs;
       try {
-        opsSubs = ['prompt-sessions', 'scheduler', 'project-brief', 'bilko-host'].map((ns) => opsPath(realRoot, ns));
+        opsSubs = ['prompt-sessions', 'scheduler', 'project-brief', 'bilko-host', 'project-pages'].map((ns) => opsPath(realRoot, ns));
       } catch {
         opsSubs = [];
       }

package/src/main/index.cjs

@@ -27,6 +27,7 @@ const scheduler = require('./scheduler.cjs');
 const { createAdminHttp } = require('./lib/localAdminHttp.cjs');
 const prdCreate = require('./lib/prdCreate.cjs');
 const prdAdminRoutes = require('./lib/prdAdminRoutes.cjs');
+const projectHomeAdminRoutes = require('./lib/projectHomeAdminRoutes.cjs');
 const { appendAuditEvent } = require('./lib/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
@@ -36,7 +37,7 @@ const epicWorktreeMint = require('./lib/epicWorktreeMint.cjs');
 const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
 const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
-const { checkDelegationReadiness, installPrdWriteGuard } = require('./lib/delegationReadiness.cjs');
+const { checkDelegationReadiness, installPrdWriteGuard, installDestructiveGitGuard } = require('./lib/delegationReadiness.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
@@ -45,6 +46,7 @@ const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
 prdCreate.registerAdminRoute(adminHttp, scheduler.remote);
 prdAdminRoutes.registerAdminRoute(adminHttp, scheduler.remote);
+projectHomeAdminRoutes.registerAdminRoute(adminHttp);
 chatRunner.registerAdminRoute(adminHttp);
 // Project-to-project feedback conduit — the app is the only process holding
 // several projects' operations roots open, so it performs the cross-folder
@@ -69,7 +71,7 @@ const schedulerConfig = require('./lib/schedulerConfig.cjs');
 const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
 const { registerProjectBriefIpc } = require('./projectBrief.cjs');
-const { registerProjectPagesIpc } = require('./projectPages.cjs');
+const { registerProjectPagesIpc, attachWindow: attachProjectPagesWindow, closeAllOutputWatchers: closeAllProjectPagesWatchers } = require('./projectPages.cjs');
 const { registerBilkoHostIpc } = require('./bilkoHost.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { computeEpicDelegationStats } = require('./lib/epicDelegationStats.cjs');
@@ -300,6 +302,7 @@ function relaunchViaNpx() {
 async function rebootApp() {
   ptyManager.killAll();
   configMgr.closeAllWatchers();
+  closeAllProjectPagesWatchers();
   transcripts.closeAll();
   watchers.manager.killAll();
 
@@ -326,6 +329,7 @@ async function rebootApp() {
     chatRunner.attachWindow(mainWindow);
     promptSessionEvents.attachWindow(mainWindow);
     attachDocEditWindow(mainWindow);
+    attachProjectPagesWindow(mainWindow);
     rebooting = false;
     return;
   }
@@ -509,12 +513,17 @@ ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadiness
   checkDelegationReadiness(payload)
 ));
 
-// The one readiness check with a sanctioned one-press install. Session Manager
+// The two readiness checks with a sanctioned one-press install. Session Manager
 // standardizes on the REFERENCE approach (absolute path to this repo's guard
-// script, never a vendored copy) — see installPrdWriteGuard's header.
+// script, never a vendored copy) — see installPrdWriteGuard's header. They stay
+// two handlers (and two PreToolUse entries) because the hooks have different
+// matchers: Write|Edit|NotebookEdit vs Bash — installDestructiveGitGuard's header.
 ipcMain.handle('app:install-prd-write-guard', validated(schemas.delegationReadinessCwd, (payload) =>
   installPrdWriteGuard(payload)
 ));
+ipcMain.handle('app:install-destructive-git-guard', validated(schemas.delegationReadinessCwd, (payload) =>
+  installDestructiveGitGuard(payload)
+));
 
 ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE_RULES || null);
 
@@ -1168,6 +1177,7 @@ app.whenReady().then(async () => {
   chatRunner.attachWindow(mainWindow);
   promptSessionEvents.attachWindow(mainWindow);
   attachDocEditWindow(mainWindow);
+  attachProjectPagesWindow(mainWindow);
   // Scheduler ownership (PRD 834): exactly one instance machine-wide runs
   // scheduler mutation (boot reconciliation, ticking, sweep, supervisor) and
   // the admin API. Electron's own single-instance lock is keyed by userData
@@ -1344,6 +1354,7 @@ app.on('window-all-closed', () => {
   if (rebooting) return; // new window is about to be created
   ptyManager.killAll();
   configMgr.closeAllWatchers();
+  closeAllProjectPagesWatchers();
   transcripts.closeAll();
   watchers.manager.killAll();
   if (process.platform !== 'darwin') app.quit();
@@ -1358,6 +1369,7 @@ app.on('before-quit', () => {
   supervisor.stopSupervisor();
   ptyManager.killAll();
   configMgr.closeAllWatchers();
+  closeAllProjectPagesWatchers();
   transcripts.closeAll();
   watchers.manager.killAll();
   adminHttp.stop().catch(() => {});

