specrails-desktop 2.2.0 → 2.3.0

package/server/dist/project-router.js

@@ -1,342 +1,30 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stripSpecMetadataSections = stripSpecMetadataSections;
-exports.extractShortSummary = extractShortSummary;
-exports.deriveFallbackShortSummary = deriveFallbackShortSummary;
-exports.lightlyStructurePrompt = lightlyStructurePrompt;
-exports.formatDescriptionWithCriteria = formatDescriptionWithCriteria;
-exports.resolveDefaultSpecModel = resolveDefaultSpecModel;
+exports.resolveDefaultSpecModel = exports.formatDescriptionWithCriteria = exports.lightlyStructurePrompt = exports.deriveFallbackShortSummary = exports.extractShortSummary = exports.stripSpecMetadataSections = void 0;
 exports.createProjectRouter = createProjectRouter;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
 const express_1 = require("express");
-const ids_1 = require("./ids");
-const db_1 = require("./db");
-const telemetry_export_1 = require("./telemetry-export");
-const desktop_db_1 = require("./desktop-db");
-const queue_manager_1 = require("./queue-manager");
-const types_1 = require("./types");
-const command_resolver_1 = require("./command-resolver");
-const providers_1 = require("./providers");
 const hooks_1 = require("./hooks");
-const config_1 = require("./config");
-const contract_refine_runner_1 = require("./contract-refine-runner");
-const explore_contract_refine_1 = require("./explore-contract-refine");
-const smash_runner_1 = require("./smash-runner");
-const explore_smash_1 = require("./explore-smash");
-const ai_invocations_1 = require("./ai-invocations");
-const context_budget_1 = require("./context-budget");
-const context_scope_1 = require("./context-scope");
-const result_event_1 = require("./result-event");
-const core_package_1 = require("./core-package");
-const spending_1 = require("./spending");
-const crypto_1 = require("crypto");
-const spec_models_1 = require("./spec-models");
-const provider_selection_1 = require("./provider-selection");
-const changes_reader_1 = require("./changes-reader");
-const metrics_1 = require("./metrics");
-const ticket_store_1 = require("./ticket-store");
-const explore_draft_title_1 = require("./explore-draft-title");
-const cli_prompt_1 = require("./util/cli-prompt");
-const readline_1 = require("readline");
-const tree_kill_1 = __importDefault(require("tree-kill"));
-const multer_1 = __importDefault(require("multer"));
 const rails_router_1 = require("./rails-router");
 const profiles_router_1 = require("./profiles-router");
 const plugins_router_1 = require("./plugins-router");
 const code_explorer_router_1 = require("./code-explorer-router");
-const terminal_settings_1 = require("./terminal-settings");
-const terminal_marks_store_1 = require("./terminal-marks-store");
-const attachment_manager_1 = require("./attachment-manager");
-const feature_flags_1 = require("./feature-flags");
-const browser_capture_types_1 = require("./browser-capture-types");
-const terminal_manager_1 = require("./terminal-manager");
-const TERMINAL_PANEL_ENABLED = process.env.SPECRAILS_TERMINAL_PANEL !== 'false';
-// ─── YAML helpers ─────────────────────────────────────────────────────────────
-/**
- * Serialize install config to YAML matching specrails-core's tui-installer format exactly.
- */
-function serializeInstallConfigYaml(config) {
-    const c = config;
-    const overrides = c.models?.overrides ?? {};
-    const overridesEntries = Object.entries(overrides);
-    const overridesYaml = overridesEntries.length > 0
-        ? '\n' + overridesEntries.map(([k, v]) => `    ${k}: ${v}`).join('\n')
-        : ' {}';
-    const lines = [
-        '# specrails install config — generated by Specrails',
-        `# Re-run: npx ${core_package_1.CORE_PACKAGE_SPEC} init  to regenerate`,
-        `version: ${c.version ?? 1}`,
-        `provider: ${c.provider ?? 'claude'}`,
-        `tier: ${c.tier ?? 'quick'}`,
-        `agents:`,
-        `  selected: [${(c.agents?.selected ?? []).join(', ')}]`,
-        `  excluded: [${(c.agents?.excluded ?? []).join(', ')}]`,
-        `models:`,
-        `  preset: ${c.models?.preset ?? 'balanced'}`,
-        `  defaults: { model: ${c.models?.defaults?.model ?? 'sonnet'} }`,
-        `  overrides:${overridesYaml}`,
-        `agent_teams: ${c.agent_teams ?? false}`,
-        '',
-    ];
-    return lines.join('\n');
-}
-// ─── Agent model helpers ──────────────────────────────────────────────────────
-const VALID_MODEL_ALIASES = ['sonnet', 'opus', 'haiku'];
-/**
- * Read installed agents from `.claude/agents/*.md` (top-level only, no subdirs).
- * Extracts the `model:` field from YAML frontmatter.
- */
-function readAgentModels(projectPath) {
-    const agentsDir = path_1.default.join(projectPath, '.claude', 'agents');
-    if (!fs_1.default.existsSync(agentsDir))
-        return [];
-    let entries;
-    try {
-        entries = fs_1.default.readdirSync(agentsDir);
-    }
-    catch {
-        return [];
-    }
-    const agents = [];
-    for (const entry of entries) {
-        // Top-level .md files only — skip subdirs
-        if (!entry.endsWith('.md'))
-            continue;
-        const filePath = path_1.default.join(agentsDir, entry);
-        try {
-            const stat = fs_1.default.statSync(filePath);
-            if (!stat.isFile())
-                continue;
-            const content = fs_1.default.readFileSync(filePath, 'utf-8');
-            // Extract model from YAML frontmatter between --- markers
-            const frontmatterMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-            if (!frontmatterMatch)
-                continue;
-            const frontmatter = frontmatterMatch[1];
-            const modelMatch = frontmatter.match(/^model:\s*(.+)$/m);
-            const model = modelMatch ? modelMatch[1].trim() : 'sonnet';
-            agents.push({ name: entry.slice(0, -3), model });
-        }
-        catch {
-            // skip unreadable files
-        }
-    }
-    return agents;
-}
-/**
- * Read `.specrails/install-config.yaml` and patch the `model:` line in each
- * `.claude/agents/*.md` frontmatter to match the config's defaults/overrides.
- * No-op if the config file does not exist.
- */
-function applyModelConfig(projectPath) {
-    const configPath = path_1.default.join(projectPath, '.specrails', 'install-config.yaml');
-    if (!fs_1.default.existsSync(configPath))
-        return;
-    let configText;
-    try {
-        configText = fs_1.default.readFileSync(configPath, 'utf-8');
-    }
-    catch {
-        return;
-    }
-    // Parse defaults.model
-    const defaultsMatch = configText.match(/defaults:\s*\{\s*model:\s*(\S+)\s*\}/);
-    const defaultModel = defaultsMatch ? defaultsMatch[1] : 'sonnet';
-    // Parse overrides block — lines like `    agentname: alias`
-    const overrides = {};
-    const overridesBlockMatch = configText.match(/overrides:([\s\S]*?)(?:\n\S|$)/);
-    if (overridesBlockMatch) {
-        const block = overridesBlockMatch[1];
-        const overrideLines = block.match(/^ {2,}(\S+):\s*(\S+)/gm) ?? [];
-        for (const line of overrideLines) {
-            const m = line.match(/^\s+(\S+):\s*(\S+)/);
-            if (m)
-                overrides[m[1]] = m[2];
-        }
-    }
-    const agentsDir = path_1.default.join(projectPath, '.claude', 'agents');
-    if (!fs_1.default.existsSync(agentsDir))
-        return;
-    let entries;
-    try {
-        entries = fs_1.default.readdirSync(agentsDir);
-    }
-    catch {
-        return;
-    }
-    for (const entry of entries) {
-        if (!entry.endsWith('.md'))
-            continue;
-        const filePath = path_1.default.join(agentsDir, entry);
-        try {
-            const stat = fs_1.default.statSync(filePath);
-            if (!stat.isFile())
-                continue;
-            const agentName = entry.slice(0, -3);
-            const targetModel = overrides[agentName] ?? defaultModel;
-            const content = fs_1.default.readFileSync(filePath, 'utf-8');
-            const patched = content.replace(/^model: .+$/m, `model: ${targetModel}`);
-            if (patched !== content) {
-                fs_1.default.writeFileSync(filePath, patched, 'utf-8');
-            }
-        }
-        catch {
-            // skip unwritable files
-        }
-    }
-}
-/**
- * Strip the metadata sections (Spec Title, Labels, Estimated Complexity,
- * Short Summary) from a generate-spec LLM response so they don't end up
- * duplicated inside the ticket's description — they're already parsed into
- * dedicated fields and re-rendered by the UI.
- */
-function stripSpecMetadataSections(buffer) {
-    return buffer
-        .replace(/##\s*Spec Title\s*\n+[^\n]*\n*/i, '')
-        .replace(/##\s*Labels\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .replace(/##\s*Estimated Complexity\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .replace(/##\s*Short Summary\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .trim();
-}
-/**
- * Extract the `## Short Summary` section body from a generate-spec response.
- * Returns the raw multi-line string (the ticket-store `clampShortSummary`
- * helper applies trim, control-strip, and the 240-char hard cap before
- * persistence). Returns `null` when the section is missing or empty.
