claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/index.cjs

@@ -1,3 +1,8 @@
+const { PROC_NAMES, setProcessTitle, inhibitHolderShell } = require('./lib/smProcNames.cjs');
+// Self-describing `comm` in System Monitor (pn-03). process.argv is a JS copy
+// made at startup, so the argv-memory overwrite below never affects the
+// `process.argv.includes('--simple')` read further down.
+setProcessTitle(PROC_NAMES.main);
 const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, powerSaveBlocker, protocol } = require('electron');
 const { spawn, execFile, execFileSync } = require('node:child_process');
 const path = require('node:path');
@@ -37,7 +42,12 @@ const epicWorktreeMint = require('./lib/epicWorktreeMint.cjs');
 const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
 const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
-const { checkDelegationReadiness, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard } = require('./lib/delegationReadiness.cjs');
+const agentModelResolve = require('./lib/agentModelResolve.cjs');
+const { resolveEffectiveModelInfo } = require('./lib/effectiveModelInfo.cjs');
+const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard, installSelfScheduleGuard } = require('./lib/delegationReadiness.cjs');
+const { resolveProjectContext } = require('./lib/projectRootResolve.cjs');
+const upgradeDrain = require('./lib/upgradeDrain.cjs');
+const { writeGuardShims } = require('./lib/guardShims.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
@@ -54,7 +64,6 @@ chatRunner.registerAdminRoute(adminHttp);
 crossProjectFeedback.registerAdminRoute(adminHttp);
 const supervisor = require('./supervisor.cjs');
 const watchers = require('./watchers.cjs');
-const teams = require('./teams.cjs');
 const queueOps = require('./queueOps.cjs');
 const pluginInstall = require('./pluginInstall.cjs');
 const { seedDevPlugin } = require('./seedDevPlugin.cjs');
@@ -70,7 +79,7 @@ const telemetryConsent = require('./lib/telemetryConsent.cjs');
 const { registerHistoryAggregatorHandlers, finalizeClosedDays, refreshIntradayToday } = require('./historyAggregator.cjs');
 const runLogRetention = require('./lib/runLogRetention.cjs');
 const { registerHistoryDashboardHandlers } = require('./historyDashboard.cjs');
-const { tryAcquireLock, releaseLock, DEFAULT_LOCK_PATH } = require('../../scripts/lib/watchdogHelpers.cjs');
+const { tryAcquireLock, releaseLock, DEFAULT_LOCK_PATH } = require('./lib/watchdogHelpers.cjs');
 const schedulerConfig = require('./lib/schedulerConfig.cjs');
 const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
@@ -90,7 +99,8 @@ const { checkInsideHome, assertInsideHome } = require('./lib/insideHome.cjs');
 const { openInEditor, openFileInEditor, openInFinder, openInTerminal } = require('./lib/openExternalApp.cjs');
 const { rebuildActiveIndex } = require('./lib/activeIndexRebuild.cjs');
 const { activeIndexPath: promptSessionsActiveIndexPath } = require('./lib/epicMint.cjs');
-const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
+const { allProjectCwds } = require('./lib/activeSessions.cjs');
+const { scheduleBootSelfHeal } = require('./lib/bootSelfHeal.cjs');
 
 let mainWindow = null;
 let rebooting = false;
@@ -130,7 +140,10 @@ function startSystemdInhibit() {
       '--who=Claude Session Manager',
       '--why=Scheduler polling and claude -p jobs must survive idle',
       '--mode=block',
-      'sh', '-c', `while kill -0 ${process.pid} 2>/dev/null; do sleep 5; done`,
+      // sm-inhibit-hold: aliased shell so the permanent holder is attributable
+      // in System Monitor (its `sleep 5` child stays a bare `sleep`, parented
+      // under it). Falls back to plain /bin/sh if the alias can't be made.
+      inhibitHolderShell(), '-c', `while kill -0 ${process.pid} 2>/dev/null; do sleep 5; done`,
     ], { stdio: 'ignore', detached: false });
     child.on('error', (e) => {
       logs.writeLine({ scope: 'main', level: 'warn', message: 'systemd-inhibit spawn failed', meta: { error: e?.message } });
@@ -303,7 +316,26 @@ function relaunchViaNpx() {
   return child;
 }
 
