claude-code-session-manager 0.98.0 → 0.101.0

package/src/main/files.cjs

@@ -22,6 +22,7 @@ const os = require('node:os');
 const { z } = require('zod');
 const { assertInsideHome } = require('./lib/insideHome.cjs');
 const { expandHome } = require('./lib/expandHome.cjs');
+const atomicFs = require('./lib/atomicFs.cjs');
 const { schemas } = require('./ipcSchemas.cjs');
 
 /**
@@ -163,11 +164,7 @@ async function writeFile(filePath, content) {
     return { ok: false, error: e.message };
   }
   try {
-    const dir = path.dirname(resolved);
-    await fsp.mkdir(dir, { recursive: true });
-    const tmp = `${resolved}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-    await fsp.writeFile(tmp, content, 'utf8');
-    await fsp.rename(tmp, resolved);
+    await atomicFs.writeTextAtomic(resolved, content);
     return { ok: true, error: null };
   } catch (e) {
     return { ok: false, error: e.message };

package/src/main/health.cjs

@@ -815,7 +815,7 @@ async function check(opts = {}) {
 
   // 1.7. Check test infrastructure exists.
   const hasPlaywright = fs.existsSync(path.join(PROJECT_ROOT, 'playwright.config.ts'));
-  const hasE2E = fs.existsSync(path.join(PROJECT_ROOT, 'e2e'));
+  const hasE2E = fs.existsSync(path.join(PROJECT_ROOT, 'tests', 'e2e'));
   status.components.test_infrastructure = {
     ok: hasPlaywright && hasE2E,
     playwright: hasPlaywright,

package/src/main/index.cjs

@@ -33,6 +33,7 @@ const { createAdminHttp } = require('./lib/localAdminHttp.cjs');
 const prdCreate = require('./lib/prdCreate.cjs');
 const prdAdminRoutes = require('./lib/prdAdminRoutes.cjs');
 const projectHomeAdminRoutes = require('./lib/projectHomeAdminRoutes.cjs');
+const { smfileResponseHeaders, shouldBlockFrameNavigation } = require('./lib/smfileHeaders.cjs');
 const { appendAuditEvent } = require('./lib/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
@@ -42,6 +43,7 @@ const epicWorktreeMint = require('./lib/epicWorktreeMint.cjs');
 const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
 const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
+const macroLibrary = require('./lib/macroLibrary.cjs');
 const agentModelResolve = require('./lib/agentModelResolve.cjs');
 const agentEffortResolve = require('./lib/agentEffortResolve.cjs');
 const { resolveEffectiveModelInfo } = require('./lib/effectiveModelInfo.cjs');
@@ -52,7 +54,6 @@ const upgradeDrain = require('./lib/upgradeDrain.cjs');
 const { writeGuardShims } = require('./lib/guardShims.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
-const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
 const crossProjectFeedback = require('./lib/crossProjectFeedback.cjs');
 const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
@@ -88,7 +89,6 @@ const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
 const { registerProjectBriefIpc } = require('./projectBrief.cjs');
 const { registerProjectPagesIpc, attachWindow: attachProjectPagesWindow, closeAllOutputWatchers: closeAllProjectPagesWatchers } = require('./projectPages.cjs');
-const { registerBilkoHostIpc } = require('./bilkoHost.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { computeEpicDelegationStats } = require('./lib/epicDelegationStats.cjs');
 const agentMemory = require('./agentMemory.cjs');
@@ -456,6 +456,21 @@ function createWindow() {
     configMgr.releaseWatchesForSender(mainWindow.webContents.id);
   });
 
