specrails-desktop 2.11.4 → 2.11.6

package/server/dist/jira/jira-client.js

@@ -79,7 +79,7 @@ class JiraClient {
             const code = classify(res.status);
             const retryAfter = res.headers.get('Retry-After');
             const retryAfterMs = retryAfter ? parseRetryAfter(retryAfter) : undefined;
-            return { ok: false, status: res.status, code, error: truncate(errText), ...(retryAfterMs ? { retryAfterMs } : {}) };
+            return { ok: false, status: res.status, code, error: truncate(errText), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}) };
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -142,15 +142,27 @@ class JiraClient {
      * removed Oct 2025). Always pass an explicit `fields` array; page via
      * `nextPageToken`. On DC v2 this falls back to the classic /search.
      */
-    searchJql(args) {
+    async searchJql(args) {
         if (this.cfg.apiVersion === '2') {
-            // DC/Server: classic search with startAt/maxResults.
-            return this.request('POST', '/search', {
+            // DC/Server: classic search with startAt/maxResults. The classic response
+            // carries {issues,total,startAt,maxResults} — NOT nextPageToken — so
+            // SYNTHESIZE a nextPageToken (= next startAt) while more pages remain.
+            // Without this the poll loop only ever read the first 100 issues.
+            const startAt = args.nextPageToken ? parseInt(args.nextPageToken, 10) || 0 : 0;
+            const maxResults = args.maxResults ?? 100;
+            const res = await this.request('POST', '/search', {
                 jql: args.jql,
                 fields: args.fields,
-                maxResults: args.maxResults ?? 100,
-                startAt: args.nextPageToken ? parseInt(args.nextPageToken, 10) || 0 : 0,
+                maxResults,
+                startAt,
             });
+            if (!res.ok)
+                return res;
+            const issues = res.data.issues ?? [];
+            const total = res.data.total ?? issues.length;
+            const nextStart = startAt + issues.length;
+            const nextPageToken = issues.length > 0 && nextStart < total ? String(nextStart) : undefined;
+            return { ok: true, status: res.status, data: { issues, nextPageToken, isLast: nextPageToken === undefined } };
         }
         return this.request('POST', '/search/jql', {
             jql: args.jql,
@@ -216,8 +228,23 @@ class JiraClient {
      * GET /issue/{id}/comment?expand=properties — used to dedup comments via the
      * self-marker (invisible comment property, with a legacy body fallback).
      */
-    getComments(issueIdOrKey) {
-        return this.request('GET', `/issue/${encodeURIComponent(issueIdOrKey)}/comment?expand=properties`);
+    async getComments(issueIdOrKey) {
+        const all = [];
+        let startAt = 0;
+        const maxResults = 100;
+        for (let page = 0; page < 50; page++) {
+            const enc = encodeURIComponent(issueIdOrKey);
+            const res = await this.request('GET', `/issue/${enc}/comment?expand=properties&startAt=${startAt}&maxResults=${maxResults}`);
+            if (!res.ok)
+                return res;
+            const batch = res.data.comments ?? [];
+            all.push(...batch);
+            const total = res.data.total ?? all.length;
+            startAt += batch.length;
+            if (batch.length === 0 || startAt >= total)
+                break;
+        }
+        return { ok: true, status: 200, data: { comments: all } };
     }
     // ─── Read-only details panel (issue fields + Development) ────────────────────
     /** GET /issue/{id}?fields=*all — the full system + custom field map (untyped). */