-async function rebootApp() {
+/**
+ * rebootApp({force}) — restart is a REQUEST that drains first and never kills
+ * (lib/upgradeDrain.cjs): dispatch pauses, running jobs finish, then the
+ * scheduler's heartbeat-driven drain calls performReboot(). `force: true`
+ * keeps the old immediate behaviour (kills running executors) for humans who
+ * accept the cost.
+ */
+async function rebootApp({ force = false } = {}) {
+  if (force) {
+    logReboot('force reboot requested — immediate, not draining');
+    return performReboot();
+  }
+  const request = upgradeDrain.requestRestart({ reason: 'user-reboot', requestedBy: 'user' });
+  logReboot(`restart requested (drain first): ${request.requestedAt}`);
+}
+
+// Registered as the scheduler's drain-complete exit path (zero running jobs).
+scheduler.setRestartHandler(() => performReboot());
+
+async function performReboot() {
   ptyManager.killAll();
   configMgr.closeAllWatchers();
   closeAllProjectPagesWatchers();
@@ -338,6 +370,9 @@ async function rebootApp() {
     return;
   }
 
+  // Bounded-lifetime marker: the watchdog must not relaunch a second instance
+  // during this deliberate exit window (single-instance-lock race).
+  upgradeDrain.markRestarting();
   let childOk = false;
   try {
     const child = relaunchViaNpx();
@@ -520,12 +555,88 @@ ipcMain.handle('agents:remove-override', async (_e, payload) => {
 ipcMain.handle('agents:get-persona-body', validated(schemas.agentsGetPersonaBody, (payload) =>
   agentLibrary.getPersonaBody(payload)));
 
+// "What will this Epic's launch actually use for --model?" — the SAME
+// resolver chatRunner.cjs's Chat-view launch calls in-process
+// (agentModelResolve.cjs's resolveEpicModel), reached here so Terminal's
+// launch (EpicTerminalPane.tsx, a renderer module with no fs access) agrees
+// with Chat by calling the identical function rather than a second one that
+// is merely supposed to. Never throws (resolveEpicModel's own contract).
+ipcMain.handle('agents:resolve-epic-model', validated(schemas.agentsResolveEpicModel, (payload) =>
+  agentModelResolve.resolveEpicModel(payload)));
+
+// "What will this Epic actually run as?" (PRD: effective-model-resolver) —
+// persona alias + evidence-based concrete model id + provenance, for a given
+// (cwd, agentType). Read-only observer; never affects what a launch resolves.
+ipcMain.handle('agents:resolve-model-info', validated(schemas.agentsResolveModelInfo, (payload) =>
+  resolveEffectiveModelInfo(payload)));
+
 // "Can this project actually delegate?" probe (PRD: delegation-readiness).
 // Structured data over the preconditions for scheduler_create_prd being in an
 // agent's tool list at all — surfacing it in the UI is a sibling PRD.
-ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadinessCwd, async (payload) =>
-  checkDelegationReadiness(payload)
-));
+//
+// Self-heals BEFORE computing the checks (PRD: guards-auto-install) — Fix It
+// used to be the only call site for the three guard installers, so every
+// project the human opened started red and demanded three manual clicks.
+// ensureGuardsInstalled never rejects on its own, but it is still awaited
+// inside a try/catch here so a future change to it can never turn this into
+// a rejected IPC handler.
+//
+// `cwd` is normalized to its real project root via the SAME resolver
+// prdAdminRoutes.cjs's session_manager_help readiness route already uses
+// (projectRootResolve.cjs's resolveProjectContext) before either the install
+// or the read-back check runs, so a worktree/ops-internal cwd can't install
+// into one path while the banner reads another.
+ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadinessCwd, async (payload) => {
+  const resolved = resolveProjectContext({ cwd: payload.cwd });
+  const cwd = resolved.cwd || payload.cwd;
+  try {
+    await ensureGuardsInstalled(cwd);
+  } catch { /* auto-install must never block the readiness probe itself */ }
+  return checkDelegationReadiness({ ...payload, cwd });
+}));
+
+// Every guard-install attempt is logged from MAIN, not the renderer — a
+// press that never reaches this process (e.g. a renderer talking to an
+// older main with no handler for the channel, Electron's own "No handler
+// registered for ..." rejection) leaves no line here, which is exactly what
+// makes it distinguishable from a press that reached main and failed. Uses
+// opsErrorLog.appendError (the sole writer of the `logs` ops namespace) so
+// the record lands in the project's own
+// session-manager-operations/logs/errors-<date>.jsonl, same shape as every
+// other structured error line.
+function logGuardInstallAttempt(guard, cwd, outcome) {
+  const opsErrorLog = require('./lib/opsErrorLog.cjs');
+  opsErrorLog.appendError({
+    cwd,
+    scope: 'delegationReadinessGuardInstall',
+    level: outcome.ok ? 'info' : 'error',
+    message: outcome.ok
+      ? `${guard} install ${outcome.action}`
+      : `${guard} install failed: ${outcome.error || 'unknown error'}`,
+    meta: { guard, ...outcome },
+  });
+}
+
+async function handleGuardInstall(guard, installFn, payload) {
+  // Normalized the SAME way the sibling app:delegation-readiness handler
+  // above normalizes cwd, before either installing or logging — without
+  // this, a worktree/ops-internal cwd installs the guard into an ephemeral
+  // `.claude/settings.json` that vanishes with the worktree (this repo's
+  // "Worktree cwd ops-root hazard" incident class), diverging from the
+  // main-tree root the readiness banner (and its own auto-heal path,
+  // ensureGuardsInstalled) actually reads.
+  const resolved = resolveProjectContext({ cwd: payload.cwd });
+  const cwd = resolved.cwd || payload.cwd;
+  const normalizedPayload = { ...payload, cwd };
+  try {
+    const result = await installFn(normalizedPayload);
+    logGuardInstallAttempt(guard, cwd, result);
+    return result;
+  } catch (err) {
+    logGuardInstallAttempt(guard, cwd, { ok: false, action: 'error', error: err?.message ?? String(err) });
+    throw err;
+  }
+}
 
