specrails-desktop 2.11.4 → 2.11.6

package/server/dist/project-router-chat.js

@@ -124,10 +124,26 @@ function registerChatRoutes(deps) {
         }
         const { title, model } = req.body ?? {};
         const patch = {};
-        if (title !== undefined)
+        if (title !== undefined) {
+            if (typeof title !== 'string') {
+                res.status(400).json({ error: 'title must be a string' });
+                return;
+            }
             patch.title = title;
-        if (model !== undefined)
+        }
+        if (model !== undefined) {
+            // Validate against the conversation's own provider so a bad value can't be
+            // persisted and break the next turn's spawn. (Mirrors the POST handler.)
+            const convProvider = conversation.provider ?? 'claude';
+            if (typeof model !== 'string' || !(0, spec_models_1.isValidModelForProvider)(model, convProvider)) {
+                res.status(400).json({
+                    error: `Invalid model "${String(model)}" for provider "${convProvider}"`,
+                    allowed: (0, spec_models_1.getModelsForProvider)(convProvider).map((m) => m.value),
+                });
+                return;
+            }
             patch.model = model;
+        }
         (0, db_1.updateConversation)(db, req.params.id, patch);
         const updated = (0, db_1.getConversation)(db, req.params.id);
         res.json({ ok: true, conversation: updated });

package/server/dist/project-router-jobs.js

@@ -77,7 +77,7 @@ function registerJobsRoutes(deps) {
         res.json({
             projectName: project.name,
             projectId: project.id,
-            phases: (0, hooks_1.getPhaseStates)(),
+            phases: (0, hooks_1.getPhaseStates)(project.id),
             busy: queueManager.getActiveJobId() !== null,
             currentJobId: queueManager.getActiveJobId(),
             featureFlags: {

package/server/dist/project-router-spending.js

@@ -125,9 +125,9 @@ function registerSpendingRoutes(deps) {
                 ].join(','));
                 lines.push('');
                 lines.push('# Daily timeline');
-                lines.push('date,jobsCostUsd,quickCostUsd,exploreCostUsd,aiEditCostUsd,totalCostUsd');
+                lines.push('date,jobsCostUsd,quickCostUsd,exploreCostUsd,aiEditCostUsd,smashCostUsd,fileSummaryCostUsd,totalCostUsd');
                 for (const d of data.dailyTimeline) {
-                    lines.push(`${d.date},${d.jobsCostUsd},${d.quickCostUsd},${d.exploreCostUsd},${d.aiEditCostUsd},${d.totalCostUsd}`);
+                    lines.push(`${d.date},${d.jobsCostUsd},${d.quickCostUsd},${d.exploreCostUsd},${d.aiEditCostUsd},${d.smashCostUsd},${d.fileSummaryCostUsd},${d.totalCostUsd}`);
                 }
                 lines.push('');
                 lines.push('# By surface');
@@ -198,7 +198,11 @@ function registerSpendingRoutes(deps) {
         }
     });
     function csvEscape(v) {
-        const s = v == null ? '' : String(v);
+        let s = v == null ? '' : String(v);
+        // CSV formula injection: a value starting with = + - @ (or tab/CR) is run as
+        // a formula by Excel/Sheets. Neutralize by prefixing a single quote.
+        if (/^[=+\-@\t\r]/.test(s))
+            s = `'${s}`;
         return s.includes(',') || s.includes('"') || s.includes('\n')
             ? `"${s.replace(/"/g, '""')}"`
             : s;