package/server/dist/jira/jira-credential-store.js

@@ -38,9 +38,18 @@ function getOrCreateKey(keyfilePath = defaultKeyfilePath()) {
         const key = Buffer.from(raw, 'base64');
         if (key.length === 32)
             return key;
+        // File exists but the decoded key is the wrong length (truncated/corrupt) —
+        // fall through to regenerate. A WRONG-LENGTH existing key is unrecoverable
+        // anyway, so rotating is the only option.
     }
-    catch {
-        // Missing or corrupt — (re)create below.
+    catch (err) {
+        // ONLY (re)create when the file genuinely doesn't exist. A transient FS
+        // error (EACCES/EBUSY/EMFILE/momentary unreadability) must NOT rotate the
+        // key — doing so makes every previously-stored Jira token across all
+        // projects permanently undecryptable. Rethrow so the caller sees the real
+        // error instead of silently destroying credentials.
+        if (err.code !== 'ENOENT')
+            throw err;
     }
     const key = crypto_1.default.randomBytes(32);
     const dir = path_1.default.dirname(keyfilePath);

package/server/dist/jira/jira-materializer.js

@@ -186,9 +186,15 @@ function upsertIssuesIntoStore(db, projectPath, conn, issues, frozenLocalIds = n
     let anyChange = false;
     for (const issue of issues) {
         const u = issue.fields.updated ? Date.parse(issue.fields.updated) : 0;
-        if (!Number.isNaN(u) && u > maxUpdatedMs)
-            maxUpdatedMs = u;
         const link = (0, jira_db_1.getLinkByIssueId)(db, issue.id);
+        // Do NOT advance the high-water past a FROZEN issue (one with a pending
+        // outbox op whose content we suppress): if the op later dead-letters without
+        // the Jira `updated` timestamp changing, a high-water moved past it would
+        // never re-fetch the suppressed remote change → permanently stale cache.
+        // Only count issues whose content we actually reconcile here.
+        const isFrozen = link ? frozenLocalIds.has(link.localId) : false;
+        if (!Number.isNaN(u) && u > maxUpdatedMs && !isFrozen)
+            maxUpdatedMs = u;
         if (!link) {
             anyChange = true;
             continue;

package/server/dist/jira/jira-sync-manager.js

@@ -444,8 +444,17 @@ class JiraSyncManager {
         const frozen = this.frozenLocalIds();
         let jql = `project = "${conn.jiraProjectKey}" ORDER BY updated ASC`;
         if (!full && conn.highWaterMs && conn.highWaterMs > 0) {
-            const since = formatJqlDate(conn.highWaterMs - POLL_OVERLAP_MS);
-            jql = `project = "${conn.jiraProjectKey}" AND updated >= "${since}" ORDER BY updated ASC`;
+            // RELATIVE JQL date (`-Nm`) instead of an absolute wall-clock string: an
+            // absolute `formatJqlDate(...)` is emitted in UTC but Jira interprets a
+            // bare JQL datetime in the ACCOUNT timezone, so on a behind-UTC instance
+            // the floor rose above the high-water and silently skipped hours of
+            // updates. Relative dates evaluate against Jira's own clock with no TZ
+            // wall-clock interpretation, eliminating the gap. The high-water is derived
+            // from Jira's own `updated` values, so minutes-ago from the server clock
+            // (within the 2-min overlap for skew) maps to the right Jira floor.
+            const sinceFloorMs = conn.highWaterMs - POLL_OVERLAP_MS;
+            const minutesAgo = Math.max(1, Math.ceil((Date.now() - sinceFloorMs) / 60_000));
+            jql = `project = "${conn.jiraProjectKey}" AND updated >= "-${minutesAgo}m" ORDER BY updated ASC`;
         }
         let nextPageToken;
         let totalUpserted = 0;