 // The three readiness checks with a sanctioned one-press install. Session
 // Manager standardizes on the REFERENCE approach (absolute path to this
@@ -536,13 +647,16 @@ ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadiness
 // header. inline-implementation-guard shares prd-write-guard's matcher, so
 // its installer appends into that SAME matcher's `hooks` array instead.
 ipcMain.handle('app:install-prd-write-guard', validated(schemas.delegationReadinessCwd, (payload) =>
-  installPrdWriteGuard(payload)
+  handleGuardInstall('prd-write-guard', installPrdWriteGuard, payload)
 ));
 ipcMain.handle('app:install-destructive-git-guard', validated(schemas.delegationReadinessCwd, (payload) =>
-  installDestructiveGitGuard(payload)
+  handleGuardInstall('destructive-git-guard', installDestructiveGitGuard, payload)
 ));
 ipcMain.handle('app:install-inline-implementation-guard', validated(schemas.delegationReadinessCwd, (payload) =>
-  installInlineImplementationGuard(payload)
+  handleGuardInstall('inline-implementation-guard', installInlineImplementationGuard, payload)
+));
+ipcMain.handle('app:install-self-schedule-guard', validated(schemas.delegationReadinessCwd, (payload) =>
+  handleGuardInstall('self-schedule-guard', installSelfScheduleGuard, payload)
 ));
 
 ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE_RULES || null);
@@ -570,7 +684,7 @@ ipcMain.handle('app:pick-directory', async () => {
   return result.filePaths[0];
 });
 
-ipcMain.on('app:reboot-app', () => rebootApp());
+ipcMain.on('app:reboot-app', (_e, opts) => { rebootApp({ force: opts?.force === true }).catch((e) => logReboot(`reboot failed: ${e?.message}`)); });
 
 // Image paste — Ctrl+V in the Terminal pane. Reads the OS clipboard via
 // Electron's native API (renderer's navigator.clipboard.read() doesn't expose
@@ -845,7 +959,6 @@ voiceHotkey.registerHotkeyHandlers();
 voiceWizard.registerWizardHandlers();
 scheduler.registerScheduleHandlers();
 watchers.registerWatcherHandlers();
-teams.registerTeamsHandlers();
 queueOps.registerQueueOpsHandlers({ retireCompletedSlugs: scheduler.retireCompletedSlugs });
 registerHistoryAggregatorHandlers();
 registerHistoryDashboardHandlers();
@@ -1164,6 +1277,7 @@ app.whenReady().then(async () => {
 
   const heapSnapshotMenuItem = heapSnapshot.buildMenuItem(() => mainWindow);
 
