specrails-desktop 2.11.1 → 2.11.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.11.1",
+  "version": "2.11.3",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/setup-manager.js

@@ -620,19 +620,42 @@ async function validateCoreContract() {
 }
 // ─── SetupManager ─────────────────────────────────────────────────────────────
 const INSTALL_LOG_BUFFER_MAX = 2000;
-function formatBufferedInstallError(baseMessage, logBuffer) {
+/**
+ * Persist the FULL install log to `~/.specrails/logs/` and return the path (or
+ * null on failure). The in-error tail is only a window; the full log carries the
+ * complete child stack — needed because a Node uncaught error prints the ORIGIN
+ * frames ABOVE the entry frames, so an 8-line tail shows only the bottom of the
+ * stack + the error object, never where it was thrown.
+ */
+function persistInstallLog(projectId, logBuffer) {
+    try {
+        const dir = (0, path_1.join)((0, artifact_registry_1.resolveHome)(), '.specrails', 'logs');
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const file = (0, path_1.join)(dir, `setup-${projectId}-${stamp}.log`);
+        (0, fs_1.writeFileSync)(file, logBuffer.join('\n') + '\n', { mode: 0o600 });
+        return file;
+    }
+    catch {
+        return null;
+    }
+}
+function formatBufferedInstallError(baseMessage, logBuffer, logPath) {
+    // Show a generous tail: a Node uncaught-exception dump is ~15-30 lines (header,
+    // stack frames, the `{errno,code,syscall,path}` object, version footer). 8 lines
+    // truncated to just the entry frames + error object, hiding the throw origin.
     const recentLines = logBuffer
         .map((line) => line.trim())
         .filter(Boolean)
-        .slice(-8);
-    if (recentLines.length === 0)
-        return baseMessage;
-    return [
-        baseMessage,
-        '',
-        'Recent output:',
-        ...recentLines.map((line) => `- ${line}`),
-    ].join('\n');
+        .slice(-40);
+    const parts = [baseMessage];
+    if (recentLines.length > 0) {
+        parts.push('', 'Recent output:', ...recentLines.map((line) => `- ${line}`));
+    }
+    if (logPath) {
+        parts.push('', `Full log: ${logPath}`);
+    }
+    return parts.join('\n');
 }
 class SetupManager {
     _broadcast;
@@ -788,12 +811,20 @@ class SetupManager {
         const initArgs = hasConfig
             ? ['--yes', '--from-config', spawnConfigPath ?? configPath]
             : ['--yes', '--root-dir', projectPath];
+        // Seed the install log with a diagnostic header capturing the EXACT spawn
+        // (node interpreter, cli entry, cwd) + relevant env. This lands in the
+        // failure report so a Windows/packaged path issue (e.g. an EISDIR on the
+        // entry realpath) is diagnosable without server-console access.
+        const diagHeader = [];
+        if (useBundledCore) {
+            diagHeader.push(`[diag] node=${(0, path_resolver_1.resolveBundledNodeExe)() ?? process.execPath}`, `[diag] cli=${(0, bundled_core_1.getBundledCoreCli)() ?? '<none>'}`, `[diag] cwd=${projectPath}`, `[diag] args=${initArgs.join(' ')}`, `[diag] SPECRAILS_BUNDLED_RUNTIMES_PATH=${process.env.SPECRAILS_BUNDLED_RUNTIMES_PATH ?? '<unset>'}`, `[diag] SPECRAILS_BUNDLED_CORE_PATH=${process.env.SPECRAILS_BUNDLED_CORE_PATH ?? '<unset>'}`);
+        }
         // Bundled core (offline, node <cli> init) when available, else legacy npx.
         const child = useBundledCore
             ? spawnBundledCoreInit(initArgs, projectPath)
             : spawnCoreInit(initArgs, projectPath);
         this._installProcesses.set(projectId, child);
-        this._installLogBuffer.set(projectId, []);
+        this._installLogBuffer.set(projectId, diagHeader);
         // spawnCoreInit uses shell:false on POSIX, so a spawn failure emits 'error'
         // (and NOT 'close') — without this handler the temp config file leaks and
         // the unhandled 'error' event would crash the app.