+  // CSP (frame-src/connect-src) does not govern a subframe navigating itself —
+  // a demo-video document could still exfiltrate data via meta refresh or
+  // `location.href = 'https://…'`. Block any such navigation out of an
+  // smfile:// demo-video subframe.
+  mainWindow.webContents.on('will-frame-navigate', (details) => {
+    if (shouldBlockFrameNavigation({
+      isMainFrame: details.isMainFrame,
+      currentUrl: details.frame?.url,
+      targetUrl: details.url,
+    })) {
+      details.preventDefault();
+      console.warn('[main] blocked will-frame-navigate to', details.url);
+    }
+  });
+
   mainWindow.webContents.on('context-menu', (_e, params) => {
     const items = [];
     if (params.editFlags.canCopy) items.push({ label: 'Copy', role: 'copy' });
@@ -551,6 +566,28 @@ ipcMain.handle('agents:remove-override', async (_e, payload) => {
   broadcastAgentsChanged();
   return result;
 });
+// Macro library (macroLibrary.cjs): global machine-local one-click sidebar
+// macros (agent + tag + prompt). Store path is fixed in-module; the renderer
+// never supplies it. Mutations broadcast `macros:changed`.
+function broadcastMacrosChanged() {
+  sendIfAlive(mainWindow, 'macros:changed', {});
+}
+ipcMain.handle('macros:list', () => macroLibrary.listMacros());
+ipcMain.handle('macros:save', validated(schemas.macrosSave, async (payload) => {
+  const macro = await macroLibrary.saveMacro(payload);
+  broadcastMacrosChanged();
+  return macro;
+}));
+ipcMain.handle('macros:delete', validated(schemas.macrosDelete, async (payload) => {
+  const result = await macroLibrary.deleteMacro(payload);
+  broadcastMacrosChanged();
+  return result;
+}));
+ipcMain.handle('macros:set-project', validated(schemas.macrosSetProject, async (payload) => {
+  const result = await macroLibrary.setMacroProject(payload);
+  if (result.ok) broadcastMacrosChanged();
+  return result;
+}));
 // New Epic AIM composer (epicIntake.ts's `agentBody`/`agentPath`): unlike
 // list-personas above (global dir only), this honors the project-overlay-
 // then-global precedence so an Epic's opening prompt carries the persona
@@ -877,13 +914,6 @@ ipcMain.handle('app:git-branch', validated(schemas.appGitBranch, async ({ cwd })
   });
 }));
 
-// Resolves a project's publish target for 'build'-tagged Epics — see
-// lib/buildTarget.cjs. Null means the Build toolbar button should be disabled
-// (no explicit config, no auto-discoverable publishable package.json).
-ipcMain.handle('build:resolve-target', validated(schemas.buildResolveTarget, ({ cwd }) => {
-  return resolveBuildTarget(cwd);
-}));
-
 // Containment check for the open-in-{editor,finder,terminal} handlers lives
 // in lib/insideHome.cjs — single chokepoint for the /home/bilkoEVIL prefix-trap.
 // Editor / finder / terminal logic lives in lib/openExternalApp.cjs.
@@ -983,7 +1013,6 @@ epicWorktreeProjectConfig.registerEpicWorktreeProjectConfigHandlers();
 registerMemoryAggregateIpc();
 registerProjectBriefIpc();
 registerProjectPagesIpc();
-registerBilkoHostIpc();
 ipcMain.handle('promptSessionTranscript:append', validated(schemas.promptSessionTranscriptAppend, async ({ cwd, epicId, role, text, at, eventId }) => {
   const ok = await promptSessionTranscript.appendTurn(cwd, epicId, { role, text, at, eventId });
   return { ok };
@@ -1263,7 +1292,7 @@ app.whenReady().then(async () => {
       const buf = await fs.promises.readFile(realPath);
       const ext = path.extname(realPath).toLowerCase();
       const type = SMFILE_MIME[ext] || 'application/octet-stream';
-      return new Response(buf, { headers: { 'content-type': type } });
+      return new Response(buf, { headers: smfileResponseHeaders(realPath, type) });
     } catch (err) {
       return new Response(`smfile error: ${err && err.message}`, { status: 404 });
     }

package/src/main/ipcSchemas.cjs

@@ -13,6 +13,7 @@ const { PromptSessionSchema, EpicTagSchema, EpicSourceSchema, EpicIntakeSectionS
 const { PrdWorkTypeSchema } = require('./lib/workTypeLibrary.cjs');
 const { PERSONA_NAME_RE } = require('./agentLibrary.cjs');
 const { AgentPersonaSaveSchema } = require('./lib/agentPersonaSchema.cjs');
+const { MacroSaveSchema, MacroDeleteSchema, MacroSetProjectSchema } = require('./lib/macroLibrary.cjs');
 
 // ──────────────────────────────────────────── PTY
 const ptySpawn = z.object({
@@ -282,6 +283,15 @@ const scheduleSlug = z.object({
   slug: z.string().regex(SCHEDULE_SLUG_RE),
 });
 