package/server/dist/project-router-tickets.js

@@ -56,6 +56,7 @@ const provider_selection_1 = require("./provider-selection");
 const ticket_store_1 = require("./ticket-store");
 const explore_draft_title_1 = require("./explore-draft-title");
 const cli_prompt_1 = require("./util/cli-prompt");
+const transient_children_1 = require("./transient-children");
 const readline_1 = require("readline");
 const tree_kill_1 = __importDefault(require("tree-kill"));
 const workspace_resolution_1 = require("./workspace-resolution");
@@ -307,6 +308,9 @@ function registerTicketsRoutes(deps) {
             stdio: ['ignore', 'pipe', 'pipe'],
             cwd: specGenExec.cwd,
         });
+        // Register so removeProject()/shutdown() can tree-kill this otherwise-untracked
+        // fire-and-forget child (auto-unregisters on close/error).
+        (0, transient_children_1.trackTransientChild)(projectId, child);
         // Watchdog: unlike ai-edit, generate-spec keeps no cancellable handle, so a
         // hung CLI (network stall, model never emitting a terminating event) would
         // otherwise leak this child + its readline for the app's lifetime. Cap is
@@ -696,9 +700,18 @@ function registerTicketsRoutes(deps) {
                     flippedInPlace = true;
                     return;
                 }
-                // Idempotent on conversationId: if a draft ticket already references this
-                // conversation, update in place rather than create a second one.
-                const existing = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId && t.status === 'draft');
+                // Idempotent on conversationId. A ticket from this conversation may
+                // already exist as a DRAFT (update in place) OR as a COMMITTED ticket
+                // (it was already turned into a real spec) — in the latter case do NOT
+                // insert a duplicate draft sharing the same origin_conversation_id
+                // (which would also break the delete→conversation cascade). Return the
+                // committed ticket unchanged instead.
+                const anyExisting = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId);
+                if (anyExisting && anyExisting.status !== 'draft') {
+                    saved = anyExisting;
+                    return;
+                }
+                const existing = anyExisting && anyExisting.status === 'draft' ? anyExisting : undefined;
                 const title = providedTitle || existing?.title || (0, explore_draft_title_1.generateAutoTitle)(messages.map((m) => ({ role: m.role, content: m.content ?? '' })));
                 if (existing) {
                     existing.title = title;
@@ -829,10 +842,18 @@ function registerTicketsRoutes(deps) {
                 let flipTarget;
                 if (draftTicketId !== null) {
                     flipTarget = s.tickets[String(draftTicketId)];
-                    if (!flipTarget || flipTarget.status !== 'draft') {
+                    if (!flipTarget) {
                         explicitDraftMissing = true;
                         return;
                     }
+                    if (flipTarget.status !== 'draft') {
+                        // Already committed (lost-response retry / second tab / watchdog
+                        // re-fire): return the committed ticket idempotently instead of a
+                        // spurious 404. The draft was flipped on the first call.
+                        created = flipTarget;
+                        wasFlip = true;
+                        return;
+                    }
                 }
                 else if (conversationId) {
                     flipTarget = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId && t.status === 'draft');
@@ -953,7 +974,13 @@ function registerTicketsRoutes(deps) {
             // are checked inside runContractRefine. Claude-only today — codex
             // contract refine isn't wired (the spawn hardcodes the `claude`
             // binary). Skip silently on codex projects.
-            if (conversationId && created && project.provider === 'claude') {
+            // Gate on the CONVERSATION's own engine, not the project's PRIMARY
+            // provider: a multi-provider project with a non-claude primary can still
+            // run an Explore on the claude engine + opt into Contract Refine.
+            const convoProvider = conversationId
+                ? ((0, db_1.getConversation)(ctx(req).db, conversationId)?.provider ?? 'claude')
+                : null;
+            if (conversationId && created && convoProvider === 'claude') {
                 const createdTicketId = created.id;
                 const convoId = conversationId;
                 console.log(`[project-router] from-draft hook: scheduling refine ticket=${createdTicketId} conv=${convoId}`);
@@ -970,8 +997,8 @@ function registerTicketsRoutes(deps) {
                     });
                 });
             }
-            else if (conversationId && created && project.provider === 'codex') {
-                console.log(`[project-router] from-draft contract refine skipped for codex project (ticket #${created.id})`);
+            else if (conversationId && created && convoProvider && convoProvider !== 'claude') {
+                console.log(`[project-router] from-draft contract refine skipped for ${convoProvider} conversation (ticket #${created.id})`);
             }
         }
         catch (err) {