@@ -867,10 +898,11 @@ class SetupManager {
             }
             else {
                 const logBuffer = this._installLogBuffer.get(projectId) ?? [];
+                const logPath = persistInstallLog(projectId, logBuffer);
                 this._broadcast({
                     type: 'setup_error',
                     projectId,
-                    error: formatBufferedInstallError(`${useBundledCore ? 'bundled specrails-core' : 'npx specrails-core'} exited with code ${code ?? 'unknown'}`, logBuffer),
+                    error: formatBufferedInstallError(`${useBundledCore ? 'bundled specrails-core' : 'npx specrails-core'} exited with code ${code ?? 'unknown'}`, logBuffer, logPath),
                 });
             }
         });

package/server/dist/setup-prerequisites.js

@@ -15,6 +15,8 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const providers_1 = require("./providers");
 const win_spawn_1 = require("./util/win-spawn");
+const bundled_core_1 = require("./bundled-core");
+const bundled_openspec_1 = require("./bundled-openspec");
 const WHICH_CMD = process.platform === 'win32' ? 'where' : 'which';
 /**
  * Run `<cmd> <args>` synchronously. On Windows use cross-spawn (NOT `shell:true`):
@@ -49,6 +51,22 @@ function locateCommand(command) {
     const resolvedPath = `${result.stdout ?? ''}`.trim().split(/\r?\n/)[0]?.trim() || undefined;
     return { found: true, resolvedPath };
 }
+/** Run `<bin> <args>` and interpret the result as a `--version` probe. */
+function runProbe(bin, args) {
+    const result = runVersionSpawn(bin, args);
+    if (result.error) {
+        const err = result.error;
+        return { executed: false, error: `${err.code ?? 'ERR'}: ${err.message}` };
+    }
+    if ((result.status ?? 1) !== 0) {
+        const stderr = `${result.stderr ?? ''}`.trim().slice(0, 400);
+        const signal = result.signal ? ` signal=${result.signal}` : '';
+        return { executed: false, error: `exit=${result.status ?? '?'}${signal}${stderr ? ` stderr=${stderr}` : ''}` };
+    }
+    const output = `${result.stdout ?? result.stderr ?? ''}`.trim();
+    const version = output.split(/\r?\n/)[0]?.trim() || undefined;
+    return { executed: true, version };
+}
 function probeVersion(command, resolvedPath) {
     // IMPORTANT: prefer the absolute path returned by `which`. When the server is
     // bundled with `pkg`, calling spawn with the bare command name `'node'` is
@@ -64,19 +82,7 @@ function probeVersion(command, resolvedPath) {
     // cross-spawn with correct escaping. The env carries SystemRoot so cmd.exe can
     // start. This replaces the old `shell:true` path that made every bundled probe
     // fail with a bogus "corrupted-bundle" when the sidecar env lacked SystemRoot.
-    const result = runVersionSpawn(target, ['--version']);
-    if (result.error) {
-        const err = result.error;
-        return { executed: false, error: `${err.code ?? 'ERR'}: ${err.message}` };
-    }
-    if ((result.status ?? 1) !== 0) {
-        const stderr = `${result.stderr ?? ''}`.trim().slice(0, 400);
-        const signal = result.signal ? ` signal=${result.signal}` : '';
-        return { executed: false, error: `exit=${result.status ?? '?'}${signal}${stderr ? ` stderr=${stderr}` : ''}` };
-    }
-    const output = `${result.stdout ?? result.stderr ?? ''}`.trim();
-    const version = output.split(/\r?\n/)[0]?.trim() || undefined;
-    return { executed: true, version };
+    return runProbe(target, ['--version']);
 }
 /** Extracts the first `major.minor.patch` triple from a version string.
  *  Tolerates prefixes like `v`, `git version `, `node `. */
@@ -144,6 +150,41 @@ function fileExists(p) {
         return false;
     }
 }
+/** The bundled REAL node executable inside the runtimes tree, or null. */
+function bundledNodeExe(runtimesBase) {
+    return getBundledToolCandidates(runtimesBase, 'node').find(fileExists) ?? null;
+}
+/**
+ * Absolute path to the bundled npm/npx CLI JS (`npm-cli.js` / `npx-cli.js`), or
+ * null. The npm package ships INSIDE the node distribution: at
+ * `node/node_modules/npm/bin/` on Windows and `node/lib/node_modules/npm/bin/`
+ * on POSIX. Both `npm` and `npx` are served by the npm package (npx-cli.js lives
+ * there too).