+// reset-job: slug + optional cwd — narrows the match to one project's job
+// row so two different projects' slugs that happen to collide (slugs carry
+// no cwd salt) don't cross-reset. Mirrors remote.resetJob's own cwd filter
+// in scheduler.cjs.
+const scheduleResetJob = z.object({
+  slug: z.string().regex(SCHEDULE_SLUG_RE),
+  cwd: z.string().min(1).max(4096).optional(),
+});
+
 const scheduleReadLog = z.object({
   slug: z.string().regex(SCHEDULE_SLUG_RE),
   runId: z.string().regex(SCHEDULE_RUN_ID_RE),
@@ -409,6 +419,17 @@ const schedulerCreatePrd = z.object({
   // invalidate. See prdCreate.cjs's buildPrdBody and schedulerBatch.cjs's
   // pickNextBatch.
   quietMachine: z.boolean().optional(),
+  // Commands that prove this PRD is done (gate-and-files-in-PRD-body unit) —
+  // rendered verbatim as the `# Gate` body section's ```gate fence and read
+  // back by definitionOfDone.cjs's resolveGate/parseChain. ['none'] opts out
+  // for docs/config PRDs with no runnable check. Shape-validated (length,
+  // chars, no-shell, none-is-alone) by prdGateFiles.cjs's validateGate, not
+  // here — this schema only bounds array size and element type.
+  gate: z.array(z.string()).min(1).max(10).optional(),
+  // Repo-relative files/folders this PRD may change — rendered verbatim as
+  // the `# Files` body section. Validated (repo-relative, no .., no globs)
+  // by prdGateFiles.cjs's validateFiles, not here.
+  files: z.array(z.string()).min(1).max(50).optional(),
 });
 
 // Renderer-facing counterpart to adminPrdFrontmatterPatch's dependsOn/
@@ -588,6 +609,9 @@ const setSessionSlotsSchema = z.object({
 // Full field-level rules live in lib/agentPersonaSchema.cjs, mirroring
 // AgentPersonaSaveInput (src/preload/api.d.ts) field-for-field.
 const agentsSavePersona = AgentPersonaSaveSchema;
+const macrosSave = MacroSaveSchema;
+const macrosDelete = MacroDeleteSchema;
+const macrosSetProject = MacroSetProjectSchema;
 
 // ──────────────────────────────────────────── Memory tool (Bundle C, cycle 3)
 // Workspace-scoped markdown store at ~/.claude/projects/<ws>/memory/.
@@ -706,30 +730,13 @@ const projectHomeAdminWriteBody = z.object({
   html: z.string(),
 }).strict();
 
-// ──────────────────────────────────────────── Host on Bilko.run
-// Same validation split: real path validation is config.cjs's validatePath
-// at first fs access in bilkoHost.cjs — these schemas only bound wire shape.
-const bilkoHostCwd = z.object({
-  cwd: z.string().min(1).max(4096),
-}).strict();
-const bilkoHostPrepareBundle = z.object({
-  cwd: z.string().min(1).max(4096),
-  slug: z.string().min(1).max(64).regex(/^[a-z0-9-]+$/, 'slug must be lowercase kebab-case'),
-}).strict();
-const BILKO_HOST_DOCUMENT_SOURCE = z.union([
-  z.object({ kind: z.literal('project-page-lens'), lens: z.enum(['home', 'marketing', 'feature', 'architecture']) }).strict(),
-  z.object({ kind: z.literal('file'), path: z.string().min(1).max(4096) }).strict(),
-]);
-const bilkoHostAddDocument = z.object({
-  cwd: z.string().min(1).max(4096),
-  subpath: z.string().min(1).max(200),
-  title: z.string().min(1).max(200),
-  source: BILKO_HOST_DOCUMENT_SOURCE,
-}).strict();
-const bilkoHostRemoveDocument = z.object({
-  cwd: z.string().min(1).max(4096),
-  id: z.string().min(1).max(200),
+// Mirrors projectHomeAdminWriteBody; content limits (network-check rejections,
+// size cap, duration meta) live in projectHomeAdminRoutes.cjs's validateDemoVideoHtml.
+const projectDemoVideoAdminWriteBody = z.object({
+  cwd: z.string().min(1).max(4096).optional(),
+  html: z.string(),
 }).strict();
+
 const projectBriefSetPin = z.object({
   cwd: z.string().min(1).max(4096),
   block: PROJECT_BRIEF_BLOCK,
@@ -993,12 +1000,6 @@ const appGitBranch = z.object({
   cwd: z.string().min(1).max(4096),
 }).passthrough();
 