package/server/dist/mobile/mobile-datachannel.js

@@ -42,6 +42,11 @@ function framedSend(ch, data) {
  *  group is complete. Non-chunk frames pass straight through. */
 class ChunkReassembler {
     _groups = new Map();
+    // Bounds against a malicious/buggy peer: an unvalidated `n` would
+    // `new Array(n).fill('')` (RangeError crash for huge/negative n, or a huge
+    // allocation), and never-completing groups would leak forever.
+    static MAX_CHUNKS = 1024;
+    static MAX_GROUPS = 64;
     /** Returns the string to handle (the frame itself, or a completed
      *  reassembly), or null when more chunks of the group are still pending. */
     push(data) {
@@ -56,12 +61,25 @@ class ChunkReassembler {
         }
         if (!p || p.n == null)
             return data;
+        // Validate counts/index BEFORE allocating: positive integer n within the
+        // ceiling, and i a valid index in [0, n).
+        if (!Number.isInteger(p.n) || p.n <= 0 || p.n > ChunkReassembler.MAX_CHUNKS)
+            return null;
+        if (!Number.isInteger(p.i) || p.i < 0 || p.i >= p.n)
+            return null;
         let grp = this._groups.get(p.g);
         if (!grp) {
+            // Cap concurrent groups; drop the oldest incomplete one when over the cap
+            // so a flood of never-completed groups can't grow memory unbounded.
+            if (this._groups.size >= ChunkReassembler.MAX_GROUPS) {
+                const oldest = this._groups.keys().next().value;
+                if (oldest !== undefined)
+                    this._groups.delete(oldest);
+            }
             grp = { n: p.n, parts: new Array(p.n).fill(''), got: 0 };
             this._groups.set(p.g, grp);
         }
-        if (grp.parts[p.i] === '' && grp.got < grp.n) {
+        if (p.i < grp.parts.length && grp.parts[p.i] === '' && grp.got < grp.n) {
             grp.parts[p.i] = p.d;
             grp.got++;
         }

package/server/dist/mobile/mobile-gateway.js

@@ -198,8 +198,8 @@ class MobileGateway {
             signalBase,
             doFetch: (url, init) => fetch(url, init),
             rooms: () => (0, mobile_devices_1.listDevices)(this._db).filter((d) => !d.revoked).map((d) => d.id),
-            makeOffer: () => this.webrtcOffer(),
-            acceptAnswer: (sdp) => this.webrtcAnswer(sdp),
+            makeOffer: (room) => this.webrtcOffer(room),
+            acceptAnswer: (room, sdp) => this.webrtcAnswer(sdp, room),
         });
         this._signal.start();
     }
@@ -242,18 +242,21 @@ class MobileGateway {
     /** Open a serverless WebRTC pairing offer (for the first QR). Returns the offer
      *  SDP + a single-use secret + the desktop identity; the webview encodes these
      *  into the QR the companion scans. */
-    async webrtcOffer() {
+    async webrtcOffer(room) {
         if (!this._webrtc)
             return null;
         const secret = (0, crypto_1.randomBytes)(16).toString('base64url');
-        const { sdp } = await this._webrtc.createOffer(secret);
+        // Per-room slot for reconnect (room = device id); undefined ⇒ the QR slot.
+        const { sdp } = room !== undefined ? await this._webrtc.createOffer(secret, room) : await this._webrtc.createOffer(secret);
         return { sdp, secret, hubName: this.desktopName(), hubInstanceId: this.instanceId() };
     }
-    /** Apply the companion's scanned answer SDP to the open offer. */
-    async webrtcAnswer(sdp) {
+    /** Apply the companion's scanned answer SDP to the open offer (per-room slot
+     *  for reconnect; the QR slot when no room given). */
+    async webrtcAnswer(sdp, room) {
         if (!this._webrtc)
             return false;
-        return (await this._webrtc.acceptAnswer(sdp)).ok;
+        const res = room !== undefined ? await this._webrtc.acceptAnswer(sdp, room) : await this._webrtc.acceptAnswer(sdp);
+        return res.ok;
     }
 }
 exports.MobileGateway = MobileGateway;

package/server/dist/mobile/mobile-signal-reconnect.js

@@ -41,7 +41,7 @@ class MobileSignalReconnect {
                     // A phone asking to reconnect? → answer with a fresh offer.
                     const req = await this._get(room, 'req');
                     if (req !== null) {
-                        const offer = await this._deps.makeOffer();
+                        const offer = await this._deps.makeOffer(room);
                         if (offer) {
                             await this._post(room, 'offer', JSON.stringify({ sdp: offer.sdp, sec: offer.secret, hub: offer.hubInstanceId, name: offer.hubName }));
                         }
@@ -52,7 +52,7 @@ class MobileSignalReconnect {
                         try {
                             const parsed = JSON.parse(ans);
                             if (typeof parsed.sdp === 'string')
-                                await this._deps.acceptAnswer(parsed.sdp);
+                                await this._deps.acceptAnswer(room, parsed.sdp);
                         }
                         catch {
                             /* malformed answer — ignore */