package/server/dist/project-router.js

@@ -61,7 +61,7 @@ function createProjectRouter(registry) {
     const hooksRouterByCtx = new WeakMap();
     router.use('/:projectId/hooks', (req, res, next) => {
         const projectCtx = ctx(req);
-        const hooksRouter = memoizedSubRouter(hooksRouterByCtx, projectCtx, () => (0, hooks_1.createHooksRouter)(projectCtx.broadcast, projectCtx.db, {
+        const hooksRouter = memoizedSubRouter(hooksRouterByCtx, projectCtx, () => (0, hooks_1.createHooksRouter)(projectCtx.project.id, projectCtx.broadcast, projectCtx.db, {
             get current() { return projectCtx.queueManager.getActiveJobId(); },
             set current(_) { },
         }));

package/server/dist/providers/claude-adapter.js

@@ -263,7 +263,9 @@ function extractClaudeResult(events) {
         num_turns: resultPayload.num_turns,
         model: resultPayload.model,
         duration_ms: resultPayload.duration_ms,
-        duration_api_ms: resultPayload.api_duration_ms,
+        // The Claude Code CLI emits `duration_api_ms`; the old `api_duration_ms`
+        // lookup always resolved undefined (persisted NULL). Read both, real first.
+        duration_api_ms: (resultPayload.duration_api_ms ?? resultPayload.api_duration_ms),
         session_id: finalSessionId,
     };
 }

package/server/dist/providers/gemini-adapter.js

@@ -29,6 +29,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports._GEMINI_MIN_VERSION = exports.geminiAdapter = void 0;
 exports._compareSemver = compareSemver;
 const child_process_1 = require("child_process");
+const win_spawn_1 = require("../util/win-spawn");
 const gemini_agent_ack_1 = require("./gemini-agent-ack");
 const WHICH_CMD = process.platform === 'win32' ? 'where' : 'which';
 // Floor where `--output-format stream-json` + headless `--resume` are available.
@@ -180,16 +181,20 @@ function compareSemver(a, b) {
 }
 async function detectGeminiInstalled() {
     try {
-        (0, child_process_1.execSync)(`${WHICH_CMD} gemini`, { stdio: 'ignore' });
+        (0, child_process_1.execSync)(`${WHICH_CMD} gemini`, { stdio: 'ignore', env: (0, win_spawn_1.windowsSpawnEnv)() });
     }
     catch {
         return { installed: false, executable: false };
     }
     try {
+        // gemini is a Node CLI; its cold `--version` (cmd.exe → node → load bundle,
+        // Defender scanning) can exceed a few seconds on Windows. Give it a generous
+        // budget + SystemRoot env so it isn't wrongly reported not-executable.
         const raw = (0, child_process_1.execSync)('gemini --version', {
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'ignore'],
-            timeout: 3000,
+            timeout: process.platform === 'win32' ? 20_000 : 8_000,
+            env: (0, win_spawn_1.windowsSpawnEnv)(),
         }).trim();
         const match = raw.match(/\d+\.\d+\.\d+/);
         const version = match ? match[0] : raw;