- */
-function extractShortSummary(buffer) {
-    const m = buffer.match(/##\s*Short Summary\s*\n+((?:(?!##)[^\n]+(?:\n(?!##)[^\n]+)*))/i);
-    if (!m)
-        return null;
-    const body = m[1].trim();
-    return body.length > 0 ? body : null;
-}
-function deriveFallbackShortSummary(title, description) {
-    const plain = description
-        .replace(/```[\s\S]*?```/g, ' ')
-        .replace(/^#{1,6}\s+.*$/gm, ' ')
-        .replace(/^\s*[-*]\s+/gm, '')
-        .replace(/\[[^\]]+\]\([^)]+\)/g, (m) => m.match(/\[([^\]]+)\]/)?.[1] ?? '')
-        .replace(/[`*_>]/g, '')
-        .replace(/\s+/g, ' ')
-        .trim();
-    const source = plain || title.trim();
-    if (!source)
-        return null;
-    const sentence = source.match(/^(.{24,}?[.!?])(?:\s|$)/)?.[1] ?? source;
-    const capped = sentence.length > 160 ? `${sentence.slice(0, 157).trimEnd()}...` : sentence;
-    return (0, ticket_store_1.clampShortSummary)(capped);
-}
-/**
- * Lightly structure a raw free-form prompt (the "Raw" Add-Spec mode) when the
- * user opts in. We deliberately do NOT fabricate spec sections — a raw prompt
- * stays the user's own words. The only transform: when the body has no leading
- * markdown heading, prefix a single neutral `## Overview` heading so the spec
- * renders with a section title downstream. Returns the (trimmed) input
- * unchanged when it already starts with a heading or is empty.
- */
-function lightlyStructurePrompt(text) {
-    const trimmed = text.trim();
-    if (!trimmed)
-        return trimmed;
-    if (/^#{1,6}\s+/.test(trimmed))
-        return trimmed;
-    return `## Overview\n\n${trimmed}`;
-}
-/**
- * Fold an `acceptanceCriteria` array into a ticket description body, writing
- * (or replacing) a `## Acceptance Criteria` section.
- *
- * - `criteria.length > 0` → append/replace the section with one `- bullet` per item
- * - `criteria.length === 0` → strip any existing `## Acceptance Criteria` section
- *
- * The match is case-insensitive on the heading text but requires `##` exactly
- * to avoid matching other heading levels.
- *
- * Shared by `POST /tickets/from-draft` and `PATCH /tickets/:id`. See
- * openspec/changes/replace-ai-edit-with-continue-editing/design.md D3+D4.
- */
-function formatDescriptionWithCriteria(body, criteria) {
-    const sectionRegex = /\n*##\s*Acceptance Criteria\s*\n[\s\S]*?(?=\n##\s|\n*$)/i;
-    const withoutExisting = body.replace(sectionRegex, '').replace(/\s+$/, '');
-    if (criteria.length === 0)
-        return withoutExisting;
-    const section = `## Acceptance Criteria\n\n${criteria.map((c) => `- ${c}`).join('\n')}`;
-    if (withoutExisting === '')
-        return section;
-    return `${withoutExisting}\n\n${section}`;
-}
-/**
- * Resolve the default model used by Add Spec for a project.
- *
- * Order:
- *   1. `models.defaults.model` from `<project>/.specrails/install-config.yaml`,
- *      if it parses AND is in the provider allow-list.
- *   2. Provider default from `PROVIDER_DEFAULT_MODEL` (`sonnet` / `gpt-5.5`).
- *
- * Logs a warning when the configured value exists but is not valid for the
- * project's provider.
- */
-function resolveDefaultSpecModel(args) {
-    const { projectPath, provider } = args;
-    const configPath = path_1.default.join(projectPath, '.specrails', 'install-config.yaml');
-    if (!fs_1.default.existsSync(configPath))
-        return (0, spec_models_1.getProviderDefault)(provider);
-    let configText;
-    try {
-        configText = fs_1.default.readFileSync(configPath, 'utf-8');
-    }
-    catch {
-        return (0, spec_models_1.getProviderDefault)(provider);
-    }
-    const defaultsMatch = configText.match(/defaults:\s*\{\s*model:\s*(\S+?)\s*\}/);
-    const configured = defaultsMatch ? defaultsMatch[1] : null;
-    if (!configured)
-        return (0, spec_models_1.getProviderDefault)(provider);
-    if (!(0, spec_models_1.isValidModelForProvider)(configured, provider)) {
-        console.warn(`[project-router] resolveDefaultSpecModel: configured model "${configured}" is not valid for provider "${provider}" — falling back to provider default`);
-        return (0, spec_models_1.getProviderDefault)(provider);
-    }
-    return configured;
-}
+const ticket_store_1 = require("./ticket-store");
+const project_router_jobs_1 = require("./project-router-jobs");
+const project_router_spending_1 = require("./project-router-spending");
+const project_router_chat_1 = require("./project-router-chat");
+const project_router_setup_1 = require("./project-router-setup");
+const project_router_tickets_1 = require("./project-router-tickets");
+const project_router_terminals_1 = require("./project-router-terminals");
+const project_router_settings_1 = require("./project-router-settings");
+// Re-export the spec helpers from their new home so existing importers
+// (`import { ... } from './project-router'`) keep working unchanged.
+var project_router_helpers_1 = require("./project-router-helpers");
+Object.defineProperty(exports, "stripSpecMetadataSections", { enumerable: true, get: function () { return project_router_helpers_1.stripSpecMetadataSections; } });
+Object.defineProperty(exports, "extractShortSummary", { enumerable: true, get: function () { return project_router_helpers_1.extractShortSummary; } });
+Object.defineProperty(exports, "deriveFallbackShortSummary", { enumerable: true, get: function () { return project_router_helpers_1.deriveFallbackShortSummary; } });
+Object.defineProperty(exports, "lightlyStructurePrompt", { enumerable: true, get: function () { return project_router_helpers_1.lightlyStructurePrompt; } });
+Object.defineProperty(exports, "formatDescriptionWithCriteria", { enumerable: true, get: function () { return project_router_helpers_1.formatDescriptionWithCriteria; } });
+Object.defineProperty(exports, "resolveDefaultSpecModel", { enumerable: true, get: function () { return project_router_helpers_1.resolveDefaultSpecModel; } });
 function createProjectRouter(registry) {
     const router = (0, express_1.Router)({ mergeParams: true });
     // Middleware: resolve project from :projectId param
@@ -399,3618 +87,14 @@ function createProjectRouter(registry) {
         }));
         codeRouter(req, res, next);
     });
-    // ─── Queue / Spawn routes ────────────────────────────────────────────────────
-    router.post('/:projectId/spawn', (req, res) => {
-        const { command, priority, dependsOnJobId, pipelineId, profileName, aiEngine } = req.body ?? {};
-        if (!command || typeof command !== 'string' || !command.trim()) {
-            res.status(400).json({ error: 'command is required' });
-            return;
-        }
-        if (priority !== undefined && !types_1.VALID_PRIORITIES.has(priority)) {
-            res.status(400).json({ error: 'priority must be one of: low, normal, high, critical' });
-            return;
-        }
-        // profileName accepts: undefined (default resolution), null (force legacy), string (explicit)
-        const normalizedProfileName = profileName === null ? null
-            : typeof profileName === 'string' && profileName.trim() ? profileName.trim()
-                : undefined;
-        // aiEngine: optional per-job provider override; must be installed on the
-        // project. Omitting it runs on the project's primary provider.
-        const engineCheck = (0, provider_selection_1.validateRequestedProvider)(ctx(req).project, aiEngine);
-        if (!engineCheck.ok) {
-            res.status(400).json({ error: engineCheck.error });
-            return;
-        }
-        try {
-            const job = ctx(req).queueManager.enqueue(command, priority ?? 'normal', {
-                dependsOnJobId: dependsOnJobId || undefined,
-                pipelineId: pipelineId || undefined,
-                profileName: normalizedProfileName,
-                provider: aiEngine ? engineCheck.provider : undefined,
-            });
-            const position = job.queuePosition ?? 0;
-            res.status(202).json({ jobId: job.id, position });
-        }
-        catch (err) {
-            if (err instanceof queue_manager_1.ClaudeNotFoundError) {
-                res.status(400).json({ error: err.message });
-            }
-            else {
-                console.error('[project-router] spawn error:', err);
-                res.status(500).json({ error: 'Internal server error' });
-            }
-        }
-    });
-    // ─── Pipeline routes ──────────────────────────────────────────────────────────
-    // NOTE: Ad-hoc pipeline creation removed — use rails (templates) instead.
-    // The GET route remains for viewing existing pipeline status.
-    router.get('/:projectId/pipelines/:pipelineId', (req, res) => {
-        const { db } = ctx(req);
-        const pipelineId = req.params.pipelineId;
-        const jobs = (0, db_1.getPipelineJobs)(db, pipelineId);
-        if (jobs.length === 0) {
-            res.status(404).json({ error: 'Pipeline not found' });
-            return;
-        }
-        const allCompleted = jobs.every(j => j.status === 'completed');
-        const anyFailed = jobs.some(j => ['failed', 'skipped', 'canceled', 'zombie_terminated'].includes(j.status));
-        const status = allCompleted ? 'completed' : anyFailed ? 'failed' : 'running';
-        res.json({ pipelineId, status, jobs });
-    });
-    router.get('/:projectId/state', (req, res) => {
-        const { queueManager, project } = ctx(req);
-        res.json({
-            projectName: project.name,
-            projectId: project.id,
-            phases: (0, hooks_1.getPhaseStates)(),
-            busy: queueManager.getActiveJobId() !== null,
-            currentJobId: queueManager.getActiveJobId(),
-            featureFlags: {
-                smash: !(0, explore_smash_1.isSpecsSmashKillSwitchActive)(),
-            },
-        });
-    });
-    // Returns the resolved default model for Add Spec + the full provider
-    // allow-list so the modal can render its picker without maintaining its
-    // own copy of the model lists. Source of truth is `server/spec-models.ts`.
-    router.get('/:projectId/default-spec-model', (req, res) => {
-        const { project } = ctx(req);
-        // Multi-provider: an optional ?provider= query selects which engine's models
-        // to return. It must be one the project actually has installed; an invalid
-        // or omitted value falls back to the project's primary provider. The
-        // response also lists every installed provider so the Add Spec modal can
-        // render its AI Engine selector without a second round-trip.