package/server/dist/mobile/mobile-webrtc-peer.js

@@ -4,24 +4,32 @@ exports.MobileWebrtcGateway = void 0;
 const werift_1 = require("werift");
 const auth_1 = require("../auth");
 const mobile_datachannel_1 = require("./mobile-datachannel");
+/** Default slot for the QR-pairing flow (a single un-keyed offer at a time). */
+const QR_KEY = '__qr__';
 class MobileWebrtcGateway {
     _deps;
-    _pending = null;
+    // Pending (un-answered) offers keyed by room/device id. A single slot would be
+    // CLOBBERED when multiple devices reconnect in one poll cycle: device B's
+    // createOffer closed device A's still-open offer, and acceptAnswer applied A's
+    // answer to whatever happened to be pending. Per-room keying isolates them.
+    _pending = new Map();
     _active = new Set();
     constructor(_deps) {
         this._deps = _deps;
     }
-    /** Drop the open (un-answered) offer. */
-    clearOffer() {
-        const p = this._pending;
-        this._pending = null;
-        if (p)
+    /** Drop the open (un-answered) offer for one room (default = QR slot). */
+    clearOffer(key = QR_KEY) {
+        const p = this._pending.get(key);
+        if (p) {
+            this._pending.delete(key);
             this._close(p.pc);
+        }
     }
     /** Create a fresh pairing offer (peer + DataChannel + gathered offer SDP).
-     *  Replaces any previously-open offer. Returns the SDP to embed in the QR. */
-    async createOffer(secret) {
-        this.clearOffer();
+     *  Replaces any previously-open offer FOR THE SAME ROOM. Returns the SDP to
+     *  embed in the QR / post to the room's mailbox. */
+    async createOffer(secret, key = QR_KEY) {
+        this.clearOffer(key);
         const pc = new werift_1.RTCPeerConnection({ iceServers: [] });
         const dc = pc.createDataChannel('mobile');
         // The companion peer activates when the channel opens. It validates `hello`
@@ -38,8 +46,9 @@ class MobileWebrtcGateway {
             console.log('[webrtc] pc connectionState:', s);
             if (s === 'failed' || s === 'closed' || s === 'disconnected') {
                 this._active.delete(pc);
-                if (this._pending?.pc === pc)
-                    this._pending = null;
+                // Drop this pc from whichever room slot still holds it.
+                if (this._pending.get(key)?.pc === pc)
+                    this._pending.delete(key);
             }
         });
         const offer = await pc.createOffer();
@@ -51,20 +60,20 @@ class MobileWebrtcGateway {
             throw new Error('no local description after ICE gathering');
         }
         console.log(`[webrtc] offer ready: ${(sdp.match(/a=candidate/g) ?? []).length} ICE candidates`);
-        this._pending = { pc, secret };
+        this._pending.set(key, { pc, secret });
         return { sdp };
     }
-    /** Apply the companion's scanned answer SDP to the open offer and keep the
-     *  connection alive for the session. */
-    async acceptAnswer(sdp) {
-        const p = this._pending;
+    /** Apply the companion's scanned answer SDP to the open offer FOR THE SAME ROOM
+     *  and keep the connection alive for the session. */
+    async acceptAnswer(sdp, key = QR_KEY) {
+        const p = this._pending.get(key);
         if (!p)
             return { ok: false };
         try {
             console.log(`[webrtc] applying answer: ${(sdp.match(/a=candidate/g) ?? []).length} ICE candidates`);
             await p.pc.setRemoteDescription({ type: 'answer', sdp });
             this._active.add(p.pc);
-            this._pending = null;
+            this._pending.delete(key);
             return { ok: true };
         }
         catch {
@@ -73,7 +82,8 @@ class MobileWebrtcGateway {
     }
     /** Tear down every peer (gateway stopping / disabled). */
     stop() {
-        this.clearOffer();
+        for (const key of [...this._pending.keys()])
+            this.clearOffer(key);
         for (const pc of this._active)
             this._close(pc);
         this._active.clear();