package/server/dist/queue-manager.js

@@ -142,6 +142,7 @@ class QueueManager {
      *  fallback model name stamped onto the ai_invocations row. */
     _resolvedModel;
     _onJobFinished;
+    _onBudgetExceeded;
     /** Project ID used for OTEL resource attributes (Super mode only) */
     _projectId;
     /** Server port used to construct the OTLP endpoint URL for env injection */
@@ -194,6 +195,7 @@ class QueueManager {
         this._adapter = (0, providers_1.getAdapter)(options?.provider ?? 'claude');
         this._resolvedModel = options?.resolvedModel ?? null;
         this._onJobFinished = options?.onJobFinished ?? null;
+        this._onBudgetExceeded = options?.onBudgetExceeded ?? null;
         this._projectId = options?.projectId ?? null;
         this._desktopPort = options?.desktopPort ?? 4200;
         this._projectSlug = options?.projectSlug ?? null;
@@ -625,11 +627,51 @@ class QueueManager {
             console.error(`[QueueManager] _startJob(${nextJobId}) threw before spawn: ${err?.message}`);
             // Only release if we never established a child (else _onJobExit owns cleanup).
             if (this._activeJobId === nextJobId && this._activeProcess === null) {
+                // Stamp the job terminal — _onJobExit never runs without a child, so the
+                // job would otherwise wedge 'running' forever and never fire
+                // onJobFinished (rail/webhook never settle) and leak its per-job maps.
+                this._failWedgedJob(nextJobId, err?.message ?? 'startup failure');
                 this._activeJobId = null;
                 this._drainQueue();
             }
         });
     }
+    /**
+     * Stamp a job terminal-failed when `_startJob` threw BEFORE a child was ever
+     * established (so no `_onJobExit` will run). Mirrors _onJobExit's terminal
+     * bookkeeping: in-memory + DB status, per-job map cleanup, onJobFinished, and
+     * a queue-state broadcast. Best-effort and never throws.
+     */
+    _failWedgedJob(jobId, reason) {
+        const job = this._jobs.get(jobId);
+        if (job && job.status === 'running') {
+            job.status = 'failed';
+            job.finishedAt = new Date().toISOString();
+        }
+        // Clear per-job selection/snapshot maps (none were consumed by a spawn).
+        this._jobExecution.delete(jobId);
+        this._snapshotRefs.delete(jobId);
+        this._jobModelSelection.delete(jobId);
+        this._jobProfileSelection.delete(jobId);
+        this._jobInteractiveSelection.delete(jobId);
+        if (this._db) {
+            try {
+                (0, db_1.finishJob)(this._db, jobId, { exit_code: -1, status: 'failed' });
+            }
+            catch {
+                /* DB may be closed mid-shutdown — never throw from the drain catch */
+            }
+        }
+        try {
+            this._onJobFinished?.(jobId, 'failed', undefined);
+        }
+        catch {
+            /* onJobFinished is best-effort */
+        }
+        this._persistQueueState();
+        this._broadcastQueueState();
+        console.error(`[QueueManager] job ${jobId} failed before spawn: ${reason}`);
+    }
     /**
      * Resolve the adapter for a job at spawn time: the per-job provider override
      * (consumed from `_jobProviderSelection`) when present and registered, else
@@ -858,12 +900,13 @@ class QueueManager {
         job.queuePosition = null;
         this._recomputePositions();
         this._persistJob(job);
+        const phaseScopeId = this._projectId ?? this._cwd ?? 'default';
         const commandPhases = this._phasesForCommand(job.command);
         if (commandPhases.length > 0) {
-            (0, hooks_1.setActivePhases)(commandPhases, this._broadcast);
+            (0, hooks_1.setActivePhases)(phaseScopeId, commandPhases, this._broadcast);