-        const provider = (0, provider_selection_1.resolveProvider)(project, typeof req.query.provider === 'string' ? req.query.provider : undefined);
-        const model = resolveDefaultSpecModel({ projectPath: project.path, provider });
-        const allowed = (0, spec_models_1.getModelsForProvider)(provider);
-        res.json({ model, provider, allowed, providers: project.providers });
-    });
-    router.delete('/:projectId/jobs/:id', (req, res) => {
-        try {
-            const result = ctx(req).queueManager.cancel(req.params.id);
-            res.json({ ok: true, status: result });
-        }
-        catch (err) {
-            if (err instanceof queue_manager_1.JobNotFoundError) {
-                res.status(404).json({ error: 'Job not found' });
-            }
-            else if (err instanceof queue_manager_1.JobAlreadyTerminalError) {
-                // Job already finished — delete it from the DB
-                (0, db_1.deleteJob)(ctx(req).db, req.params.id);
-                res.json({ ok: true, status: 'deleted' });
-            }
-            else {
-                res.status(500).json({ error: 'Internal server error' });
-            }
-        }
-    });
-    router.patch('/:projectId/jobs/:id/priority', (req, res) => {
-        const { priority } = req.body ?? {};
-        if (!priority || !types_1.VALID_PRIORITIES.has(priority)) {
-            res.status(400).json({ error: 'priority must be one of: low, normal, high, critical' });
-            return;
-        }
-        try {
-            ctx(req).queueManager.updatePriority(req.params.id, priority);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            if (err instanceof queue_manager_1.JobNotFoundError) {
-                res.status(404).json({ error: 'Job not found' });
-            }
-            else {
-                res.status(400).json({ error: err.message });
-            }
-        }
-    });
-    router.post('/:projectId/queue/pause', (req, res) => {
-        ctx(req).queueManager.pause();
-        res.json({ ok: true, paused: true });
-    });
-    router.post('/:projectId/queue/resume', (req, res) => {
-        ctx(req).queueManager.resume();
-        res.json({ ok: true, paused: false });
-    });
-    router.put('/:projectId/queue/reorder', (req, res) => {
-        const { jobIds } = req.body ?? {};
-        if (!Array.isArray(jobIds)) {
-            res.status(400).json({ error: 'jobIds must be an array' });
-            return;
-        }
-        try {
-            ctx(req).queueManager.reorder(jobIds);
-            res.json({ ok: true, queue: jobIds });
-        }
-        catch (err) {
-            res.status(400).json({ error: err.message });
-        }
-    });
-    router.get('/:projectId/queue', (req, res) => {
-        const { queueManager } = ctx(req);
-        res.json({
-            jobs: queueManager.getJobs(),
-            paused: queueManager.isPaused(),
-            activeJobId: queueManager.getActiveJobId(),
-        });
-    });
-    router.get('/:projectId/jobs', (req, res) => {
-        // Clamp to [1, 200] (H-11): a negative limit is LIMIT -1 in SQLite, which
-        // means UNLIMITED — without the lower bound `?limit=-1` dumps the whole table.
-        const limit = Math.max(1, Math.min(parseInt(String(req.query.limit ?? '50'), 10) || 50, 200));
-        const offset = parseInt(String(req.query.offset ?? '0'), 10) || 0;
-        const status = req.query.status;
-        const from = req.query.from;
-        const to = req.query.to;
-        const { db } = ctx(req);
-        const result = (0, db_1.listJobs)(db, { limit, offset, status, from, to });
-        // Merge in-memory queued jobs that haven't been persisted to DB yet
-        const { queueManager } = ctx(req);
-        const dbIds = new Set(result.jobs.map((j) => j.id));
-        const queuedRows = queueManager
-            .getJobs()
-            .filter((j) => j.status === 'queued' && !dbIds.has(j.id))
-            .filter((j) => !status || j.status === status)
-            .map((j) => ({
-            id: j.id,
-            command: j.command,
-            started_at: j.startedAt ?? new Date().toISOString(),
-            finished_at: j.finishedAt,
-            status: j.status,
-            exit_code: j.exitCode,
-            queue_position: j.queuePosition,
-            priority: j.priority,
-            tokens_in: null,
-            tokens_out: null,
-            tokens_cache_read: null,
-            tokens_cache_create: null,
-            total_cost_usd: null,
-            num_turns: null,
-            model: null,
-            duration_ms: null,
-            duration_api_ms: null,
-            session_id: null,
-            depends_on_job_id: j.dependsOnJobId,
-            pipeline_id: j.pipelineId,
-            skip_reason: j.skipReason,
-        }));
-        if (queuedRows.length > 0) {
-            result.jobs = [...queuedRows, ...result.jobs];
-            result.total += queuedRows.length;
-        }
-        // Annotate each job with hasTelemetry so the client can show the
-        // Export diagnostic button without an extra round trip.
-        const jobsWithTelemetry = (0, db_1.getJobsWithTelemetry)(db);
-        const annotatedJobs = result.jobs.map((j) => ({
-            ...j,
-            hasTelemetry: jobsWithTelemetry.has(j.id),
-        }));
-        res.json({ jobs: annotatedJobs, total: result.total });
-    });
-    // ─── CSV helper ──────────────────────────────────────────────────────────────
-    const toCsv = (headers, rows) => {
-        const escape = (v) => {
-            const s = v == null ? '' : String(v);
-            return s.includes(',') || s.includes('"') || s.includes('\n') ? `"${s.replace(/"/g, '""')}"` : s;
-        };
-        const lines = [headers.join(',')];
-        for (const row of rows) {
-            lines.push(headers.map(h => escape(row[h])).join(','));
-        }
-        return lines.join('\n');
-    };
-    // ─── Jobs export (must be before /:projectId/jobs/:id) ─────────────────────
-    router.get('/:projectId/jobs/export', (req, res) => {
-        const format = req.query.format || 'json';
-        if (format !== 'json' && format !== 'csv') {
-            res.status(400).json({ error: 'Invalid format. Must be json or csv' });
-            return;
-        }
-        const from = req.query.from;
-        const to = req.query.to;
-        const { db } = ctx(req);
-        const conditions = [];
-        const params = [];
-        if (from) {
-            conditions.push('started_at >= ?');
-            params.push(from);
-        }
-        if (to) {
-            conditions.push('started_at <= ?');
-            params.push(to);
-        }
-        const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
-        const jobs = db
-            .prepare(`SELECT * FROM jobs ${where} ORDER BY started_at DESC LIMIT 10000`)
-            .all(...params);
-        if (format === 'csv') {
-            const headers = ['id', 'command', 'status', 'started_at', 'finished_at', 'duration_ms', 'tokens_in', 'tokens_out', 'tokens_cache_read', 'total_cost_usd', 'model'];
-            const csv = toCsv(headers, jobs);
-            res.setHeader('Content-Type', 'text/csv');
-            res.setHeader('Content-Disposition', 'attachment; filename="jobs-export.csv"');
-            res.send(csv);
-        }
-        else {
-            res.json({ jobs });
-        }
-    });
-    // Must be registered BEFORE /:projectId/jobs/:id, otherwise Express matches
-    // the parameterized route first with id='compare' and this never runs (the
-    // Job Comparison feature would always 404).
-    router.get('/:projectId/jobs/compare', (req, res) => {
-        const raw = req.query.jobIds;
-        if (!raw) {
-            res.status(400).json({ error: 'jobIds query param required (comma-separated, exactly 2)' });
-            return;
-        }
-        const ids = raw.split(',').map((s) => s.trim()).filter(Boolean);
-        if (ids.length !== 2) {
-            res.status(400).json({ error: 'Exactly 2 jobIds are required' });
-            return;
-        }
-        const { db } = ctx(req);
-        const rows = ids.map((id) => {
-            const job = db.prepare('SELECT * FROM jobs WHERE id = ?').get(id);
-            if (!job)
-                return null;
-            const phases = db.prepare("SELECT phase FROM job_phases WHERE job_id = ? AND state = 'done' ORDER BY updated_at ASC").all(id);
-            return {
-                id: job.id,
-                command: job.command,
-                status: job.status,
-                startedAt: job.started_at,
-                finishedAt: job.finished_at,
-                durationMs: job.duration_ms,
-                tokensIn: job.tokens_in,
-                tokensOut: job.tokens_out,
-                tokensCacheRead: job.tokens_cache_read,
-                totalCostUsd: job.total_cost_usd,
-                model: job.model,
-                phasesCompleted: phases.map((p) => p.phase),
-            };
-        });
-        const missing = ids.filter((_, i) => rows[i] === null);
-        if (missing.length > 0) {
-            res.status(404).json({ error: `Jobs not found: ${missing.join(', ')}` });
-            return;
-        }
-        res.json({ jobs: rows });
-    });
-    router.get('/:projectId/jobs/:id', (req, res) => {
-        const { db, queueManager, project } = ctx(req);
-        const jobId = req.params.id;
-        const job = (0, db_1.getJob)(db, jobId);
-        if (!job) {
-            // Queued jobs live only in memory until spawn time (createJob runs on spawn,
-            // not enqueue). Fall back to the in-memory queue so /jobs/:id returns a
-            // usable payload instead of 404 — the detail page then renders a "queued"
-            // state and flips to live logs via WS once the job starts.