package/server/dist/mobile/mobile-ws.js

@@ -202,6 +202,13 @@ class MobileWsBridge {
                 this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
                 continue;
             }
+            // App-level desktop budget alert: deliver to EVERY subscriber holding the
+            // `alerts` topic regardless of which project tripped it (boundBroadcast
+            // stamps it with one project id, but it's an app-wide alert).
+            if (topic === 'alerts' && msg.type === 'desktop_daily_budget_exceeded') {
+                this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
+                continue;
+            }
             const projectId = msg.projectId;
             if (!projectId || !s.projects.has(projectId))
                 continue;

package/server/dist/path-resolver.js

@@ -120,6 +120,25 @@ function fastPathDirectories() {
     }
     return [];
 }
+/**
+ * Well-known Windows directories that hold globally-installed CLI shims
+ * (`claude.cmd` / `codex.cmd` / `gemini.cmd`) which a GUI-launched (Explorer/
+ * Tauri) process may not have on its inherited PATH. The per-user npm prefix
+ * places `.cmd` shims DIRECTLY in the prefix root (`%APPDATA%\npm`), not a `bin`
+ * subdir. `npm prefix -g` is the authoritative location for a custom prefix.
+ */
+function windowsGlobalBinDirs() {
+    if (process.platform !== 'win32')
+        return [];
+    const dirs = [];
+    // Default per-user npm prefix: shims (`claude.cmd` …) live in the prefix ROOT.
+    if (process.env.APPDATA)
+        dirs.push(path_1.default.join(process.env.APPDATA, 'npm'));
+    // Machine-wide Node install (also where a machine-scope npm prefix points).
+    if (process.env.ProgramFiles)
+        dirs.push(path_1.default.join(process.env.ProgramFiles, 'nodejs'));
+    return dirs;
+}
 /**
  * Returns the absolute path to the bundled runtimes directory.
  * Only valid when SPECRAILS_IS_DESKTOP=1 and SPECRAILS_BUNDLED_RUNTIMES_PATH is set.
@@ -200,9 +219,26 @@ function resolveStartupPath() {
     const inherited = splitPath(process.env.PATH);
     const inheritedSet = new Set(inherited);
     if (process.platform === 'win32') {
+        // Prepend well-known global-CLI dirs (npm prefix, Program Files\nodejs) that
+        // a GUI-launched process may lack, so provider shims (claude/codex/gemini
+        // .cmd) — and any RECURSIVE bare-name invocation by a spawned CLI — resolve.
+        // Existence-gated + deduped; no-op when already present (the common case).
+        const winPrepend = [];
+        for (const dir of windowsGlobalBinDirs()) {
+            if (dir && fileExists(dir) && !inheritedSet.has(dir)) {
+                winPrepend.push(dir);
+                inheritedSet.add(dir);
+            }
+        }
+        const winMerged = [...winPrepend, ...inherited];
+        if (winPrepend.length > 0)
+            process.env.PATH = joinPath(winMerged);
         diagnostic = {
-            pathSegments: inherited,
-            pathSources: inherited.map(() => 'inherited'),
+            pathSegments: winMerged,
+            pathSources: [
+                ...winPrepend.map(() => 'fast-path'),
+                ...inherited.map(() => 'inherited'),
+            ],
             loginShellStatus: 'skipped',
         };
         return;