         }
         else {
-            (0, hooks_1.resetPhases)(this._broadcast);
+            (0, hooks_1.resetPhases)(phaseScopeId, this._broadcast);
         }
         const commandToRun = job.command.trim();
         // Build supplementary context (output chaining + headless mode) that goes
@@ -1177,6 +1220,14 @@ class QueueManager {
         });
         this._activeProcess = child;
         this._activeJobId = jobId;
+        // Honour a cancel that arrived during the async pre-spawn window (it recorded
+        // intent in _cancelingJobs via _kill but found no child yet). SIGTERM the
+        // just-spawned child now; the close handler wired below fires _onJobExit,
+        // which reads _cancelingJobs and stamps 'canceled'. No early-return — the
+        // exit handler MUST still be wired so the job settles.
+        if (this._cancelingJobs.has(jobId)) {
+            this._kill(jobId);
+        }
         // Without this listener, an ENOENT (e.g. claude not on PATH) propagates
         // as an unhandled 'error' event and crashes the entire app. Node still
         // emits 'close' afterwards, so the existing close handler fails the job
@@ -1529,6 +1580,10 @@ class QueueManager {
                                     this._db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('paused', 'true')`).run();
                                 }
                                 this._broadcast({ type: 'daily_budget_exceeded', projectId: '', dailySpend, budget: dailyBudget, queuePaused: true });
+                                try {
+                                    this._onBudgetExceeded?.('daily_budget_exceeded', { dailySpend, budget: dailyBudget, queuePaused: true });
+                                }
+                                catch { /* webhook delivery is best-effort */ }
                             }
                         }
                     }
@@ -1542,6 +1597,10 @@ class QueueManager {
                                 this._db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('paused', 'true')`).run();
                             }
                             this._broadcast({ type: 'desktop_daily_budget_exceeded', projectId: '', desktopDailySpend: desktopTotalSpend, desktopBudget, queuePaused: true });
+                            try {
+                                this._onBudgetExceeded?.('desktop_daily_budget_exceeded', { desktopDailySpend: desktopTotalSpend, desktopBudget, queuePaused: true });
+                            }
+                            catch { /* webhook delivery is best-effort */ }
                         }
                     }
                 }
@@ -1626,6 +1685,13 @@ class QueueManager {
         this._kill(jobId);
     }
     _kill(jobId) {
+        // Record the cancel intent UP FRONT — even when no child exists yet. A
+        // cancel arriving during the async pre-spawn window (plugin verify / profile
+        // snapshot) would otherwise early-return below before recording intent, the
+        // child would later spawn unobserved, and _onJobExit would stamp 'completed'.
+        // With the intent recorded, the post-spawn check in _startJob SIGTERMs the
+        // child once it exists, and _onJobExit reads it to stamp 'canceled'.
+        this._cancelingJobs.add(jobId);
         if (!this._activeProcess || !this._activeProcess.pid)
             return;
         this._clearZombieTimer();
@@ -1636,7 +1702,6 @@ class QueueManager {
             clearTimeout(this._killTimer);
             this._killTimer = null;
         }
-        this._cancelingJobs.add(jobId);
         (0, tree_kill_1.default)(this._activeProcess.pid, 'SIGTERM');
         const pid = this._activeProcess.pid;
         this._killTimer = setTimeout(() => {