-            const inMemory = queueManager.getJobs().find((j) => j.id === jobId);
-            if (!inMemory) {
-                res.status(404).json({ error: 'Job not found' });
-                return;
-            }
-            const synthetic = {
-                id: inMemory.id,
-                command: inMemory.command,
-                started_at: inMemory.startedAt ?? '',
-                finished_at: inMemory.finishedAt,
-                status: inMemory.status,
-                exit_code: inMemory.exitCode,
-                queue_position: inMemory.queuePosition,
-                priority: inMemory.priority,
-                tokens_in: null,
-                tokens_out: null,
-                tokens_cache_read: null,
-                tokens_cache_create: null,
-                total_cost_usd: null,
-                num_turns: null,
-                model: null,
-                duration_ms: null,
-                duration_api_ms: null,
-                session_id: null,
-                depends_on_job_id: inMemory.dependsOnJobId,
-                pipeline_id: inMemory.pipelineId,
-                skip_reason: inMemory.skipReason,
-            };
-            const phaseDefinitions = queueManager.phasesForCommand(synthetic.command);
-            const tickets = (0, ticket_store_1.resolveTicketsFromCommand)(project.path, synthetic.command);
-            res.json({ job: { ...synthetic, hasTelemetry: false, tickets }, events: [], phaseDefinitions });
-            return;
-        }
-        const events = (0, db_1.getJobEvents)(db, jobId);
-        const phaseDefinitions = queueManager.phasesForCommand(job.command);
-        const tickets = (0, ticket_store_1.resolveTicketsFromCommand)(project.path, job.command);
-        const annotated = { ...job, hasTelemetry: (0, db_1.hasJobTelemetry)(db, jobId), tickets };
-        res.json({ job: annotated, events, phaseDefinitions });
-    });
-    router.delete('/:projectId/jobs', (req, res) => {
-        try {
-            const { from, to } = req.body ?? {};
-            const deleted = (0, db_1.purgeJobs)(ctx(req).db, { from, to });
-            res.json({ ok: true, deleted });
-        }
-        catch (err) {
-            console.error('[project-router] purge error:', err);
-            res.status(500).json({ error: 'Failed to purge jobs' });
-        }
-    });
-    router.get('/:projectId/activity', (req, res) => {
-        const limit = Math.min(Math.max(1, parseInt(String(req.query.limit ?? '50'), 10) || 50), 100);
-        const before = req.query.before;
-        res.json((0, db_1.getProjectActivity)(ctx(req).db, { limit, before }));
-    });
-    router.get('/:projectId/stats', (req, res) => {
-        res.json((0, db_1.getStats)(ctx(req).db));
-    });
-    router.get('/:projectId/metrics', (req, res) => {
-        const { project, db } = ctx(req);
-        try {
-            res.json((0, metrics_1.getProjectMetrics)(project.path, db));
-        }
-        catch (err) {
-            console.error('[project-router] metrics error:', err);
-            res.status(500).json({ error: 'Failed to compute metrics' });
-        }
-    });
-    // ─── Spending dashboard ──────────────────────────────────────────────────────
-    router.get('/:projectId/spending', (req, res) => {
-        const filters = (0, spending_1.parseSpendingFilters)(req.query);
-        if (filters.period === 'custom' && (!filters.from || !filters.to)) {
-            res.status(400).json({ error: 'from and to are required for custom period' });
-            return;
-        }
-        try {
-            res.json((0, spending_1.getSpending)(ctx(req).db, ctx(req).project.id, filters));
-        }
-        catch (err) {
-            console.error('[project-router] spending error:', err);
-            res.status(500).json({ error: 'Failed to compute spending' });
-        }
-    });
-    // ─── Raw invocations table ───────────────────────────────────────────────────
-    router.get('/:projectId/invocations', (req, res) => {
-        const filters = (0, spending_1.parseSpendingFilters)(req.query);
-        // Clamp to [1, 10000] when provided (H-11): a negative/NaN limit becomes
-        // SQLite LIMIT -1 (unlimited) and dumps the entire invocations table.
-        const rawLimit = req.query.limit ? parseInt(req.query.limit, 10) : undefined;
-        const limit = rawLimit !== undefined && Number.isFinite(rawLimit)
-            ? Math.max(1, Math.min(rawLimit, 10_000))
-            : undefined;
-        const offset = req.query.offset ? parseInt(req.query.offset, 10) : undefined;
-        try {
-            const result = (0, spending_1.getInvocations)(ctx(req).db, ctx(req).project.id, {
-                ...filters,
-                ...(limit ? { limit } : {}),
-                ...(offset ? { offset } : {}),
-            });
-            // Enrich with ticket titles from YAML store.
-            try {
-                const store = (0, ticket_store_1.readStore)(ticketPath(req));
-                for (const r of result.rows) {
-                    if (r.ticket_id != null) {
-                        const t = store.tickets[String(r.ticket_id)];
-                        r.ticket_title = t?.title ?? null;
-                    }
-                }
-            }
-            catch { /* tickets store may not exist yet */ }
-            res.json(result);
-        }
-        catch (err) {
-            console.error('[project-router] invocations error:', err);
-            res.status(500).json({ error: 'Failed to list invocations' });
-        }
-    });
-    // ─── Per-ticket spending summary (used by TicketDetailModal) ─────────────────
-    router.get('/:projectId/tickets/:id/spending-summary', (req, res) => {
-        const ticketId = parseInt(req.params.id, 10);
-        if (Number.isNaN(ticketId)) {
-            res.status(400).json({ error: 'Invalid ticket id' });
-            return;
-        }
-        try {
-            res.json((0, ai_invocations_1.getTicketSpendingSummary)(ctx(req).db, ticketId));
-        }
-        catch (err) {
-            console.error('[project-router] ticket spending summary error:', err);
-            res.status(500).json({ error: 'Failed to compute ticket spending' });
-        }
-    });
-    // ─── Spending / analytics export (Summary + Raw, CSV or JSON) ────────────────
-    router.get('/:projectId/analytics/export', async (req, res) => {
-        const format = req.query.format || 'json';
-        const mode = req.query.mode || 'summary';
-        if (format !== 'json' && format !== 'csv') {
-            res.status(400).json({ error: 'Invalid format. Must be json or csv' });
-            return;
-        }
-        if (mode !== 'summary' && mode !== 'raw') {
-            res.status(400).json({ error: 'Invalid mode. Must be summary or raw' });
-            return;
-        }
-        const periodRaw = req.query.period ?? '30d';
-        const validPeriods = ['7d', '30d', '90d', 'all', 'custom'];
-        if (!validPeriods.includes(periodRaw)) {
-            res.status(400).json({ error: 'Invalid period. Must be one of: 7d, 30d, 90d, all, custom' });
-            return;
-        }
-        const filters = (0, spending_1.parseSpendingFilters)(req.query);
-        if (filters.period === 'custom' && (!filters.from || !filters.to)) {
-            res.status(400).json({ error: 'from and to are required for custom period' });
-            return;
-        }
-        const { project } = ctx(req);
-        const projectId = project.id;
-        const dateStamp = new Date().toISOString().slice(0, 10);
-        const periodTag = filters.period ?? '30d';
-        const surfaceTag = (filters.surface && filters.surface.length === 1)
-            ? `-${filters.surface[0].replace('-spec', '').replace('-', '')}`
-            : '';
-        try {
-            if (mode === 'summary') {
-                const data = (0, spending_1.getSpending)(ctx(req).db, projectId, filters);
-                if (format === 'json') {
-                    res.setHeader('Content-Disposition', `attachment; filename="${project.slug}-analytics-${periodTag}-${dateStamp}.json"`);
-                    res.json(data);
-                    return;
-                }
-                // CSV summary: multi-section composite
-                const lines = [];
-                lines.push('# Totals');
-                lines.push('totalCostUsd,totalRuns,prevTotalCostUsd,deltaPct,avgCostPerRun,failureRate');
-                lines.push([
-                    data.summary.totalCostUsd,
-                    data.summary.totalRuns,
-                    data.summary.prevTotalCostUsd,
-                    data.summary.deltaPct ?? '',
-                    data.summary.avgCostPerRun ?? '',
-                    data.summary.failureRate,
-                ].join(','));
-                lines.push('');
-                lines.push('# Daily timeline');
-                lines.push('date,jobsCostUsd,quickCostUsd,exploreCostUsd,aiEditCostUsd,totalCostUsd');
-                for (const d of data.dailyTimeline) {
-                    lines.push(`${d.date},${d.jobsCostUsd},${d.quickCostUsd},${d.exploreCostUsd},${d.aiEditCostUsd},${d.totalCostUsd}`);
-                }
-                lines.push('');
-                lines.push('# By surface');
-                lines.push('surface,count,costUsd');
-                for (const s of data.bySurface)
-                    lines.push(`${s.surface},${s.count},${s.costUsd}`);
-                lines.push('');
-                lines.push('# By model');
-                lines.push('model,count,costUsd');
-                for (const m of data.byModel)
-                    lines.push(`${csvEscape(m.model)},${m.count},${m.costUsd}`);
-                lines.push('');
-                lines.push('# Top tickets');
-                lines.push('ticketId,totalCostUsd,totalRuns,jobCost,quickCost,exploreCost,aiEditCost');
-                for (const t of data.topTickets) {
-                    lines.push([
-                        t.ticketId ?? '(unattributed)',
-                        t.totalCostUsd,
-                        t.totalRuns,
-                        t.bySurface.job.costUsd,
-                        t.bySurface['quick-spec'].costUsd,
-                        t.bySurface['explore-spec'].costUsd,
-                        t.bySurface['ai-edit'].costUsd,
-                    ].join(','));
-                }
-                res.setHeader('Content-Type', 'text/csv');
-                res.setHeader('Content-Disposition', `attachment; filename="${project.slug}-analytics-${periodTag}-${dateStamp}.csv"`);
-                res.send(lines.join('\n'));
-            }
-            else {
-                // raw mode: capped invocations
-                const result = (0, spending_1.getInvocations)(ctx(req).db, projectId, { ...filters, cap: 10000 });
-                // Enrich titles
-                try {
-                    const store = (0, ticket_store_1.readStore)(ticketPath(req));
-                    for (const r of result.rows) {