package/server/dist/plugin-manager.js

@@ -252,7 +252,7 @@ class PluginManager {
         return out;
     }
     // ─── Install ───────────────────────────────────────────────────────────────
-    async install(projectPath, projectId, name, broadcast, providerId) {
+    async install(projectPath, projectId, name, broadcast, providerId, slug) {
         const plugin = this.registry.byName.get(name);
         if (!plugin)
             throw new PluginNotFoundError(name);
@@ -327,6 +327,7 @@ class PluginManager {
         const ctx = {
             projectPath,
             projectId,
+            slug,
             providerId,
             recordInstalledFile: (rel) => { installedFiles.push(rel); },
             log: onLog,
@@ -383,6 +384,19 @@ class PluginManager {
                     // the next install attempt.
                 }
             }
+            // For cli-add providers (codex), a successful `codex mcp add` lives in
+            // CODEX_HOME, NOT the snapshotted filesystem — the file rollback above
+            // can't undo it. Run the plugin's uninstall so a verify-failed codex
+            // install leaves no orphaned MCP registration (best-effort).
+            if (providerId && (0, providers_1.hasAdapter)(providerId) && (0, providers_1.getAdapter)(providerId).mcpRegistration === 'cli-add') {
+                try {
+                    await plugin.uninstall({
+                        projectPath, projectId, slug, providerId,
+                        recordInstalledFile: () => { }, log: onLog,
+                    });
+                }
+                catch { /* best-effort rollback of the codex registration */ }
+            }
             throw err instanceof PluginInstallError ? err : new PluginInstallError(`install of '${name}' failed: ${err?.message ?? String(err)}`, err);
         }
         const msg = {
@@ -395,7 +409,7 @@ class PluginManager {
         broadcast(msg);
     }
     // ─── Uninstall ─────────────────────────────────────────────────────────────
-    async uninstall(projectPath, projectId, name, broadcast, providerId) {
+    async uninstall(projectPath, projectId, name, broadcast, providerId, slug) {
         const state = this.getProjectState(projectPath);
         const entry = state.plugins[name];
         if (!entry)
@@ -417,6 +431,7 @@ class PluginManager {
             await plugin.uninstall({
                 projectPath,
                 projectId,
+                slug,
                 providerId,
                 recordInstalledFile: () => { },
                 log: onLog,

package/server/dist/plugins/serena/install.js

@@ -24,12 +24,13 @@ function isCodex(ctx) {
         return false;
     return (0, providers_1.getAdapter)(ctx.providerId).mcpRegistration === 'cli-add';
 }
-/** Project slug used by codex-mcp helpers — derived from the project path's
- *  basename. The app maintains the canonical slug elsewhere (ProjectRegistry);
- *  for the install context we don't have the registry, but the basename is a
- *  stable per-project identifier sufficient for CODEX_HOME isolation. */
-function slugFromProjectPath(projectPath) {
-    return path_1.default.basename(projectPath);
+/** Resolve the canonical per-project slug for codex-mcp CODEX_HOME isolation.
+ *  PREFER the registry slug threaded through the lifecycle context (the SAME
+ *  slug used by ~/.specrails/projects/<slug>/ everywhere else). Fall back to the
+ *  path basename only when absent — basenames collide between same-named repos
+ *  and would point CODEX_HOME at a shared/wrong dir. */
+function resolveCodexSlug(ctx) {
+    return ctx.slug && ctx.slug.trim().length > 0 ? ctx.slug : path_1.default.basename(ctx.projectPath);
 }
 async function installSerena(ctx) {
     if (isCodex(ctx)) {
@@ -40,7 +41,7 @@ async function installSerena(ctx) {
         if (!entry) {
             throw new Error('serena manifest is missing providerSupport.codex.mcpEntry');
         }
-        const slug = slugFromProjectPath(ctx.projectPath);
+        const slug = resolveCodexSlug(ctx);
         ctx.log(`Registering serena MCP via 'codex mcp add' (CODEX_HOME=~/.specrails/projects/${slug}/codex-home/)`);
         const result = (0, codex_mcp_1.codexMcpAdd)(slug, 'serena', entry);
         if (!result.ok) {
@@ -61,7 +62,7 @@ async function installSerena(ctx) {
 }
 async function uninstallSerena(ctx) {
     if (isCodex(ctx)) {
-        const slug = slugFromProjectPath(ctx.projectPath);
+        const slug = resolveCodexSlug(ctx);
         // Probe first so removing an already-removed server doesn't surface as an
         // error (e.g. the user uninstalled via terminal then via the app).
         const listing = (0, codex_mcp_1.codexMcpList)(slug);