package/src/main/ipcSchemas.cjs

@@ -10,6 +10,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { PromptSessionSchema, EpicTagSchema, EpicSourceSchema, EpicIntakeSectionSchema } = require('./lib/promptSessionSchema.cjs');
 const { PrdWorkTypeSchema } = require('./lib/workTypeLibrary.cjs');
+const { PERSONA_NAME_RE } = require('./agentLibrary.cjs');
 const { AgentPersonaSaveSchema } = require('./lib/agentPersonaSchema.cjs');
 
 // ──────────────────────────────────────────── PTY
@@ -224,6 +225,12 @@ const promptSessionsMergeToMain = z.object({
   epicId: z.string().regex(PROMPT_SESSION_ID_RE),
   branch: z.string().regex(/^sm-epic\/[A-Za-z0-9_-]{1,64}$/),
   dir: z.string().min(1).max(4096),
+  // Base-tree WIP paths carried into this worktree at creation time
+  // (gitWorktree.cjs's createWorktree, PRD 1094) — threaded through so
+  // integrateEpicBranch can apply the same carried-wip-only skip the job
+  // path already gets. Absent on a worktree created before this field
+  // existed, or one whose base tree was clean at creation.
+  carriedPaths: z.array(z.string().min(1).max(4096)).max(2000).optional(),
 });
 
 // Renderer entry points for the per-project "disable Epic worktree
@@ -299,6 +306,13 @@ const PRD_CREATE_SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 // frontmatter-shaped lines into the body. Block newlines at the boundary
 // instead of trying to escape them later.
 const NO_NEWLINE_RE = /^[^\r\n]*$/;
+// WHO executes a PRD — a persona name (agentLibrary.cjs's PERSONA_NAME_RE),
+// distinct from `tag` (the WORK TYPE, above). Not a closed enum here: the
+// Agent Library is user-editable, so the actual FK check (does this name
+// resolve to a readable persona file) happens at write time in
+// prdCreate.cjs's createPrd via prdAgentType.cjs's assertAgentTypeWritable —
+// this schema only enforces the name SHAPE.
+const PrdAgentTypeSchema = z.string().regex(PERSONA_NAME_RE, 'agent name must be lowercase, hyphenated (e.g. "dev-lead")');
 const schedulerCreatePrd = z.object({
   title: z.string().min(1).max(200).regex(NO_NEWLINE_RE, 'must not contain newlines'),
   // Optional (PRD: worktree-cwd Epic-lookup hazard) — when omitted, prdCreate.cjs's
@@ -352,6 +366,18 @@ const schedulerCreatePrd = z.object({
   // excluded here for the same reason adminPrdFrontmatterPatch excludes it
   // below — a discussion-tagged Epic never reaches PRD authoring.
   tag: PrdWorkTypeSchema.optional(),
+  // WHO executes this PRD (persona name, `~/.claude/agents/<name>.md`) —
+  // independent of `tag` above. Optional: prdCreate.cjs's buildPrdBody fills
+  // in DEFAULT_PRD_AGENT_TYPE ('dev-lead') when omitted.
+  agentType: PrdAgentTypeSchema.optional(),
+  // Opt-in exclusive-lease flag (PRD 1107): the scheduler dispatches this PRD
+  // only once zero other jobs are running machine-wide, and holds every other
+  // job off the whole session-slot pool while it runs — for a PRD whose
+  // acceptance criteria are wall-clock/timing measurements (frame time,
+  // performance fences) that CPU contention from sibling jobs would otherwise
+  // invalidate. See prdCreate.cjs's buildPrdBody and schedulerBatch.cjs's
+  // pickNextBatch.
+  quietMachine: z.boolean().optional(),
 });
 
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
@@ -418,12 +444,17 @@ const adminPrdFrontmatterPatch = z.object({
   // discussion-tagged Epic never reaches PRD authoring) — see
   // workTypeLibrary.cjs's PrdWorkTypeSchema.
   tag: PrdWorkTypeSchema.optional(),
+  // WHO executes this PRD — patchable after creation too, same as `tag`.
+  agentType: PrdAgentTypeSchema.optional(),
   // Provenance stamp (PRD-authoring lockdown). Free-text rather than an enum
   // — 'scheduler-api' (create-time) and 'legacy-adopted' (migration/manual
   // adopt) are the two values this codebase writes today, but the field
   // itself is descriptive, not a closed set.
   createdVia: z.string().min(1).max(64).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
   issuedAt: z.string().min(1).max(64).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
+  // Opt-in exclusive-lease flag (PRD 1107) — patchable after creation too,
+  // same as every other recognized key here.
+  quietMachine: z.boolean().optional(),
 });
 
 const adminUpdatePrd = z.object({
@@ -565,6 +596,8 @@ const projectBriefCwd = z.object({
 }).strict();
 