-                        if (r.ticket_id != null)
-                            r.ticket_title = store.tickets[String(r.ticket_id)]?.title ?? null;
-                    }
-                }
-                catch { /* no tickets yet */ }
-                if (format === 'json') {
-                    res.setHeader('Content-Disposition', `attachment; filename="${project.slug}-invocations-${periodTag}${surfaceTag}-${dateStamp}.json"`);
-                    res.json(result);
-                    return;
-                }
-                const headers = [
-                    'id', 'surface', 'surface_ref_id', 'ticket_id', 'ticket_title', 'conversation_id',
-                    'model', 'status', 'started_at', 'finished_at', 'duration_ms', 'duration_api_ms',
-                    'tokens_in', 'tokens_out', 'tokens_cache_read', 'tokens_cache_create',
-                    'total_cost_usd', 'num_turns', 'session_id'
-                ];
-                const lines = [headers.join(',')];
-                for (const r of result.rows) {
-                    lines.push(headers.map((h) => csvEscape(r[h])).join(','));
-                }
-                if (result.truncated) {
-                    lines.push(`# truncated_at=${result.rows.length} of ${result.totalAvailable}`);
-                }
-                res.setHeader('Content-Type', 'text/csv');
-                res.setHeader('Content-Disposition', `attachment; filename="${project.slug}-invocations-${periodTag}${surfaceTag}-${dateStamp}.csv"`);
-                res.send(lines.join('\n'));
-            }
-        }
-        catch (err) {
-            console.error('[project-router] export error:', err);
-            res.status(500).json({ error: 'Failed to export' });
-        }
-    });
-    function csvEscape(v) {
-        const s = v == null ? '' : String(v);
-        return s.includes(',') || s.includes('"') || s.includes('\n')
-            ? `"${s.replace(/"/g, '""')}"`
-            : s;
-    }
-    router.get('/:projectId/config', (req, res) => {
-        const { project, db } = ctx(req);
-        try {
-            const config = (0, config_1.getConfig)(project.path, db, project.name);
-            const dailyBudgetRaw = db.prepare(`SELECT value FROM queue_state WHERE key = 'config.daily_budget_usd'`).get()?.value;
-            const dailyBudgetUsd = dailyBudgetRaw != null ? parseFloat(dailyBudgetRaw) : null;
-            const zombieTimeoutRaw = db.prepare(`SELECT value FROM queue_state WHERE key = 'config.zombie_timeout_ms'`).get()?.value;
-            const zombieTimeoutMs = zombieTimeoutRaw != null ? parseInt(zombieTimeoutRaw, 10) : null;
-            res.json({ ...config, dailyBudgetUsd, zombieTimeoutMs });
-        }
-        catch (err) {
-            console.error('[project-router] config error:', err);
-            res.status(500).json({ error: 'Failed to read config' });
-        }
-    });
-    router.post('/:projectId/config', (req, res) => {
-        const { active, labelFilter, dailyBudgetUsd, zombieTimeoutMs } = req.body ?? {};
-        const { db, queueManager } = ctx(req);
-        try {
-            if (active !== undefined) {
-                db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.active_tracker', ?)`).run(active ?? '');
-            }
-            if (labelFilter !== undefined) {
-                db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.label_filter', ?)`).run(labelFilter ?? '');
-            }
-            if (dailyBudgetUsd !== undefined) {
-                if (dailyBudgetUsd === null) {
-                    db.prepare(`DELETE FROM queue_state WHERE key = 'config.daily_budget_usd'`).run();
-                }
-                else if (typeof dailyBudgetUsd === 'number' && dailyBudgetUsd > 0) {
-                    db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.daily_budget_usd', ?)`).run(String(dailyBudgetUsd));
-                }
-            }
-            if (zombieTimeoutMs !== undefined) {
-                if (zombieTimeoutMs === null) {
-                    db.prepare(`DELETE FROM queue_state WHERE key = 'config.zombie_timeout_ms'`).run();
-                }
-                else if (typeof zombieTimeoutMs === 'number' && zombieTimeoutMs > 0) {
-                    db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.zombie_timeout_ms', ?)`).run(String(zombieTimeoutMs));
-                }
-                queueManager.setZombieTimeout(typeof zombieTimeoutMs === 'number' && zombieTimeoutMs > 0 ? zombieTimeoutMs : queue_manager_1.DEFAULT_ZOMBIE_TIMEOUT_MS);
-            }
-            res.json({ ok: true });
-        }
-        catch (err) {
-            console.error('[project-router] config persist error:', err);
-            res.status(500).json({ error: 'Failed to persist config' });
-        }
-    });
-    // ─── Budget routes ────────────────────────────────────────────────────────────
-    router.get('/:projectId/budget', (req, res) => {
-        const { db } = ctx(req);
-        try {
-            const dailyBudgetRaw = db.prepare(`SELECT value FROM queue_state WHERE key = 'config.daily_budget_usd'`).get()?.value;
-            const dailyBudgetUsd = dailyBudgetRaw != null ? parseFloat(dailyBudgetRaw) : null;
-            const jobThresholdRaw = db.prepare(`SELECT value FROM queue_state WHERE key = 'config.job_cost_threshold_usd'`).get()?.value;
-            const jobCostThresholdUsd = jobThresholdRaw != null ? parseFloat(jobThresholdRaw) : null;
-            const costRow = db.prepare(`SELECT COALESCE(SUM(total_cost_usd), 0) as costToday FROM jobs WHERE started_at >= date('now')`).get();
-            const costToday = costRow.costToday;
-            const budgetUtilizationPct = dailyBudgetUsd != null && dailyBudgetUsd > 0
-                ? (costToday / dailyBudgetUsd) * 100
-                : null;
-            res.json({ dailyBudgetUsd, jobCostThresholdUsd, costToday, budgetUtilizationPct });
-        }
-        catch (err) {
-            console.error('[project-router] budget get error:', err);
-            res.status(500).json({ error: 'Failed to read budget' });
-        }
-    });
-    router.patch('/:projectId/budget', (req, res) => {
-        const { dailyBudgetUsd, jobCostThresholdUsd } = req.body ?? {};
-        const { db } = ctx(req);
-        try {
-            if (dailyBudgetUsd !== undefined) {
-                if (dailyBudgetUsd === null) {
-                    db.prepare(`DELETE FROM queue_state WHERE key = 'config.daily_budget_usd'`).run();
-                }
-                else if (typeof dailyBudgetUsd === 'number' && dailyBudgetUsd > 0) {
-                    db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.daily_budget_usd', ?)`).run(String(dailyBudgetUsd));
-                }
-            }
-            if (jobCostThresholdUsd !== undefined) {
-                if (jobCostThresholdUsd === null) {
-                    db.prepare(`DELETE FROM queue_state WHERE key = 'config.job_cost_threshold_usd'`).run();
-                }
-                else if (typeof jobCostThresholdUsd === 'number' && jobCostThresholdUsd > 0) {
-                    db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.job_cost_threshold_usd', ?)`).run(String(jobCostThresholdUsd));
-                }
-            }
-            res.json({ ok: true });
-        }
-        catch (err) {
-            console.error('[project-router] budget patch error:', err);
-            res.status(500).json({ error: 'Failed to update budget' });
-        }
-    });
-    router.get('/:projectId/issues', (req, res) => {
-        const { project, db } = ctx(req);
-        try {
-            const config = (0, config_1.getConfig)(project.path, db, project.name);
-            const tracker = config.issueTracker.active;
-            if (!tracker) {
-                res.status(503).json({ error: 'No issue tracker configured', trackers: config.issueTracker });
-                return;
-            }
-            const search = req.query.search;
-            const label = req.query.label;
-            const issues = (0, config_1.fetchIssues)(tracker, { search, label, repo: config.project.repo, cwd: project.path });
-            res.json(issues);
-        }
-        catch (err) {
-            console.error('[project-router] issues error:', err);
-            res.status(500).json({ error: 'Failed to fetch issues' });
-        }
-    });
-    // ─── Chat routes ─────────────────────────────────────────────────────────────
-    router.get('/:projectId/chat/conversations', (req, res) => {
-        const conversations = (0, db_1.listConversations)(ctx(req).db);
-        res.json({ conversations });
-    });
-    router.post('/:projectId/chat/conversations', (req, res) => {
-        const { db, project } = ctx(req);
-        // Multi-provider: an optional aiEngine (alias: provider) picks which engine
-        // this conversation runs on. It must be installed on the project; omitting
-        // it uses the project's primary provider. The chosen provider drives model
-        // validation and is persisted on the conversation so resume turns and
-        // ai_invocations attribute to the right engine.
-        const requestedEngine = req.body?.aiEngine ?? req.body?.provider;
-        const engineCheck = (0, provider_selection_1.validateRequestedProvider)(project, requestedEngine);
-        if (!engineCheck.ok) {
-            res.status(400).json({ error: engineCheck.error });
-            return;
-        }
-        const provider = engineCheck.provider;
-        const rawModel = req.body?.model;
-        let model;
-        if (rawModel === undefined || rawModel === null || rawModel === '') {
-            model = resolveDefaultSpecModel({ projectPath: project.path, provider });
-        }
-        else if ((0, spec_models_1.isValidModelForProvider)(rawModel, provider)) {
-            model = rawModel;
-        }
-        else {
-            res.status(400).json({
-                error: `Invalid model "${String(rawModel)}" for provider "${provider}"`,
-                allowed: (0, spec_models_1.getModelsForProvider)(provider).map((m) => m.value),
-            });
-            return;
-        }
-        const rawKind = req.body?.kind;
-        const kind = rawKind === 'explore' ? 'explore' : 'sidebar';
-        const id = (0, ids_1.newId)();
-        const rawScope = req.body?.contextScope;
-        if (rawScope !== undefined && kind !== 'explore') {
-            res.status(400).json({ error: 'contextScope is only allowed for kind=explore' });
-            return;
-        }
-        let scope;
-        if (kind === 'explore') {
-            const fallback = (0, context_scope_1.getLastContextScope)(db, 'explore');
-            // Defence-in-depth: SMASH / Contract Layer is Claude-only. Strip
-            // contractRefine from the scope when the conversation's resolved provider
-            // is non-Claude so no downstream code (Contract Refine Runner, SMASH
-            // eligibility) ever sees a mismatched flag.