package/server/dist/plugins-router.js

@@ -79,7 +79,7 @@ function createPluginsRouter() {
     router.post('/:name/install', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().install(pluginRoot(project), project.id, req.params.name, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().install(pluginRoot(project), project.id, req.params.name, broadcast, project.provider, project.slug);
             res.status(200).json({ ok: true });
         }
         catch (err) {
@@ -90,7 +90,7 @@ function createPluginsRouter() {
     router.delete('/:name', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().uninstall(pluginRoot(project), project.id, req.params.name, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().uninstall(pluginRoot(project), project.id, req.params.name, broadcast, project.provider, project.slug);
             res.status(200).json({ ok: true });
         }
         catch (err) {

package/server/dist/profile-manager.js

@@ -7,6 +7,7 @@ exports.ProfileConflictError = exports.ProfileNotFoundError = exports.ProfileVal
 exports.validateProfile = validateProfile;
 exports.listProfiles = listProfiles;
 exports.getProfile = getProfile;
+exports.getProfileRaw = getProfileRaw;
 exports.createProfile = createProfile;
 exports.updateProfile = updateProfile;
 exports.deleteProfile = deleteProfile;
@@ -198,6 +199,30 @@ function getProfile(projectPath, name, expectedProvider = 'claude') {
     const raw = JSON.parse(fs_1.default.readFileSync(full, 'utf8'));
     return validateProfile(raw, expectedProvider);
 }
+/**
+ * Non-validating read for the editor: returns the parsed profile body plus any
+ * schema/structural validation errors (instead of throwing). A profile that
+ * became invalid against the current agent catalog must still be openable so the
+ * user can repair it — `getProfile` would throw and lock it out. JSON-parse
+ * errors still throw (unrepairable in the editor). `validateProfile` remains the
+ * gate on create/update/launch.
+ */
+function getProfileRaw(projectPath, name, expectedProvider = 'claude') {
+    assertValidName(name);
+    const full = profilePath(projectPath, name);
+    if (!fs_1.default.existsSync(full)) {
+        throw new ProfileNotFoundError(name);
+    }
+    const raw = JSON.parse(fs_1.default.readFileSync(full, 'utf8'));
+    try {
+        validateProfile(raw, expectedProvider);
+        return { profile: raw, valid: true, errors: [] };
+    }
+    catch (err) {
+        const errors = err instanceof ProfileValidationError ? err.errors : [err.message];
+        return { profile: raw, valid: false, errors };
+    }
+}
 function createProfile(projectPath, profile, expectedProvider = 'claude') {
     assertValidName(profile.name);
     validateProfile(profile, expectedProvider);
@@ -235,6 +260,11 @@ function duplicateProfile(projectPath, sourceName, newName, expectedProvider = '
     return copy;
 }
 function renameProfile(projectPath, fromName, toName, expectedProvider = 'claude') {
+    // Renaming the default away would leave no default → resolveProfile returns
+    // null and rails silently drop to legacy/no-profile mode. Mirror deleteProfile.
+    if (fromName === 'default' || fromName === 'project-default') {
+        throw new ProfileValidationError(['cannot rename the default profile']);
+    }
     const source = getProfile(projectPath, fromName, expectedProvider);
     assertValidName(toName);
     if (fs_1.default.existsSync(profilePath(projectPath, toName))) {