+ */
+function bundledNpmCliJs(runtimesBase, tool) {
+    const file = tool === 'npx' ? 'npx-cli.js' : 'npm-cli.js';
+    const candidates = process.platform === 'win32'
+        ? [path_1.default.join(runtimesBase, 'node', 'node_modules', 'npm', 'bin', file)]
+        : [path_1.default.join(runtimesBase, 'node', 'lib', 'node_modules', 'npm', 'bin', file)];
+    return candidates.find(fileExists) ?? null;
+}
+/**
+ * Probe a bundled npm/npx by running the bundled node DIRECTLY against the npm
+ * package's CLI JS, instead of executing the `.cmd`/wrapper shim. The shims route
+ * through `cmd.exe` (Windows) / a wrapper script and proved fragile in the
+ * packaged app (a stripped sidecar env / cmd.exe quirks made `npm.cmd --version`
+ * fail with a bogus "corrupted-bundle" even though node.exe itself runs fine).
+ * Running `node npm-cli.js --version` is deterministic, shell-free and pkg-safe.
+ * Returns null when the bundled node or the CLI JS isn't present (caller falls
+ * back to probing the shim, then to the system tool).
+ */
+function probeBundledNpmLike(runtimesBase, tool) {
+    const nodeExe = bundledNodeExe(runtimesBase);
+    const cliJs = bundledNpmCliJs(runtimesBase, tool);
+    if (!nodeExe || !cliJs)
+        return null;
+    return { probe: runProbe(nodeExe, [cliJs, '--version']), resolvedPath: cliJs };
+}
 // Short-lived memo: probing involves up to ~12 synchronous spawnSync calls that
 // block the single Express event loop. The endpoint only fires from low-freq
 // setup flows, so a 30s TTL eliminates repeated probe storms (cold-cache
@@ -167,6 +208,13 @@ function __resetSetupPrerequisitesCacheForTest() {
 function computeSetupPrerequisitesStatus(options = {}) {
     const isDesktop = process.env.SPECRAILS_IS_DESKTOP === '1';
     const runtimesBase = process.env.SPECRAILS_BUNDLED_RUNTIMES_PATH ?? '';
+    // When the app ships a bundled core AND bundled openspec, project-add is fully
+    // OFFLINE: it runs `node cli.js` / `node openspec.js` directly and NEVER spawns
+    // npm or npx. So npm/npx are advisory (not required) in that mode — a broken or
+    // unprobeable npm/npx must NOT dead-end Add Project for tools the install flow
+    // never invokes. Outside the bundled-offline path (dev / no bundle) npx IS used
+    // (npx specrails-core), so npm/npx stay required there.
+    const bundledOfflineSetup = isDesktop && (0, bundled_core_1.getBundledCoreCli)() !== null && (0, bundled_openspec_1.getBundledOpenspecCli)() !== null;
     const platform = process.platform === 'darwin'
         ? 'darwin'
         : process.platform === 'win32'
@@ -190,7 +238,7 @@ function computeSetupPrerequisitesStatus(options = {}) {
             kind: 'tool',
             label: 'npm',
             command: 'npm',
-            required: true,
+            required: !bundledOfflineSetup,
             minVersion: exports.MIN_VERSIONS.npm,
             installUrl: 'https://nodejs.org/en/download',
             installHint: 'npm ships with Node.js LTS.',
@@ -200,7 +248,7 @@ function computeSetupPrerequisitesStatus(options = {}) {
             kind: 'tool',
             label: 'npx',
             command: 'npx',
-            required: true,
+            required: !bundledOfflineSetup,
             installUrl: 'https://nodejs.org/en/download',
             installHint: 'npx ships with npm and is required to run specrails-core.',
         },
@@ -254,17 +302,27 @@ function computeSetupPrerequisitesStatus(options = {}) {
         // Desktop mode: probe bundled absolute paths for node/npm/npx/git.
         // Provider CLIs (claude, codex) are always probed via system PATH regardless of mode.
         if (isDesktop && definition.kind === 'tool' && isBundledTool(definition.key)) {
-            const candidates = getBundledToolCandidates(runtimesBase, definition.key);
-            const bundledPath = candidates.find(fileExists);
-            // Only treat as bundled when the binary FILE actually exists. A missing
-            // file means this build never shipped runtimes for this platform/arch
-            // (e.g. a runtimes-less Windows ARM64 build, or a partial CI extraction)
+            const tool = definition.key;
+            // npm/npx: probe by running the bundled node DIRECTLY against the npm
+            // package's CLI JS — robust where the `.cmd`/wrapper shim proved fragile in
+            // the packaged app (cmd.exe / stripped-env quirks made `npm.cmd --version`
+            // fail with a bogus "corrupted-bundle" even though node.exe runs fine).