-// build:resolve-target — see src/main/lib/buildTarget.cjs. cwd is a trusted
-// TAB cwd, not validatePath'd here (same invariant as appGitBranch above).
-const buildResolveTarget = z.object({
-  cwd: z.string().min(1).max(4096),
-}).passthrough();
-
 // git:status / git:file-status — see src/main/git.cjs. cwd is validatePath'd
 // inside the handler (allowedRoots = home), so the schema only enforces shape.
 const gitStatus = z.object({
@@ -1100,6 +1101,7 @@ module.exports = {
     sessionsPayload,
     layoutEnvelope,
     scheduleSlug,
+    scheduleResetJob,
     scheduleReadLog,
     scheduleWritePrd,
     schedulerCreatePrd,
@@ -1122,7 +1124,6 @@ module.exports = {
     voiceSetRecording,
     appTestFireHook,
     appGitBranch,
-    buildResolveTarget,
     gitStatus,
     gitFileStatus,
     repoAnalyze,
@@ -1138,10 +1139,7 @@ module.exports = {
     projectBriefCwd,
     projectPagesCwd,
     projectHomeAdminWriteBody,
-    bilkoHostCwd,
-    bilkoHostPrepareBundle,
-    bilkoHostAddDocument,
-    bilkoHostRemoveDocument,
+    projectDemoVideoAdminWriteBody,
     projectBriefSetPin,
     projectBriefUpdate,
     promptSessionTranscriptAppend,
@@ -1172,6 +1170,9 @@ module.exports = {
     chatExternalSend,
     exchangesList,
     agentsSavePersona,
+    macrosSave,
+    macrosDelete,
+    macrosSetProject,
     agentsGetPersonaBody,
     agentsResolveModelInfo,
     modelsCatalog,

package/src/main/lib/agentPersonaSchema.cjs

@@ -23,7 +23,7 @@
 'use strict';
 
 const { z } = require('zod');
-const { WorkTypeSchema } = require('./workTypeLibrary.cjs');
+const { WorkTypeSchema, LEGACY_WORK_TYPES } = require('./workTypeLibrary.cjs');
 const { PERSONA_NAME_RE, ALL_PROJECTS } = require('../agentLibrary.cjs');
 
 // Bounded free-text fields — generous for legitimate persona authoring while
@@ -53,13 +53,24 @@ const AgentPersonaSaveSchema = z.object({
   model: BoundedString,
   effort: BoundedString.optional(),
   color: BoundedString,
-  tags: z.array(WorkTypeSchema),
+  // A legacy tag value (e.g. the retired 'bilko-host-publisher') must keep
+  // loading on an old on-disk persona — dropped silently, never thrown. Any
+  // other unknown value still fails via WorkTypeSchema.
+  tags: z.preprocess(
+    (v) => (Array.isArray(v) ? v.filter((t) => !(typeof t === 'string' && LEGACY_WORK_TYPES.includes(t))) : v),
+    z.array(WorkTypeSchema),
+  ),
   projects: z.array(ProjectEntrySchema).optional(),
   action: z.string().max(20000).optional(),
   actionLabel: BoundedString.optional(),
   title: BoundedString.optional(),
   // Set = write this project's frontmatter-only override (model/effort only) instead of the global file.
   projectName: BoundedString.optional(),
+  // Bundled-persona version stamp (seedAgentPersonas.cjs). Omit to carry over
+  // the existing file's stamp unchanged — see agentLibrary.cjs's savePersona.
+  // Without this field zod's default "strip unknown keys" behavior would
+  // silently drop it from a save payload that did carry one.
+  seedVersion: z.number().int().optional(),
   // Unbounded — a persona's body is arbitrary system-prompt prose.
   body: z.string(),
 });