-            const safeRawScope = provider !== 'claude' && rawScope != null
-                ? { ...rawScope, contractRefine: false }
-                : rawScope;
-            scope = (0, context_scope_1.normalizeContextScope)(safeRawScope ?? fallback, fallback);
-            (0, context_scope_1.setLastContextScope)(db, scope);
-            console.log(`[project-router] new explore conv ${id} provider=${provider} scope=${JSON.stringify(scope)} rawScope=${JSON.stringify(rawScope)}`);
-        }
-        // Only persist provider when the project is multi-provider; single-provider
-        // projects leave it NULL so behaviour is byte-identical to before.
-        const persistProvider = (0, provider_selection_1.isMultiProvider)(project) ? provider : null;
-        (0, db_1.createConversation)(db, { id, model, kind, contextScope: scope, provider: persistProvider });
-        const conversation = (0, db_1.getConversation)(db, id);
-        res.status(201).json({ conversation });
-    });
-    router.get('/:projectId/chat/conversations/:id', (req, res) => {
-        const { db } = ctx(req);
-        const conversation = (0, db_1.getConversation)(db, req.params.id);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        const messages = (0, db_1.getMessages)(db, req.params.id);
-        res.json({ conversation, messages });
-    });
-    router.delete('/:projectId/chat/conversations/:id', (req, res) => {
-        const { db, chatManager, broadcast, project, ticketWatcher } = ctx(req);
-        const convId = req.params.id;
-        const conversation = (0, db_1.getConversation)(db, convId);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        (0, db_1.deleteConversation)(db, convId);
-        chatManager?.forgetSpecDraft(convId);
-        chatManager?.forgetExploreLifecycle(convId);
-        // Cascade-clear origin_conversation_id on any ticket that referenced this
-        // conversation (application-level "ON DELETE SET NULL").
-        try {
-            const filePath = ticketPath(req);
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                for (const id of Object.keys(s.tickets)) {
-                    if (s.tickets[id].origin_conversation_id === convId) {
-                        s.tickets[id].origin_conversation_id = null;
-                        s.tickets[id].updated_at = new Date().toISOString();
-                    }
-                }
-            });
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            // No per-ticket broadcast: the cleared field is metadata-only and the
-            // board card visual treatment doesn't depend on it.
-        }
-        catch (err) {
-            console.error('[project-router] conversation-cascade ticket update error:', err);
-        }
-        res.json({ ok: true });
-    });
-    router.patch('/:projectId/chat/conversations/:id', (req, res) => {
-        const { db } = ctx(req);
-        const conversation = (0, db_1.getConversation)(db, req.params.id);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        const { title, model } = req.body ?? {};
-        const patch = {};
-        if (title !== undefined)
-            patch.title = title;
-        if (model !== undefined)
-            patch.model = model;
-        (0, db_1.updateConversation)(db, req.params.id, patch);
-        const updated = (0, db_1.getConversation)(db, req.params.id);
-        res.json({ ok: true, conversation: updated });
-    });
-    router.get('/:projectId/chat/conversations/:id/messages', (req, res) => {
-        const { db } = ctx(req);
-        const conversation = (0, db_1.getConversation)(db, req.params.id);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        const messages = (0, db_1.getMessages)(db, req.params.id);
-        res.json({ messages });
-    });
-    // Returns the in-memory spec-draft state Claude has accumulated for this
-    // conversation. Used by useSpecDraftStream on mount to rehydrate updates
-    // that were broadcast while the client wasn't subscribed (refresh /
-    // minimize-and-restore). Returns 200 with `null` draft when no state yet.
-    router.get('/:projectId/chat/conversations/:id/spec-draft', (req, res) => {
-        const { db, chatManager } = ctx(req);
-        const conversation = (0, db_1.getConversation)(db, req.params.id);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        const state = chatManager.getSpecDraftState(req.params.id);
-        if (!state) {
-            res.json({ draft: null, ready: false, chips: [] });
-            return;
-        }
-        res.json({
-            draft: state.draft,
-            ready: state.ready,
-            chips: state.chips,
-        });
-    });
-    router.post('/:projectId/chat/conversations/:id/messages', async (req, res) => {
-        const { db, chatManager, project } = ctx(req);
-        const conversation = (0, db_1.getConversation)(db, req.params.id);
-        if (!conversation) {
-            res.status(404).json({ error: 'Conversation not found' });
-            return;
-        }
-        const text = req.body?.text;
-        if (!text || !text.trim()) {
-            res.status(400).json({ error: 'text is required' });
-            return;
-        }
-        if (chatManager.isActive(req.params.id)) {
-            res.status(409).json({ error: 'CONVERSATION_BUSY' });
-            return;
-        }
-        const lightweight = req.body?.lightweight === true;
-        const maxTurns = typeof req.body?.maxTurns === 'number' ? req.body.maxTurns : undefined;
-        let attachments;
-        const rawAtt = req.body?.attachments;
-        if (rawAtt && typeof rawAtt === 'object' && typeof rawAtt.ticketKey === 'string'
-            && Array.isArray(rawAtt.ids)) {
-            const ids = rawAtt.ids.filter((x) => typeof x === 'string');
-            if (ids.length > 0) {
-                attachments = { slug: project.slug, ticketKey: rawAtt.ticketKey, ids };
-            }
-        }
-        res.status(202).json({ ok: true });
-        chatManager.sendMessage(req.params.id, text.trim(), { lightweight, maxTurns, attachments }).catch((err) => {
-            console.error('[project-router] chat sendMessage error:', err);
-        });
-    });
-    router.delete('/:projectId/chat/conversations/:id/messages/stream', (req, res) => {
-        const { chatManager } = ctx(req);
-        if (!chatManager.isActive(req.params.id)) {
-            res.status(404).json({ error: 'No active stream for this conversation' });
-            return;
-        }
-        chatManager.abort(req.params.id);
-        res.json({ ok: true });
-    });
-    // Explore Spec lifecycle: minimize-to-toast hint and restore-from-toast hint.
-    // Idempotent; does not mutate persistent state. See design.md D7.
-    router.post('/:projectId/chat/conversations/:id/minimize', (req, res) => {
-        ctx(req).chatManager.notifyMinimized(req.params.id);
-        res.json({ ok: true });
-    });
-    router.post('/:projectId/chat/conversations/:id/restore', (req, res) => {
-        ctx(req).chatManager.notifyRestored(req.params.id);
-        res.json({ ok: true });
-    });
-    // ─── Install-config route ─────────────────────────────────────────────────────
-    router.post('/:projectId/setup/install-config', (req, res) => {
-        const { project } = ctx(req);
-        const config = req.body ?? {};
-        if (typeof config !== 'object' || Array.isArray(config)) {
-            res.status(400).json({ error: 'Request body must be a config object' });
-            return;
-        }
-        const configDir = path_1.default.join(project.path, '.specrails');
-        const configPath = path_1.default.join(configDir, 'install-config.yaml');
-        try {
-            fs_1.default.mkdirSync(configDir, { recursive: true });
-            const yaml = serializeInstallConfigYaml(config);
-            fs_1.default.writeFileSync(configPath, yaml, 'utf-8');
-            res.json({ ok: true, path: configPath });
-        }
-        catch (err) {
-            res.status(500).json({ error: `Failed to write install-config.yaml: ${err}` });
-        }
-    });
-    // ─── Enrich routes (v3) + Setup aliases (v1/v2 backward compat) ──────────────
-    router.post('/:projectId/setup/install', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        if (setupManager.isInstalling(project.id)) {
-            res.status(409).json({ error: 'Install already in progress' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        setupManager.startInstall(project.id, project.path);
-    });
-    router.post('/:projectId/enrich/start', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        if (setupManager.isEnriching(project.id)) {
-            res.status(409).json({ error: 'Enrich already in progress' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        setupManager.startEnrich(project.id, project.path, project.provider);
-    });
-    // Legacy alias: /setup/start → /enrich/start
-    router.post('/:projectId/setup/start', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        if (setupManager.isEnriching(project.id)) {
-            res.status(409).json({ error: 'Setup already in progress' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        setupManager.startEnrich(project.id, project.path, project.provider);
-    });
-    router.post('/:projectId/enrich/message', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        const { sessionId, message } = req.body ?? {};
-        if (!sessionId || typeof sessionId !== 'string') {
-            res.status(400).json({ error: 'sessionId is required' });
-            return;
-        }
-        if (!message || typeof message !== 'string' || !message.trim()) {
-            res.status(400).json({ error: 'message is required' });
-            return;
-        }
-        if (setupManager.isEnriching(project.id)) {
-            res.status(409).json({ error: 'Enrich already in progress' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        setupManager.resumeEnrich(project.id, project.path, sessionId, message.trim(), project.provider);
-    });
-    // Legacy alias: /setup/message → /enrich/message
-    router.post('/:projectId/setup/message', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        const { sessionId, message } = req.body ?? {};
-        if (!sessionId || typeof sessionId !== 'string') {
-            res.status(400).json({ error: 'sessionId is required' });
-            return;
-        }
-        if (!message || typeof message !== 'string' || !message.trim()) {
-            res.status(400).json({ error: 'message is required' });
-            return;
-        }
-        if (setupManager.isEnriching(project.id)) {
-            res.status(409).json({ error: 'Setup already in progress' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        setupManager.resumeEnrich(project.id, project.path, sessionId, message.trim(), project.provider);
-    });
-    router.get('/:projectId/setup/checkpoints', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        const checkpoints = setupManager.getCheckpointStatus(project.id, project.path);
-        const savedSessionId = (0, desktop_db_1.getProjectSetupSession)(registry.desktopDb, project.id);
-        res.json({
-            checkpoints,
-            isInstalling: setupManager.isInstalling(project.id),
-            isSettingUp: setupManager.isEnriching(project.id),
-            isEnriching: setupManager.isEnriching(project.id),
-            tier: setupManager.getInstallTier(project.id) ?? null,
-            savedSessionId: savedSessionId ?? null,
-            logLines: setupManager.getInstallLog(project.id),
-            summary: setupManager.getSummary(project.path),
-        });
-    });
-    router.post('/:projectId/setup/abort', (req, res) => {
-        const { project, setupManager } = ctx(req);
-        setupManager.abort(project.id);
-        res.json({ ok: true });
-    });
-    // ─── Proposal routes ──────────────────────────────────────────────────────
-    router.get('/:projectId/propose', (req, res) => {
-        const limit = Math.min(parseInt(String(req.query.limit ?? '20'), 10) || 20, 100);
-        const offset = parseInt(String(req.query.offset ?? '0'), 10) || 0;
-        const result = (0, db_1.listProposals)(ctx(req).db, { limit, offset });
-        res.json(result);
-    });
-    router.post('/:projectId/propose', async (req, res) => {
-        const { idea } = req.body ?? {};
-        if (!idea || typeof idea !== 'string' || !idea.trim()) {
-            res.status(400).json({ error: 'idea is required' });
-            return;
-        }
-        // Pre-check: does the propose-feature command exist in this project?