+            let effective = tool === 'npm' || tool === 'npx' ? probeBundledNpmLike(runtimesBase, tool) : null;
+            // Otherwise (node/git, or npm/npx whose CLI JS wasn't found) probe the
+            // bundled binary/shim directly. Only treat as bundled when the FILE exists;
+            // a missing file means this build shipped no runtimes for this platform/arch
             // — fall through to the system probe so a system-installed tool still
-            // satisfies the requirement, instead of dead-ending Add Project with a
-            // futile "reinstall the app" message. 'corrupted-bundle' is reserved for
-            // the case where the file EXISTS but fails its --version probe.
-            if (bundledPath) {
-                const probe = probeVersion(definition.key, bundledPath);
+            // satisfies the requirement instead of dead-ending Add Project with a futile
+            // "reinstall the app". 'corrupted-bundle' is reserved for file-EXISTS-but-
+            // fails-its-probe.
+            if (!effective) {
+                const bundledPath = getBundledToolCandidates(runtimesBase, tool).find(fileExists);
+                if (bundledPath) {
+                    effective = { probe: probeVersion(tool, bundledPath), resolvedPath: bundledPath };
+                }
+            }
+            if (effective) {
+                const { probe, resolvedPath } = effective;
                 if (!probe.executed) {
                     return {
                         ...definition,
@@ -272,7 +330,7 @@ function computeSetupPrerequisitesStatus(options = {}) {
                         executable: false,
                         bundled: true,
                         error: 'corrupted-bundle',
-                        resolvedPath: bundledPath,
+                        resolvedPath,
                         executionError: probe.error,
                         meetsMinimum: false,
                         installHint: 'Bundle corrupted — reinstall the Specrails app.',
@@ -284,12 +342,12 @@ function computeSetupPrerequisitesStatus(options = {}) {
                     executable: true,
                     bundled: true,
                     version: probe.version,
-                    resolvedPath: bundledPath,
+                    resolvedPath,
                     meetsMinimum: meetsMinimumVersion(probe.version, definition.minVersion),
                     installHint: '',
                 };
             }
-            // bundledPath not found → fall through to the system probe below.
+            // No bundled binary/CLI found → fall through to the system probe below.
         }
         // Non-desktop (or provider CLI in any mode, or desktop with bundle absent): system probe.
         const lookup = locateCommand(definition.command);

package/server/dist/util/win-spawn.js

@@ -54,10 +54,29 @@ function windowsSpawnEnv(base = process.env) {
     if (process.platform !== 'win32')
         return base;
     const env = { ...base };
-    const systemRoot = env.SystemRoot || env.windir || 'C:\\Windows';
-    env.SystemRoot = systemRoot;
+    const systemRoot = (env.SystemRoot || env.windir || 'C:\\Windows').replace(/[\\/]$/, '');
+    env.SystemRoot = env.SystemRoot || systemRoot;
     env.windir = env.windir || systemRoot;
-    env.ComSpec = env.ComSpec || `${systemRoot.replace(/[\\/]$/, '')}\\System32\\cmd.exe`;
+    env.ComSpec = env.ComSpec || `${systemRoot}\\System32\\cmd.exe`;
+    // npm/npx load @npmcli/config on startup (even `npm --version` and the inner
+    // npm-prefix.js resolver), which reads the user profile via USERPROFILE /
+    // APPDATA / HOMEDRIVE+HOMEPATH / TEMP. A GUI-launched, env-stripped sidecar can
+    // lack these → `node npm-cli.js --version` fails the same way the .cmd shim did.
+    // Backfill canonical Windows defaults when absent (node.exe itself needs none
+    // of these, which is why node/git probed fine while npm/npx did not).
+    const userProfile = env.USERPROFILE ||
+        (env.HOMEDRIVE && env.HOMEPATH ? `${env.HOMEDRIVE}${env.HOMEPATH}` : 'C:\\Users\\Default');
+    env.USERPROFILE = userProfile;
+    const drive = /^([A-Za-z]:)(.*)$/.exec(userProfile);
+    if (drive) {
+        env.HOMEDRIVE = env.HOMEDRIVE || drive[1];
+        env.HOMEPATH = env.HOMEPATH || (drive[2] || '\\');
+    }
+    env.APPDATA = env.APPDATA || `${userProfile}\\AppData\\Roaming`;
+    env.LOCALAPPDATA = env.LOCALAPPDATA || `${userProfile}\\AppData\\Local`;
+    const temp = env.TEMP || env.TMP || `${env.LOCALAPPDATA}\\Temp`;
+    env.TEMP = env.TEMP || temp;
+    env.TMP = env.TMP || temp;
     return env;
 }
 // Back-compat for callsites that only need the resolved binary