package/src/main/lib/atomicFs.cjs

@@ -0,0 +1,116 @@
+'use strict';
+
+/**
+ * atomicFs.cjs — canonical tmp+rename file-IO primitives, extracted out of
+ * config.cjs so non-Electron modules (lib/*.cjs) can reuse the exact same
+ * atomic-write recipe without importing config.cjs's electron-adjacent
+ * validation layer. NO electron import here, intentionally — this module is
+ * pure Node and must stay requirable from any process.
+ *
+ * Recipe (unchanged from the original config.cjs copies this consolidates):
+ * write to `<file>.tmp-<pid>-<ts>-<rand>` in the SAME directory, then rename
+ * over the real path. mkdir -p the parent first. On write/rename failure,
+ * best-effort unlink the tmp file before rethrowing.
+ */
+
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+
+function tmpPathFor(file) {
+  return `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+/**
+ * opts.mode: optional POSIX permission bits applied to the tmp file before
+ * rename (chmod'd explicitly too — some platforms ignore the mode arg on
+ * writeFile when the file pre-exists).
+ * opts.fsync: fsync the tmp file's fd before rename (durability for callers
+ * that need the write to survive a crash immediately after it returns).
+ */
+async function writeTextAtomic(file, text, opts = {}) {
+  const dir = path.dirname(file);
+  await fsp.mkdir(dir, { recursive: true });
+  const tmp = tmpPathFor(file);
+  try {
+    const handle = await fsp.open(tmp, 'w', opts.mode);
+    try {
+      await handle.writeFile(text, 'utf8');
+      if (opts.mode) {
+        try { await handle.chmod(opts.mode); } catch { /* umask may have already applied it */ }
+      }
+      if (opts.fsync) await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fsp.rename(tmp, file);
+  } catch (e) {
+    try { await fsp.unlink(tmp); } catch { /* tmp never created or already gone */ }
+    throw e;
+  }
+}
+
+function writeTextAtomicSync(file, text, opts = {}) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const tmp = tmpPathFor(file);
+  try {
+    const fd = fs.openSync(tmp, 'w', opts.mode);
+    try {
+      fs.writeSync(fd, text, null, 'utf8');
+      if (opts.mode) {
+        try { fs.chmodSync(tmp, opts.mode); } catch { /* umask may have already applied it */ }
+      }
+      if (opts.fsync) fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* tmp never created or already gone */ }
+    throw e;
+  }
+}
+
+function serializeJson(obj, { space = 2, newline = true } = {}) {
+  const json = JSON.stringify(obj, null, space);
+  return newline ? `${json}\n` : json;
+}
+
+async function writeJsonAtomic(file, obj, opts = {}) {
+  await writeTextAtomic(file, serializeJson(obj, opts), opts);
+}
+
+function writeJsonAtomicSync(file, obj, opts = {}) {
+  writeTextAtomicSync(file, serializeJson(obj, opts), opts);
+}
+
+async function readJsonOr(file, fallback) {
+  try {
+    const raw = await fsp.readFile(file, 'utf8');
+    if (raw.trim() === '') return fallback;
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+
+function readJsonOrSync(file, fallback) {
+  try {
+    const raw = fs.readFileSync(file, 'utf8');
+    if (raw.trim() === '') return fallback;
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+
+module.exports = {
+  tmpPathFor,
+  writeTextAtomic,
+  writeTextAtomicSync,
+  writeJsonAtomic,
+  writeJsonAtomicSync,
+  readJsonOr,
+  readJsonOrSync,
+};

package/src/main/lib/branchSweep.cjs

@@ -19,20 +19,13 @@
  */
 'use strict';
 
-const { execFile } = require('node:child_process');
 const gitWorktree = require('./gitWorktree.cjs');
+const { execGit: sharedExecGit } = require('./gitExec.cjs');
 
+// Thin re-shape over the shared gitExec.execGit — kept so call sites below
+// (positional `timeout`, no `-C` prefix needed) don't all need touching.
 function execGit(cwd, args, timeout = 20_000) {
-  return new Promise((resolve, reject) => {
-    execFile('git', ['-C', cwd, ...args], { timeout, windowsHide: true, encoding: 'utf8' }, (err, stdout, stderr) => {
-      if (err) {
-        err.stderrText = stderr;
-        reject(err);
-        return;
-      }
-      resolve(stdout || '');
-    });
-  });
+  return sharedExecGit(cwd, args, { timeout });
 }
 
 /** List every local branch under `refs/heads/sm-job/*`. Never throws. */
@@ -114,7 +107,15 @@ async function sweepStrandedJobBranches({ cwd, jobs, attemptedBranches }) {
       continue;
     }
     attempted.add(attemptKey);
-    const integration = await gitWorktree.integrateJobBranch({ cwd, branch, slug: slug || branch });
+    // baseBranch: read off the job row when one still exists (the crash-between-
+    // commit-and-integrate case this sweep exists for) so integration targets the
+    // SAME branch the checkout was actually on when the worktree was created —
+    // not whatever cwd happens to sit on during this sweep pass. A fully orphaned
+    // branch (no row at all) has nothing to read, so it falls back to
+    // resolveDefaultBranch(cwd), same as before.
+    const integration = await gitWorktree.integrateJobBranch({
+      cwd, branch, slug: slug || branch, baseBranch: (row && row.worktreeBaseBranch) || null,
+    });
     results.push({ branch, slug, action: integration.ok ? 'integrated' : 'conflict', integration });
   }
   return { results };