-        const testCmd = `/specrails:propose-feature test`;
-        const resolved = (0, command_resolver_1.resolveCommand)(testCmd, ctx(req).project.path);
-        if (resolved === testCmd) {
-            res.status(400).json({ error: 'This project does not have the /specrails:propose-feature command installed. Run "npx specrails-core@latest" to update.' });
-            return;
-        }
-        const id = (0, ids_1.newId)();
-        (0, db_1.createProposal)(ctx(req).db, { id, idea: idea.trim() });
-        res.status(202).json({ proposalId: id });
-        ctx(req).proposalManager.startExploration(id, idea.trim()).catch((err) => {
-            console.error('[project-router] proposal startExploration error:', err);
-        });
-    });
-    router.get('/:projectId/propose/:id', (req, res) => {
-        const proposal = (0, db_1.getProposal)(ctx(req).db, req.params.id);
-        if (!proposal) {
-            res.status(404).json({ error: 'Proposal not found' });
-            return;
-        }
-        res.json({ proposal });
-    });
-    router.post('/:projectId/propose/:id/refine', async (req, res) => {
-        const proposal = (0, db_1.getProposal)(ctx(req).db, req.params.id);
-        if (!proposal) {
-            res.status(404).json({ error: 'Proposal not found' });
-            return;
-        }
-        const { feedback } = req.body ?? {};
-        if (!feedback || typeof feedback !== 'string' || !feedback.trim()) {
-            res.status(400).json({ error: 'feedback is required' });
-            return;
-        }
-        if (ctx(req).proposalManager.isActive(req.params.id)) {
-            res.status(409).json({ error: 'PROPOSAL_BUSY' });
-            return;
-        }
-        if (proposal.status !== 'review') {
-            res.status(409).json({ error: 'Proposal is not in review state' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        ctx(req).proposalManager.sendRefinement(req.params.id, feedback.trim()).catch((err) => {
-            console.error('[project-router] proposal sendRefinement error:', err);
-        });
-    });
-    router.post('/:projectId/propose/:id/create-issue', async (req, res) => {
-        const proposal = (0, db_1.getProposal)(ctx(req).db, req.params.id);
-        if (!proposal) {
-            res.status(404).json({ error: 'Proposal not found' });
-            return;
-        }
-        if (ctx(req).proposalManager.isActive(req.params.id)) {
-            res.status(409).json({ error: 'PROPOSAL_BUSY' });
-            return;
-        }
-        if (proposal.status !== 'review') {
-            res.status(409).json({ error: 'Proposal is not in review state' });
-            return;
-        }
-        res.status(202).json({ ok: true });
-        ctx(req).proposalManager.createIssue(req.params.id).catch((err) => {
-            console.error('[project-router] proposal createIssue error:', err);
-        });
-    });
-    router.delete('/:projectId/propose/:id', (req, res) => {
-        const proposal = (0, db_1.getProposal)(ctx(req).db, req.params.id);
-        if (!proposal) {
-            res.status(404).json({ error: 'Proposal not found' });
-            return;
-        }
-        ctx(req).proposalManager.cancel(req.params.id);
-        res.json({ ok: true });
-    });
-    // ─── Feature Funnel ─────────────────────────────────────────────────────────
-    router.get('/:projectId/changes', (req, res) => {
-        const { project, queueManager } = ctx(req);
-        const activeCommands = queueManager.getJobs()
-            .filter((j) => j.status === 'running' || j.status === 'queued')
-            .map((j) => j.command);
-        const changes = (0, changes_reader_1.readChanges)(project.path, activeCommands);
-        res.json({ changes });
-    });
-    // ─── Change Artifact Browser ─────────────────────────────────────────────────
-    const ALLOWED_ARTIFACTS = new Set(['proposal.md', 'design.md', 'tasks.md', 'delta-spec.md', 'context-bundle.md']);
-    router.get('/:projectId/changes/:changeId/artifacts/:artifact', (req, res) => {
-        const changeId = req.params.changeId;
-        const artifact = req.params.artifact;
-        if (!ALLOWED_ARTIFACTS.has(artifact)) {
-            res.status(400).json({ error: 'Invalid artifact name' });
-            return;
-        }
-        // Sanitize changeId to prevent path traversal
-        if (!/^[\w-]+$/.test(changeId)) {
-            res.status(400).json({ error: 'Invalid change ID' });
-            return;
-        }
-        const { project } = ctx(req);
-        const changesRoot = path_1.default.join(project.path, 'openspec', 'changes');
-        // Check active dir first, then archive
-        let filePath = path_1.default.join(changesRoot, changeId, artifact);
-        if (!fs_1.default.existsSync(filePath)) {
-            filePath = path_1.default.join(changesRoot, 'archive', changeId, artifact);
-        }
-        if (!fs_1.default.existsSync(filePath)) {
-            res.status(404).json({ error: 'Artifact not found' });
-            return;
-        }
-        try {
-            const content = fs_1.default.readFileSync(filePath, 'utf-8');
-            res.json({ content, artifact, changeId });
-        }
-        catch {
-            res.status(500).json({ error: 'Failed to read artifact' });
-        }
-    });
-    // ─── Spec Launcher ───────────────────────────────────────────────────────────
-    router.post('/:projectId/spec-launcher/start', (req, res) => {
-        const { description } = req.body ?? {};
-        if (!description || typeof description !== 'string' || !description.trim()) {
-            res.status(400).json({ error: 'description is required' });
-            return;
-        }
-        const launchId = (0, ids_1.newId)();
-        res.status(202).json({ launchId });
-        ctx(req).specLauncherManager.launch(launchId, description.trim()).catch((err) => {
-            console.error('[project-router] spec-launcher error:', err);
-        });
-    });
-    router.delete('/:projectId/spec-launcher/:launchId', (req, res) => {
-        const { specLauncherManager } = ctx(req);
-        if (!specLauncherManager.isActive(req.params.launchId)) {
-            res.status(404).json({ error: 'No active launch with that ID' });
-            return;
-        }
-        specLauncherManager.cancel(req.params.launchId);
-        res.json({ ok: true });
-    });
-    // ─── Job Templates ────────────────────────────────────────────────────────
-    function templateToPublic(row) {
-        if (!row)
-            return null;
-        return {
-            id: row.id,
-            name: row.name,
-            description: row.description,
-            commands: JSON.parse(row.commands),
-            created_at: row.created_at,
-            updated_at: row.updated_at,
-        };
-    }
-    router.get('/:projectId/templates', (req, res) => {
-        const rows = (0, db_1.listTemplates)(ctx(req).db);
-        const templates = rows.map((r) => templateToPublic(r));
-        res.json({ templates });
-    });
-    router.post('/:projectId/templates', (req, res) => {
-        const { name, description, commands } = req.body ?? {};
-        if (!name || typeof name !== 'string' || !name.trim()) {
-            res.status(400).json({ error: 'name is required' });
-            return;
-        }
-        if (!Array.isArray(commands) || commands.length === 0) {
-            res.status(400).json({ error: 'commands must be a non-empty array' });
-            return;
-        }
-        if (commands.some((c) => typeof c !== 'string' || !String(c).trim())) {
-            res.status(400).json({ error: 'each command must be a non-empty string' });
-            return;
-        }
-        const id = (0, ids_1.newId)();
-        try {
-            (0, db_1.createTemplate)(ctx(req).db, {
-                id,
-                name: name.trim(),
-                description: description && typeof description === 'string' ? description.trim() : undefined,
-                commands: commands.map((c) => c.trim()),
-            });
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : '';
-            if (msg.includes('UNIQUE constraint failed')) {
-                res.status(409).json({ error: 'A template with that name already exists' });
-                return;
-            }
-            console.error('[project-router] create template error:', err);
-            res.status(500).json({ error: 'Internal server error' });
-            return;
-        }
-        const created = templateToPublic((0, db_1.getTemplate)(ctx(req).db, id));
-        res.status(201).json({ template: created });
-    });
-    router.get('/:projectId/templates/:templateId', (req, res) => {
-        const row = (0, db_1.getTemplate)(ctx(req).db, req.params.templateId);
-        if (!row) {
-            res.status(404).json({ error: 'Template not found' });
-            return;
-        }
-        res.json({ template: templateToPublic(row) });
-    });
-    router.patch('/:projectId/templates/:templateId', (req, res) => {
-        const { db } = ctx(req);
-        const templateId = req.params.templateId;
-        const row = (0, db_1.getTemplate)(db, templateId);
-        if (!row) {
-            res.status(404).json({ error: 'Template not found' });
-            return;
-        }
-        const { name, description, commands } = req.body ?? {};
-        const patch = {};
-        if (name !== undefined) {
-            if (typeof name !== 'string' || !name.trim()) {
-                res.status(400).json({ error: 'name must be a non-empty string' });
-                return;
-            }
-            patch.name = name.trim();
-        }
-        if (description !== undefined) {
-            patch.description = description === null ? null : String(description).trim() || null;
-        }
-        if (commands !== undefined) {
-            if (!Array.isArray(commands) || commands.length === 0) {
-                res.status(400).json({ error: 'commands must be a non-empty array' });
-                return;
-            }
-            if (commands.some((c) => typeof c !== 'string' || !String(c).trim())) {
-                res.status(400).json({ error: 'each command must be a non-empty string' });