package/server/dist/profiles-router.js

@@ -742,7 +742,11 @@ function createProfilesRouter() {
     router.get('/:name', (req, res) => {
         try {
             const { project } = ctx(req);
-            res.json({ profile: (0, profile_manager_1.getProfile)(specRoot(project), req.params.name, project.provider ?? 'claude') });
+            // Non-validating read so a profile that drifted invalid against the current
+            // catalog can still be opened + repaired in the editor (getProfile threw and
+            // locked it out). The body + validation errors are both returned.
+            const { profile, valid, errors } = (0, profile_manager_1.getProfileRaw)(specRoot(project), req.params.name, project.provider ?? 'claude');
+            res.json({ profile, valid, validationErrors: errors });
         }
         catch (err) {
             handleError(res, err);

package/server/dist/project-registry.js

@@ -23,6 +23,9 @@ const ticket_watcher_1 = require("./ticket-watcher");
 const terminal_manager_1 = require("./terminal-manager");
 const browser_capture_manager_1 = require("./browser-capture-manager");
 const explore_cwd_manager_1 = require("./explore-cwd-manager");
+const hooks_1 = require("./hooks");
+const transient_children_1 = require("./transient-children");
+const telemetry_receiver_1 = require("./telemetry-receiver");
 const artifact_registry_1 = require("./artifact-registry");
 const workspace_resolution_1 = require("./workspace-resolution");
 const workspace_manager_1 = require("./workspace-manager");
@@ -153,6 +156,11 @@ class ProjectRegistry {
                 ctx.setupManager.abort(id);
             }
             catch { /* ignore */ }
+            // Kill untracked fire-and-forget children (Quick spec-gen) for this project.
+            try {
+                (0, transient_children_1.killTransientChildren)(id);
+            }
+            catch { /* ignore */ }
             // M12: these three also spawn children that outlive removeProject. Proposal
             // and AgentRefine write to the per-project DB in their close handlers — if
             // not disposed before db.close() they throw on the closed connection and
@@ -196,6 +204,16 @@ class ProjectRegistry {
                 (0, explore_cwd_manager_1.removeExploreCwd)(ctx.project.slug);
             }
             catch { /* ignore — non-fatal */ }
+            // Drop this project's per-project phase-tracking scope (avoid a leak).
+            try {
+                (0, hooks_1.dropPhaseScope)(id);
+            }
+            catch { /* ignore */ }
+            // Drop any in-memory telemetry BlobState entries for this project.
+            try {
+                (0, telemetry_receiver_1.dropBlobStatesForProject)(id);
+            }
+            catch { /* ignore */ }
             // Close the DB connection BEFORE removing the project's data dir below.
             try {
                 ctx.db.close();
@@ -282,6 +300,17 @@ class ProjectRegistry {
                 ctx.chatManager.shutdown();
             }
             catch { /* ignore */ }
+            // Install/enrich wizard children + the 3s install poll interval are NOT
+            // torn down by the spawner shutdowns above — mirror removeProject()'s
+            // setupManager.abort() so a quit mid-wizard doesn't orphan them.
+            try {
+                ctx.setupManager.abort(ctx.project.id);
+            }
+            catch { /* ignore */ }
+            try {
+                (0, transient_children_1.killTransientChildren)(ctx.project.id);
+            }
+            catch { /* ignore */ }
             try {
                 ctx.proposalManager.shutdown();
             }
@@ -376,6 +405,16 @@ class ProjectRegistry {
                 }
                 return { budget, totalSpend };
             },
+            onBudgetExceeded: (event, data) => {
+                // Deliver the budget event to this project's subscribed webhooks — the
+                // WS broadcast alone never reached webhook subscribers, so a
+                // daily_budget_exceeded / desktop_daily_budget_exceeded subscription was
+                // dead. (Event names are in the webhook validEvents allow-list.)
+                try {
+                    webhookManager.deliver(project.id, event, data);
+                }
+                catch { /* best-effort */ }
+            },
             onJobFinished: (jobId, status, costUsd) => {
                 const jobRow = db.prepare('SELECT command, duration_ms FROM jobs WHERE id = ?').get(jobId);
                 const event = status === 'completed' ? 'job.completed' : status === 'canceled' ? 'job.canceled' : 'job.failed';