package/src/main/lib/buildTarget.cjs

@@ -21,9 +21,9 @@
  * daemon whose "release" is bump VERSION, write the changelog, tag, and flag
  * that the live server needs a restart. That requires reading CLAUDE.md and
  * git history and exercising judgment, so discovery lives in the agent: a
- * `null` here means **not configured yet**, and the UI turns it into a
- * "Set Up Build" bootstrap session (`src/renderer/lib/buildAction.ts`) that
- * probes the project and writes the config, rather than a disabled button.
+ * `null` here means **not configured yet**; the builder skill probes the
+ * project and writes the config. No IPC or UI calls this resolver today;
+ * builds start from a user-created Macro (e.g. agent `builder`, tag `build`).
  */
 'use strict';
 

package/src/main/lib/builtinMacros.cjs

@@ -0,0 +1,39 @@
+'use strict';
+
+/**
+ * builtinMacros.cjs — the machine-local Macro library's seeded built-ins.
+ *
+ * These drive Project Home's one-click actions through the same (agent, tag,
+ * prompt) hot-key framework as user-created macros. `macroLibrary.cjs`'s
+ * `ensureBuiltins` seeds any entry here that is missing from macros.json, and
+ * upgrades an unedited stored copy whose `builtinVersion` is behind this file.
+ *
+ * Plain Node, no Electron imports.
+ */
+
+const BUILTIN_MACROS = Object.freeze([
+  Object.freeze({
+    id: 'builtin-project-home',
+    label: 'Project Home',
+    agentName: 'project-home-builder',
+    tag: 'project-home-builder',
+    surface: 'project-home',
+    projects: ['*'],
+    builtinVersion: 1,
+    prompt:
+      "Generate this project's Project Home page: one self-contained HTML overview (what it is, who it is for, key features, structure, how to run it, key commands), grounded only in what you read in the repository. Save it with a single project_home_write call.",
+  }),
+  Object.freeze({
+    id: 'builtin-demo-video',
+    label: 'Demo Video',
+    agentName: 'demo-video-builder',
+    tag: 'project-home-builder',
+    surface: 'project-home',
+    projects: ['*'],
+    builtinVersion: 1,
+    prompt:
+      'Generate a 30-second demo video for this project as one self-contained HTML/JavaScript animation that presents its main goals and key features, grounded only in what you read in the repository. Save it with a single project_demo_video_write call.',
+  }),
+]);
+
+module.exports = { BUILTIN_MACROS };