package/server/dist/result-event.js

@@ -80,7 +80,8 @@ function normaliseResultEvent(event, provider = 'claude') {
             num_turns: event.num_turns,
             model: event.model,
             duration_ms: event.duration_ms,
-            duration_api_ms: event.api_duration_ms,
+            // CLI emits `duration_api_ms`; keep the legacy alias as a fallback.
+            duration_api_ms: (event.duration_api_ms ?? event.api_duration_ms),
             session_id: event.session_id,
         };
     }

package/server/dist/setup-manager.js

@@ -26,6 +26,7 @@ const bundled_core_1 = require("./bundled-core");
 const bundled_openspec_1 = require("./bundled-openspec");
 const path_resolver_1 = require("./path-resolver");
 const framework_manager_1 = require("./framework-manager");
+const workspace_resolution_1 = require("./workspace-resolution");
 /**
  * specrails-core's installer (Node-native from v4.2.0 onward, bash
  * prior) always scaffolds into `.claude/` regardless of which AI
@@ -668,6 +669,14 @@ class SetupManager {
     _checkpoints;
     // Track checkpoint start times
     _checkpointStart;
+    // Project ids whose install/enrich was explicitly aborted — the close handler
+    // checks this to suppress a spurious setup_error / double onSetupDone when the
+    // SIGTERM'd child closes with a null exit code.
+    _abortedProjects = new Set();
+    // projectId → registry slug (captured at startInstall) so post-install
+    // validation/summary/checkpoint reads resolve the RELOCATED workspace artifact
+    // root rather than the (pristine) repo path.
+    _projectSlugs = new Map();
     // Ring buffer for install log lines — allows clients to recover log on reconnect
     _installLogBuffer;
     // Track each project's chosen AI provider for binary selection
@@ -692,6 +701,9 @@ class SetupManager {
     }
     // ─── Full Install: TUI installer (npx specrails-core) ────────────────────────
     startInstall(projectId, projectPath, projectSlug, provider) {
+        this._abortedProjects.delete(projectId); // fresh run — clear any prior abort flag
+        if (projectSlug)
+            this._projectSlugs.set(projectId, projectSlug);
         if (this._installProcesses.has(projectId)) {
             console.warn(`[SetupManager] install already running for ${projectId}`);
             return;
@@ -874,8 +886,15 @@ class SetupManager {
                 catch { /* non-fatal */ }
             }
             this._installProcesses.delete(projectId);
+            // Explicit abort already tore down + fired onSetupDone — don't surface a
+            // spurious setup_error for the SIGTERM'd child's null exit.
+            if (this._abortedProjects.has(projectId))
+                return;
             if (code === 0) {
-                const validation = validateInstalledCore(projectPath);
+                // Relocated installs write artifacts to the workspace, not the repo —
+                // validate/sweep/summarize against the resolved artifact root.
+                const artifactRoot = this._artifactRoot(projectId, projectPath);
+                const validation = validateInstalledCore(artifactRoot);
                 if (!validation.ok) {
                     this._broadcast({
                         type: 'setup_error',
@@ -886,8 +905,8 @@ class SetupManager {
                 }
                 this._advanceCheckpoint(projectId, 'base_install');
                 this._completeCheckpoint(projectId, 'base_install');
-                const legacySrRemoved = sweepLegacySrCommands(projectPath);
-                const summary = { ...computeSummary(projectPath, tier, this._projectProviders.get(projectId) ?? 'claude'), legacySrRemoved };
+                const legacySrRemoved = sweepLegacySrCommands(artifactRoot);
+                const summary = { ...computeSummary(artifactRoot, tier, this._projectProviders.get(projectId) ?? 'claude'), legacySrRemoved };
                 this._broadcast({
                     type: 'setup_install_done',
                     projectId,
@@ -909,6 +928,7 @@ class SetupManager {
     }
     // ─── Enrich: claude -p "/specrails:enrich --from-config" ────────────────────
     startEnrich(projectId, projectPath, provider, projectName) {
+        this._abortedProjects.delete(projectId); // fresh run — clear any prior abort flag
         if (this._setupProcesses.has(projectId)) {
             console.warn(`[SetupManager] enrich already running for ${projectId}`);
             return;
@@ -1132,21 +1152,28 @@ class SetupManager {
         child.on('close', (code) => {
             this._setupProcesses.delete(projectId);
             this._stopFilesystemPoll(projectId);
+            // Explicit abort already tore down + fired onSetupDone — suppress the
+            // failure branch (spurious error + a second onSetupDone) here.
+            if (this._abortedProjects.has(projectId))