+  // Application menu rules + rationale: session-manager-operations/architecture/application-menu.md
   const template = [
     {
       label: 'Session Manager',
@@ -1180,7 +1294,7 @@ app.whenReady().then(async () => {
         {
           label: 'Restart Session Manager App',
           accelerator: 'CmdOrCtrl+Shift+R',
-          click: rebootApp,
+          click: () => { rebootApp().catch((e) => logReboot(`reboot failed: ${e?.message}`)); },
         },
         {
           label: 'Restart Terminal in Active Tab',
@@ -1274,42 +1388,22 @@ app.whenReady().then(async () => {
   seedSchedulerMcp({ logger: console, writeLog: logs.writeLine }).catch((e) => {
     logs.writeLine({ scope: 'seed-scheduler-mcp', level: 'error', message: 'seed failed', meta: { error: e?.message } });
   });
+  // Rewrite the stable guard-hook shims (~/.claude/session-manager/hooks/) to
+  // point at THIS running app's root, on every boot. An already-installed
+  // project hook resolves through the shim at invocation time, so an app
+  // upgrade (a new npx hash dir) just follows along with no re-install — see
+  // guardShims.cjs's header.
+  writeGuardShims().catch((e) => {
+    logs.writeLine({ scope: 'guard-shims', level: 'error', message: 'writeGuardShims failed', meta: { error: e?.message } });
+  });
   // Epic index self-heal: a project whose active-index.json is MISSING or
   // fails to parse has lost every open Epic's status unless the per-Epic
-  // status mirror (epicStatusMirror.cjs) can rebuild it. Runs once per boot,
-  // fire-and-forget, and only touches a project whose index reads unclean —
-  // a clean index is never rewritten here. See activeIndexRebuild.cjs.
-  try {
-    for (const projectCwd of allProjectCwds()) {
-      const indexPath = promptSessionsActiveIndexPath(projectCwd);
-      let unclean = false;
-      let parseError = null;
-      if (!fs.existsSync(indexPath)) {
-        unclean = true;
-      } else {
-        try {
-          JSON.parse(fs.readFileSync(indexPath, 'utf8'));
-        } catch (e) {
-          unclean = true;
-          parseError = e.message;
-        }
-      }
-      if (!unclean) continue;
-      try {
-        const { rows, skipped } = rebuildActiveIndex(projectCwd);
-        logs.writeLine({
-          scope: 'active-index-rebuild',
-          level: 'info',
-          message: 'rebuilt active-index.json from status mirrors',
-          meta: { cwd: projectCwd, parseError, restored: rows.length, skipped: skipped.length },
-        });
-      } catch (e) {
-        logs.writeLine({ scope: 'active-index-rebuild', level: 'error', message: 'rebuild failed', meta: { cwd: projectCwd, error: e?.message } });
-      }
-    }
-  } catch (e) {
-    logs.writeLine({ scope: 'active-index-rebuild', level: 'error', message: 'boot sweep failed', meta: { error: e?.message } });
-  }
+  // status mirror (epicStatusMirror.cjs) can rebuild it. Runs once per boot
+  // and only touches a project whose index reads unclean — a clean index is
+  // never rewritten. Deferred until the window paints (did-finish-load) so
+  // the ~270ms allProjectCwds() scan doesn't compete with the renderer's
+  // first IPC round trips for the event loop — see bootSelfHeal.cjs.
+  scheduleBootSelfHeal(mainWindow, { fs, allProjectCwds, promptSessionsActiveIndexPath, rebuildActiveIndex, logs });
   // History rollup finalize pass: deferred 30s past boot so it never competes
   // with first-paint, fire-and-forget (cron/offline refresh is PRD 651 — this
   // is just the one-shot in-app pass).
@@ -1340,7 +1434,7 @@ app.whenReady().then(async () => {
   }, 30_000);
   // Keep TODAY's rollup line current so the History dashboard never needs to
   // fall back to a live transcript scan. Shares the same O_EXCL lock file as
-  // the external watchdog's finalize pass (scripts/lib/watchdogHelpers.cjs)
+  // the external watchdog's finalize pass (src/main/lib/watchdogHelpers.cjs)
   // so the two never interleave writes to the rollup; a contended lock just
   // means this tick's refresh is skipped (harmless — the next tick retries).
   const intradayTimer = setInterval(runIntradayRefresh, schedulerConfig.HISTORY_INTRADAY_REFRESH_MS);
@@ -1392,6 +1486,14 @@ function runShutdownCleanup() {
   // Mark a clean exit so the next boot can distinguish a graceful quit from an
   // OOM-kill / native crash (which leaves the sentinel `open`).
   crashDiagnostics.markCleanShutdown();
+  // Release scheduler ownership on every teardown path, not just before-quit
+  // — the app.exit() sites (in-app reboot, dist-missing abort) bypass
+  // before-quit entirely and previously left a stale lock behind (fail-closed
+  // proc-identity recovery covers a hard crash, but a clean app.exit() should
+  // never need it). Pid-scoped and idempotent, so a redundant call from a
+  // later before-quit/will-quit firing is a safe no-op.
+  releaseSchedulerOwnership();
+  try { scheduler.stop(); } catch { /* */ }
   // PRD F1 v2 §IPC plumbing: must unregisterAll on will-quit.
   try { globalShortcut.unregisterAll(); } catch { /* */ }
   voiceHotkey.disposeOnQuit();