package/src/main/lib/claudeCliCaps.cjs

@@ -0,0 +1,129 @@
+'use strict';
+
+/**
+ * claudeCliCaps.cjs — probes the installed `claude` CLI for
+ * `--permission-prompts` support once per process, caches the result.
+ *
+ * Headless spawns (scheduler/supervisor/docEdit/runClaudeP) have no human
+ * attached, so a tool that waits on AskUserQuestion or a permission prompt
+ * would stall the job forever. `--permission-prompts none` (CLI v2.1.285+)
+ * auto-denies those prompts and removes human-requiring tools. Older CLIs
+ * don't recognize the flag, so it's only appended when `claude --help`
+ * confirms support.
+ *
+ * Only a SUCCESSFUL probe (a real supported/unsupported determination from
+ * actual `--help` text) is cached for the rest of the process — an error
+ * (ENOENT, timeout, a throw) is never cached: this call returns [] (the safe
+ * default: omit the flag) but a LATER call re-probes, subject to a
+ * once-per-60s backoff so a persistently broken binary doesn't turn every
+ * headless spawn attempt into a fresh probe.
+ *
+ * The probe spawns the SAME binary/spawn target every real headless spawn
+ * site uses — `claudeSpawnTarget('aux', ...)` from claudeBin.cjs — not a raw
+ * `resolveClaudeBin()` result, so what gets probed is provably what later
+ * gets spawned (aliasing/argv0 labeling included).
+ */
+
+const claudeBinLib = require('./claudeBin.cjs');
+
+const PROBE_TIMEOUT_MS = 10_000;
+const FLAG_ARGS = ['--permission-prompts', 'none'];
+const DEFAULT_REPROBE_AFTER_ERROR_MS = 60_000;
+
+let _execFile = require('node:child_process').execFile;
+
+/** Test hook — inject a stub execFile(file, args, opts, cb) instead of spawning the real CLI. */
+function _setExecFileForTest(fn) {
+  _execFile = fn || require('node:child_process').execFile;
+}
+
+/** Test hook — forget the cached probe result and any error backoff so the next call re-probes immediately. */
+function _resetForTest() {
+  cachedArgs = null;
+  inflight = null;
+  lastErrorAt = 0;
+  reprobeAfterErrorMs = DEFAULT_REPROBE_AFTER_ERROR_MS;
+}
+
+/** Test hook — shrink the once-per-60s error backoff so a re-probe-after-error test doesn't need to sleep 60s. */
+function _setReprobeBackoffMsForTest(ms) {
+  reprobeAfterErrorMs = typeof ms === 'number' && ms >= 0 ? ms : DEFAULT_REPROBE_AFTER_ERROR_MS;
+}
+
+let cachedArgs = null; // set ONLY by a successful probe — never by an error path
+let inflight = null;
+let lastErrorAt = 0;
+let reprobeAfterErrorMs = DEFAULT_REPROBE_AFTER_ERROR_MS;
+
+/**
+ * Probes `claude --help` once per process (successful result only); every
+ * call (including concurrent/later ones) resolves the same cached arg array
+ * once a successful probe has landed. A probe error is never cached — this
+ * call still resolves [] for the caller, but the NEXT call re-probes for
+ * real once `reprobeAfterErrorMs` has elapsed since the last error.
+ */
+function ensureCliCapsProbed() {
+  if (cachedArgs) return Promise.resolve(cachedArgs);
+  if (inflight) return inflight;
+  if (lastErrorAt && Date.now() - lastErrorAt < reprobeAfterErrorMs) {
+    return Promise.resolve([]);
+  }
+
+  let bin;
+  try { bin = claudeBinLib.resolveClaudeBin(); } catch { bin = 'claude'; }
+  let target;
+  try { target = claudeBinLib.claudeSpawnTarget('aux', 'cli-caps-probe', bin); } catch { target = { command: bin }; }
+
+  // NOTE: `inflight` is cleared via `.finally()` below, never directly
+  // inside this executor. A real `execFile` callback is always async, but a
+  // TEST stub firing its callback synchronously would otherwise run
+  // `succeed`/`fail` (and their `inflight = null`) to completion BEFORE the
+  // `inflight = promise` assignment two lines down ever runs — leaving
+  // `inflight` wedged at a stale, already-settled promise forever, so this
+  // function would never re-probe again regardless of the cache/backoff
+  // state. `.finally()` callbacks always run as a microtask, strictly after
+  // the synchronous assignment below, so this ordering hazard can't recur.
+  const promise = new Promise((resolve) => {
+    const succeed = (args) => {
+      cachedArgs = args;
+      resolve(args);
+    };
+    const fail = () => {
+      lastErrorAt = Date.now();
+      resolve([]);
+    };
+    try {
+      const execOpts = { timeout: PROBE_TIMEOUT_MS, windowsHide: true };
+      if (target.argv0) execOpts.argv0 = target.argv0;
+      _execFile(target.command, ['--help'], execOpts, (err, stdout) => {
+        if (err) {
+          console.warn('[claudeCliCaps] claude --help probe failed; headless spawns will omit --permission-prompts:', err?.message || err);
+          fail();
+          return;
+        }
+        succeed(String(stdout || '').includes('--permission-prompts') ? FLAG_ARGS.slice() : []);
+      });
+    } catch (e) {
+      console.warn('[claudeCliCaps] claude --help probe threw; headless spawns will omit --permission-prompts:', e?.message || e);
+      fail();
+    }
+  });
+  inflight = promise;
+  promise.finally(() => {
+    if (inflight === promise) inflight = null;
+  });
+  return promise;
+}
+
+/** Sync accessor for the cached probe result — [] until ensureCliCapsProbed() has resolved successfully at least once. */
+function headlessPermissionArgs() {
+  return cachedArgs ? cachedArgs.slice() : [];
+}
+
+module.exports = {
+  headlessPermissionArgs,
+  ensureCliCapsProbed,
+  _setExecFileForTest,
+  _resetForTest,
+  _setReprobeBackoffMsForTest,
+};