+                return;
             // Final filesystem sync
             this._syncFilesystemCheckpoints(projectId, projectPath);
             if (code === 0) {
                 // Sync filesystem checkpoints
                 this._syncFilesystemCheckpoints(projectId, projectPath);
+                // Relocated installs write artifacts to the workspace, not the repo —
+                // resolve the has-agents/has-commands gate + summary against it.
+                const artifactRoot = this._artifactRoot(projectId, projectPath);
                 // Check if setup is truly complete — real artifacts must exist
-                const hasAgents = (0, fs_1.existsSync)((0, path_1.join)(projectPath, SPECRAILS_DIR, 'agents')) &&
-                    hasFiles((0, path_1.join)(projectPath, SPECRAILS_DIR, 'agents'), /^sr-.*\.md$/);
-                const hasCommands = (((0, fs_1.existsSync)((0, path_1.join)(projectPath, SPECRAILS_DIR, 'commands', 'sr')) && hasFiles((0, path_1.join)(projectPath, SPECRAILS_DIR, 'commands', 'sr'), /\.md$/)) ||
-                    ((0, fs_1.existsSync)((0, path_1.join)(projectPath, SPECRAILS_DIR, 'commands', 'specrails')) && hasFiles((0, path_1.join)(projectPath, SPECRAILS_DIR, 'commands', 'specrails'), /\.md$/)));
+                const hasAgents = (0, fs_1.existsSync)((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'agents')) &&
+                    hasFiles((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'agents'), /^sr-.*\.md$/);
+                const hasCommands = (((0, fs_1.existsSync)((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'commands', 'sr')) && hasFiles((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'commands', 'sr'), /\.md$/)) ||
+                    ((0, fs_1.existsSync)((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'commands', 'specrails')) && hasFiles((0, path_1.join)(artifactRoot, SPECRAILS_DIR, 'commands', 'specrails'), /\.md$/)));
                 const isComplete = hasAgents && hasCommands;
                 if (isComplete) {
-                    const legacySrRemoved = sweepLegacySrCommands(projectPath);
+                    const legacySrRemoved = sweepLegacySrCommands(artifactRoot);
                     const tier = this._projectTiers.get(projectId) ?? 'full';
-                    const summary = { ...computeSummary(projectPath, tier, this._projectProviders.get(projectId) ?? 'claude'), legacySrRemoved };
+                    const summary = { ...computeSummary(artifactRoot, tier, this._projectProviders.get(projectId) ?? 'claude'), legacySrRemoved };
                     this._onSetupDone?.(projectId);
                     this._broadcast({
                         type: 'setup_complete',
@@ -1229,11 +1256,27 @@ class SetupManager {
         checkpoint.duration_ms = duration_ms;
         this._broadcast({ type: 'setup_checkpoint', projectId, checkpoint: key, status: 'done', duration_ms });
     }
+    /** Resolve the artifact root for post-install reads. For a RELOCATED project
+     *  (registry entry + populated workspace) the `.specrails`/provider dirs live
+     *  in the workspace, NOT the pristine repo path — `resolveProjectExecution`
+     *  returns that cwd. Falls back to the repo path (legacy) when no slug is
+     *  known or the project isn't relocated. */
+    _artifactRoot(projectId, projectPath) {
+        const slug = this._projectSlugs.get(projectId);
+        if (!slug)
+            return projectPath;
+        try {
+            return (0, workspace_resolution_1.resolveProjectExecution)({ slug, path: projectPath }).cwd;
+        }
+        catch {
+            return projectPath;
+        }
+    }
     _syncFilesystemCheckpoints(projectId, projectPath) {
         const statuses = this._checkpoints.get(projectId);
         if (!statuses)
             return;
-        const fsChecks = checkFilesystem(projectPath);
+        const fsChecks = checkFilesystem(this._artifactRoot(projectId, projectPath));
         for (const [key, exists] of Object.entries(fsChecks)) {
             if (!exists)
                 continue;
@@ -1268,9 +1311,14 @@ class SetupManager {
     }
     // ─── Abort ────────────────────────────────────────────────────────────────────
     abort(projectId) {
+        // Mark aborted so the still-registered close handlers suppress their failure
+        // branch (spurious setup_error + a second onSetupDone) when the SIGTERM'd
+        // child closes with a null code. Cleared on the next startInstall/startEnrich.
+        this._abortedProjects.add(projectId);
         this._stopFilesystemPoll(projectId);
         this._projectProviders.delete(projectId);
         this._projectTiers.delete(projectId);
+        this._projectSlugs.delete(projectId);
         this._onSetupDone?.(projectId);
         const installChild = this._installProcesses.get(projectId);
         if (installChild?.pid) {