package/src/main/ipcSchemas.cjs

@@ -320,6 +320,11 @@ const PrdAgentTypeSchema = z.string().regex(PERSONA_NAME_RE, 'agent name must be
 // call site since update also allows an explicit empty array to CLEAR the
 // dependency, which create has no reason to accept.
 const DepSlugSchema = z.string().min(1).max(160).regex(/^[A-Za-z0-9][\w.-]*$/);
+// Wave-authoring decision (scheduler wave-disposition PRD), shared between
+// schedulerCreatePrd (authoring time) and adminPrdFrontmatterPatch (the
+// after-the-fact change path) so both can never disagree on what a valid
+// disposition value is.
+const PrdDispositionSchema = z.enum(['append', 'new-head']);
 const schedulerCreatePrd = z.object({
   title: z.string().min(1).max(200).regex(NO_NEWLINE_RE, 'must not contain newlines'),
   // Optional (PRD: worktree-cwd Epic-lookup hazard) — when omitted, prdCreate.cjs's
@@ -340,6 +345,12 @@ const schedulerCreatePrd = z.object({
   // Explicit ordering (PRD 832): slugs that must complete before this PRD
   // becomes eligible. Written to frontmatter as `dependsOn: [a, b]`.
   dependsOn: z.array(DepSlugSchema).max(20).optional(),
+  // Explicit wave-authoring decision (scheduler wave-disposition PRD) — only
+  // meaningful (and only stamped) when this PRD joins an Epic that already
+  // has incomplete PRDs and lands as a wave root (no dependsOn of its own);
+  // createPrd() requires it in that situation for an interactive caller and
+  // defaults to 'append' (logged as a default) for a non-interactive one.
+  disposition: PrdDispositionSchema.optional(),
   // An EXISTING Epic's promptSessionId (PRD 748) — NOT a PromptTicket.id.
   // ensureEpic() (epicMint.cjs) joins the Epic whose active-index.json
   // sessions key literally equals this value; the renderer only ever sends
@@ -387,6 +398,19 @@ const schedulerCreatePrd = z.object({
   quietMachine: z.boolean().optional(),
 });
 
+// Renderer-facing counterpart to adminPrdFrontmatterPatch's dependsOn/
+// disposition patch (scheduler wave-disposition PRD) — backs the Scheduler
+// UI's "change disposition" action. `dependsOn` is the caller's already-
+// computed target (from the SAME backlog tree the UI renders — see
+// lib/backlogTree.ts); the main-process handler only validates the rewrite
+// is safe (prdDisposition.cjs), never re-derives "the" terminal itself.
+const scheduleSetPrdDisposition = z.object({
+  slug: z.string().regex(SCHEDULE_SLUG_RE),
+  cwd: z.string().min(1).max(4096).optional(),
+  disposition: PrdDispositionSchema,
+  dependsOn: z.array(DepSlugSchema).max(20).optional(),
+});
+
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
 // Optional cwd narrows every slug's directory search to one project (same
 // role as scheduler_get_prd/scheduler_update_prd's cwd hint) — omitted, the
@@ -469,6 +493,11 @@ const adminPrdFrontmatterPatch = z.object({
   // (depSlugResolve.cjs) scheduler_create_prd uses, so update and create
   // can never disagree about what a dependsOn entry resolves to.
   dependsOn: z.array(DepSlugSchema).max(20).optional(),
+  // Patchable after creation too — the Scheduler UI's "change disposition"
+  // action (promote a wave to its own head, or attach it behind another
+  // chain) rewrites this alongside dependsOn via the same
+  // schedule:set-prd-disposition path (see prdDisposition.cjs).
+  disposition: PrdDispositionSchema.optional(),
 });
 