 // ──────────────────────────────────────────── Delegation readiness
+// Shared by app:delegation-readiness, app:install-prd-write-guard and
+// app:install-destructive-git-guard — all three take exactly { cwd }.
 const delegationReadinessCwd = z.object({
   cwd: z.string().min(1).max(4096),
 }).strict();
@@ -582,6 +615,23 @@ const projectPagesCwd = z.object({
   cwd: z.string().min(1).max(4096),
 }).strict();
 
+// ──────────────────────────────────────────── Project Home admin routes
+// (PRD: project-home-admin-routes). Same validation split as
+// projectPagesCwd above: real path validation is projectRootResolve.cjs +
+// config.cjs's validatePath at first fs access.
+const projectHomeAdminCwdQuery = z.object({
+  cwd: z.string().min(1).max(4096),
+}).strict();
+const projectHomeAdminValidateSummaryBody = z.object({
+  cwd: z.string().min(1).max(4096),
+  summary: z.unknown(),
+}).strict();
+const projectHomeAdminRenderBody = z.object({
+  cwd: z.string().min(1).max(4096),
+  summary: z.unknown(),
+  picks: z.unknown(),
+}).strict();
+
 // ──────────────────────────────────────────── Host on Bilko.run
 // Same validation split: real path validation is config.cjs's validatePath
 // at first fs access in bilkoHost.cjs — these schemas only bound wire shape.
@@ -990,6 +1040,9 @@ module.exports = {
     memoryStale,
     projectBriefCwd,
     projectPagesCwd,
+    projectHomeAdminCwdQuery,
+    projectHomeAdminValidateSummaryBody,
+    projectHomeAdminRenderBody,
     bilkoHostCwd,
     bilkoHostPrepareBundle,
     bilkoHostAddDocument,

package/src/main/lib/__tests__/childWithLog.test.cjs

@@ -61,3 +61,81 @@ describe('childWithLog post-exit group sweep (PRD 1065)', () => {
     15000,
   );
 });
+
+// PRD 1110 — the sweep above kills silently; onExit must also report what it
+// swept so a project whose jobs leak repeatedly can see it instead of
+// inferring it from ps.
+describe('childWithLog onExit leakedDescendants reporting (PRD 1110)', () => {
+  it.skipIf(process.platform !== 'linux')(
+    'reports the same backgrounded grandchild the sweep reaped',
+    async () => {
+      dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-child-leak-'));
+      const logPath = path.join(dir, 'job.log');
+      const pidFile = path.join(dir, 'grandchild.pid');
+      const { fd, safeLog, closeFd } = openLog(logPath);
+
+      const exitInfo = await new Promise((resolve) => {
+        withChildAndLog({
+          fd,
+          logPath,
+          safeLog,
+          closeFd,
+          spawn: {
+            command: 'sh',
+            args: [
+              '-c',
+              `sleep 30 & echo $! > ${pidFile}; exec sleep 0.2`,
+            ],
+            options: { detached: true },
+          },
+          onExit: (info) => resolve(info),
+        });
+      });
+
+      for (let i = 0; i < 20 && !fs.existsSync(pidFile); i++) {
+        await new Promise((r) => setTimeout(r, 50));
+      }
+      const grandchildPid = Number(fs.readFileSync(pidFile, 'utf8').trim());
+
+      expect(Array.isArray(exitInfo.leakedDescendants)).toBe(true);
+      expect(exitInfo.leakedDescendants.length).toBeGreaterThan(0);
+      const found = exitInfo.leakedDescendants.find((p) => p.pid === grandchildPid);
+      expect(found).toBeTruthy();
+      expect(found.comm).toBeTruthy();
+      expect(typeof found.pcpu).toBe('number');
+      expect(typeof found.etimes).toBe('number');
+
+      // Let the sweep's SIGTERM->SIGKILL cascade finish so the grandchild
+      // doesn't leak past this test.
+      await new Promise((r) => setTimeout(r, POST_EXIT_GROUP_SWEEP_GRACE_MS + 1000));
+    },
+    15000,
+  );
+
+  it.skipIf(process.platform !== 'linux')(
+    'reports [] for a clean job that leaked nothing',
+    async () => {
+      dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-child-clean-'));
+      const logPath = path.join(dir, 'job.log');
+      const { fd, safeLog, closeFd } = openLog(logPath);
+
+      const exitInfo = await new Promise((resolve) => {
+        withChildAndLog({
+          fd,
+          logPath,
+          safeLog,
+          closeFd,
+          spawn: {
+            command: 'sh',
+            args: ['-c', 'exit 0'],
+            options: { detached: true },
+          },
+          onExit: (info) => resolve(info),
+        });
+      });
+
+      expect(exitInfo.leakedDescendants).toEqual([]);
+    },
+    15000,
+  );
+});