package/server/dist/setup-prerequisites.js

@@ -28,13 +28,19 @@ const WHICH_CMD = process.platform === 'win32' ? 'where' : 'which';
  * inherited a stripped env) — without it every bundled probe failed with a bogus
  * "bundle corrupted — reinstall the app".
  */
-function runVersionSpawn(cmd, args) {
-    const opts = { env: (0, win_spawn_1.windowsSpawnEnv)(), encoding: 'utf-8', timeout: 5_000 };
+function runVersionSpawn(cmd, args, timeoutMs = 5_000) {
+    const opts = { env: (0, win_spawn_1.windowsSpawnEnv)(), encoding: 'utf-8', timeout: timeoutMs };
     if (process.platform === 'win32') {
         return cross_spawn_1.default.sync(cmd, args, opts);
     }
     return (0, child_process_1.spawnSync)(cmd, args, opts);
 }
+// A bundled/system CLI's `--version` cold start can be slow on Windows: a npm
+// `.cmd` shim goes cmd.exe → node.exe → load the CLI bundle, while Defender
+// scans it. The Node-based gemini CLI in particular exceeded the old 5s cap and
+// was wrongly reported not-executable. Give version probes a generous Windows
+// budget; the `where`/`which` LOCATE probe stays fast (5s) since it's a builtin.
+const VERSION_PROBE_TIMEOUT_MS = process.platform === 'win32' ? 20_000 : 8_000;
 exports.MIN_VERSIONS = {
     node: '18.0.0',
     npm: '9.0.0',
@@ -53,7 +59,7 @@ function locateCommand(command) {
 }
 /** Run `<bin> <args>` and interpret the result as a `--version` probe. */
 function runProbe(bin, args) {
-    const result = runVersionSpawn(bin, args);
+    const result = runVersionSpawn(bin, args, VERSION_PROBE_TIMEOUT_MS);
     if (result.error) {
         const err = result.error;
         return { executed: false, error: `${err.code ?? 'ERR'}: ${err.message}` };

package/server/dist/spawn-lifecycle.js

@@ -11,9 +11,13 @@
 // manages crash-respawn / idle-kill) stay with the caller via hooks + the
 // returned result. Adopting it is behaviour-preserving: the caller keeps every
 // post-close decision it had, just without re-implementing the plumbing.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAiCliInvocation = runAiCliInvocation;
 const node_readline_1 = require("node:readline");
+const tree_kill_1 = __importDefault(require("tree-kill"));
 const cli_prompt_1 = require("./util/cli-prompt");
 const STDERR_TAIL_CAP = 64 * 1024;
 /**
@@ -61,10 +65,28 @@ function runAiCliInvocation(hooks) {
         if (hooks.timeoutMs != null) {
             timer = setTimeout(() => {
                 hooks.onTimeout?.();
-                try {
-                    child.kill('SIGTERM');
+                // treeKill the whole subtree (a bare child.kill leaves grandchildren),
+                // then escalate to SIGKILL after a grace window if the child ignores
+                // SIGTERM — otherwise a hung, signal-swallowing CLI is orphaned for the
+                // host's lifetime. (Mirrors QueueManager._kill.)
+                if (child.pid) {
+                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
+                    const pid = child.pid;
+                    const killTimer = setTimeout(() => {
+                        try {
+                            (0, tree_kill_1.default)(pid, 'SIGKILL', () => { });
+                        }
+                        catch { /* gone */ }
+                    }, 2000);
+                    killTimer.unref?.();
+                    child.once('close', () => clearTimeout(killTimer));
+                }
+                else {
+                    try {
+                        child.kill('SIGTERM');
+                    }
+                    catch { /* already gone */ }
                 }
-                catch { /* already gone */ }
                 settle({ code: null, timedOut: true, spawnFailed: false, child });
             }, hooks.timeoutMs);
         }

package/server/dist/spending.js

@@ -7,10 +7,14 @@ exports.parseSpendingFilters = parseSpendingFilters;
 const ALL_SURFACES = ['job', 'quick-spec', 'explore-spec', 'ai-edit', 'smash', 'file-summary'];
 function resolveRange(filters, now = new Date()) {
     const period = filters.period ?? '30d';
-    if (period === 'custom' && filters.from && filters.to) {
-        const fromMs = new Date(filters.from).getTime();
-        const toMs = new Date(filters.to).getTime();
-        const span = toMs - fromMs;
+    // Only take the custom branch when BOTH dates parse — otherwise
+    // `new Date(NaN).toISOString()` throws a RangeError (surfaced as a 500).
+    // Unparseable custom dates fall through to the default 30d range below.
+    const customFromMs = filters.from ? new Date(filters.from).getTime() : NaN;
+    const customToMs = filters.to ? new Date(filters.to).getTime() : NaN;
+    if (period === 'custom' && !Number.isNaN(customFromMs) && !Number.isNaN(customToMs)) {
+        const fromMs = customFromMs;
+        const span = customToMs - fromMs;
         return {
             from: filters.from,
             to: filters.to,