 const adminUpdatePrd = z.object({
@@ -623,28 +652,34 @@ const agentsGetPersonaBody = z.object({
   name: z.string().min(1).max(200),
 }).strict();
 
-// ──────────────────────────────────────────── Project Pages (PRD 932)
-// Same validation split as projectBriefCwd above: real path validation is
-// config.cjs's validatePath at first fs access in projectPages.cjs.
-const projectPagesCwd = z.object({
+// ──────────────────────────────────────────── Effective model info (PRD: what-will-this-run-as)
+const agentsResolveModelInfo = z.object({
   cwd: z.string().min(1).max(4096),
+  agentType: z.string().min(1).max(200),
 }).strict();
 
-// ──────────────────────────────────────────── Project Home admin routes
-// (PRD: project-home-admin-routes). Same validation split as
-// projectPagesCwd above: real path validation is projectRootResolve.cjs +
-// config.cjs's validatePath at first fs access.
-const projectHomeAdminCwdQuery = z.object({
+// ──────────────────────────────────────────── Epic launch model (PRD: unify-epic-model-resolution)
+// Terminal's (EpicTerminalPane.tsx) call into agentModelResolve.cjs's
+// resolveEpicModel — the same launch-model authority chatRunner.cjs's Chat
+// path calls in-process, reached here over IPC since the renderer has no fs.
+const agentsResolveEpicModel = z.object({
   cwd: z.string().min(1).max(4096),
+  claudeSessionId: z.string().min(1).max(200),
 }).strict();
-const projectHomeAdminValidateSummaryBody = z.object({
+
+// ──────────────────────────────────────────── Project Pages (PRD 932)
+// Same validation split as projectBriefCwd above: real path validation is
+// config.cjs's validatePath at first fs access in projectPages.cjs.
+const projectPagesCwd = z.object({
   cwd: z.string().min(1).max(4096),
-  summary: z.unknown(),
 }).strict();
-const projectHomeAdminRenderBody = z.object({
+
+// ──────────────────────────────────────────── Project Home admin route
+// Real path validation is projectRootResolve.cjs + config.cjs's validatePath;
+// html content limits live in projectHomeAdminRoutes.cjs's validateHomeHtml.
+const projectHomeAdminWriteBody = z.object({
   cwd: z.string().min(1).max(4096),
-  summary: z.unknown(),
-  picks: z.unknown(),
+  html: z.string(),
 }).strict();
 
 // ──────────────────────────────────────────── Host on Bilko.run
@@ -1037,6 +1072,7 @@ module.exports = {
     scheduleReadLog,
     scheduleWritePrd,
     schedulerCreatePrd,
+    scheduleSetPrdDisposition,
     scheduleArchivePrd,
     scheduleRetagPrd,
     adminListPrdsQuery,
@@ -1070,9 +1106,7 @@ module.exports = {
     memoryStale,
     projectBriefCwd,
     projectPagesCwd,
-    projectHomeAdminCwdQuery,
-    projectHomeAdminValidateSummaryBody,
-    projectHomeAdminRenderBody,
+    projectHomeAdminWriteBody,
     bilkoHostCwd,
     bilkoHostPrepareBundle,
     bilkoHostAddDocument,
@@ -1108,6 +1142,8 @@ module.exports = {
     exchangesList,
     agentsSavePersona,
     agentsGetPersonaBody,
+    agentsResolveModelInfo,
+    agentsResolveEpicModel,
     delegationReadinessCwd,
     telemetrySetConfig,
   },