-                return;
-            }
-            patch.commands = commands.map((c) => c.trim());
-        }
-        try {
-            (0, db_1.updateTemplate)(db, templateId, patch);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : '';
-            if (msg.includes('UNIQUE constraint failed')) {
-                res.status(409).json({ error: 'A template with that name already exists' });
-                return;
-            }
-            console.error('[project-router] update template error:', err);
-            res.status(500).json({ error: 'Internal server error' });
-            return;
-        }
-        const updated = templateToPublic((0, db_1.getTemplate)(db, templateId));
-        res.json({ ok: true, template: updated });
-    });
-    router.delete('/:projectId/templates/:templateId', (req, res) => {
-        const { db } = ctx(req);
-        const row = (0, db_1.getTemplate)(db, req.params.templateId);
-        if (!row) {
-            res.status(404).json({ error: 'Template not found' });
-            return;
-        }
-        (0, db_1.deleteTemplate)(db, req.params.templateId);
-        res.json({ ok: true });
-    });
-    router.post('/:projectId/templates/:templateId/run', (req, res) => {
-        const { db, queueManager } = ctx(req);
-        const row = (0, db_1.getTemplate)(db, req.params.templateId);
-        if (!row) {
-            res.status(404).json({ error: 'Template not found' });
-            return;
-        }
-        const commands = JSON.parse(row.commands);
-        const chain = req.body?.chain !== false; // default: chain jobs as pipeline
-        const jobIds = [];
-        try {
-            const pipelineId = chain && commands.length > 1 ? (0, ids_1.newId)() : undefined;
-            let prevJobId = null;
-            for (const command of commands) {
-                const job = queueManager.enqueue(command, 'normal', {
-                    dependsOnJobId: chain ? (prevJobId ?? undefined) : undefined,
-                    pipelineId,
-                });
-                jobIds.push(job.id);
-                prevJobId = job.id;
-            }
-        }
-        catch (err) {
-            if (err instanceof queue_manager_1.ClaudeNotFoundError) {
-                res.status(400).json({ error: err.message });
-                return;
-            }
-            console.error('[project-router] template run error:', err);
-            res.status(500).json({ error: 'Internal server error' });
-            return;
-        }
-        res.status(202).json({ ok: true, jobIds, templateId: row.id, templateName: row.name });
-    });
-    // ─── Integration contract ──────────────────────────────────────────────────
-    const DEFAULT_TICKET_CAPABILITIES = ['crud', 'labels', 'status', 'priorities', 'dependencies'];
-    const DEFAULT_TICKET_STORAGE_PATH = '.specrails/local-tickets.json';
-    // GET /:projectId/integration-contract — Return the project's integration contract with ticketProvider
-    router.get('/:projectId/integration-contract', (req, res) => {
-        const projectPath = ctx(req).project.path;
-        const contractFile = path_1.default.join(projectPath, '.claude', 'integration-contract.json');
-        let rawContract = {};
-        let source = 'default';
-        if (fs_1.default.existsSync(contractFile)) {
-            try {
-                rawContract = JSON.parse(fs_1.default.readFileSync(contractFile, 'utf-8'));
-                source = 'contract';
-            }
-            catch {
-                // malformed contract — fall back to defaults
-            }
-        }
-        const rawProvider = rawContract.ticketProvider;
-        const storagePath = rawProvider?.storagePath ?? DEFAULT_TICKET_STORAGE_PATH;
-        const ticketProvider = {
-            type: rawProvider?.type ?? 'local',
-            storagePath: path_1.default.resolve(projectPath, storagePath),
-            capabilities: rawProvider?.capabilities ?? DEFAULT_TICKET_CAPABILITIES,
-        };
-        res.json({ ticketProvider, source });
-    });
-    // ─── Tickets ──────────────────────────────────────────────────────────────────
-    /** Resolve the ticket storage file path for a project */
-    function ticketPath(req) {
-        return (0, ticket_store_1.resolveTicketStoragePath)(ctx(req).project.path);
-    }
-    // GET /:projectId/tickets — List all tickets with optional filters
-    router.get('/:projectId/tickets', (req, res) => {
-        try {
-            const filePath = ticketPath(req);
-            const store = (0, ticket_store_1.readStore)(filePath);
-            const allTickets = Object.values(store.tickets);
-            const filtered = (0, ticket_store_1.filterTickets)(allTickets, {
-                status: req.query.status,
-                label: req.query.label,
-                q: req.query.q,
-            });
-            // Sort by updated_at descending
-            filtered.sort((a, b) => (b.updated_at || '').localeCompare(a.updated_at || ''));
-            res.json({ tickets: filtered, revision: store.revision, total: allTickets.length });
-        }
-        catch (err) {
-            console.error('[project-router] ticket list error:', err);
-            res.status(500).json({ error: 'Failed to read tickets' });
-        }
-    });
-    // GET /:projectId/tickets/:id — Get single ticket
-    router.get('/:projectId/tickets/:id', (req, res) => {
-        const ticketId = req.params.id;
-        if (!/^\d+$/.test(ticketId)) {
-            res.status(400).json({ error: 'Invalid ticket ID' });
-            return;
-        }
-        try {
-            const store = (0, ticket_store_1.readStore)(ticketPath(req));
-            const ticket = store.tickets[ticketId];
-            if (!ticket) {
-                res.status(404).json({ error: 'Ticket not found' });
-                return;
-            }
-            res.json({ ticket, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] ticket get error:', err);
-            res.status(500).json({ error: 'Failed to read ticket' });
-        }
-    });
-    // POST /:projectId/tickets/generate-spec — Fast AI spec generation (no codebase exploration)
-    router.post('/:projectId/tickets/generate-spec', async (req, res) => {
-        const idea = req.body?.idea;
-        if (!idea?.trim()) {
-            res.status(400).json({ error: 'idea is required' });
-            return;
-        }
-        const attachmentIds = Array.isArray(req.body?.attachmentIds)
-            ? req.body.attachmentIds.filter((x) => typeof x === 'string')
-            : [];
-        const pendingSpecId = typeof req.body?.pendingSpecId === 'string' ? req.body.pendingSpecId : null;
-        if (attachmentIds.length > 0 && !pendingSpecId) {
-            res.status(400).json({ error: 'pendingSpecId is required when attachmentIds are provided' });
-            return;
-        }
-        const { project, broadcast, ticketWatcher } = ctx(req);
-        // Multi-provider: optional aiEngine (alias provider) picks the engine for
-        // this Quick spec; must be installed on the project. Omitting it uses the
-        // primary provider.
-        const requestedEngine = req.body?.aiEngine ?? req.body?.provider;
-        const engineCheck = (0, provider_selection_1.validateRequestedProvider)(project, requestedEngine);
-        if (!engineCheck.ok) {
-            res.status(400).json({ error: engineCheck.error });
-            return;
-        }
-        const provider = engineCheck.provider;
-        // Resolve and validate the model. Order:
-        //   - Body had a `model` and it's valid → use it.
-        //   - Body had a `model` and it's invalid → 400 with the allow-list.
-        //   - Body had no `model` → fall back to project default.
-        const rawModel = req.body?.model;
-        let resolvedModel;
-        if (rawModel === undefined || rawModel === null || rawModel === '') {
-            resolvedModel = resolveDefaultSpecModel({ projectPath: project.path, provider });
-        }
-        else if ((0, spec_models_1.isValidModelForProvider)(rawModel, provider)) {
-            resolvedModel = rawModel;
-        }
-        else {
-            res.status(400).json({
-                error: `Invalid model "${String(rawModel)}" for provider "${provider}"`,
-                allowed: (0, spec_models_1.getModelsForProvider)(provider).map((m) => m.value),
-            });
-            return;
-        }
-        const requestId = (0, ids_1.newId)();
-        const projectId = project.id;
-        const filePath = ticketPath(req);
-        let hasAttachments = false;
-        let baseUserPrompt = `Generate a spec for the following idea:\n\n${idea.trim()}`;
-        let imageFlags = [];
-        if (attachmentIds.length > 0 && pendingSpecId) {
-            try {
-                const extracted = await attachment_manager_1.attachmentManager.getClaudeArgs(project.slug, pendingSpecId, attachmentIds);
-                imageFlags = extracted.imageFlags;
-                if (extracted.textBlocks.length > 0) {
-                    hasAttachments = true;
-                    baseUserPrompt = `${baseUserPrompt}\n\n## Attached Resources\n\n${extracted.textBlocks.join('\n\n')}`;
-                }
-            }
-            catch (err) {
-                console.error('[project-router] generate-spec attachment extraction error:', err);
-            }
-        }
-        // Parse contextScope from body. Quick and Explore share the same Context
-        // Awareness controls; Quick still keeps Contract Refine as a top-level
-        // field for the refine scheduler.
-        const rawScope = req.body?.contextScope;
-        // Contract Layer is Claude-only — force it off for any non-claude engine
-        // (defence-in-depth; the Quick UI hides the toggle for those).
-        const quickContractRefine = provider !== 'claude'
-            ? false
-            : typeof req.body?.contractRefine === 'boolean'
-                ? req.body.contractRefine
-                : typeof rawScope?.contractRefine === 'boolean'
-                    ? rawScope.contractRefine
-                    : false;
-        const quickScope = {
-            specrails: typeof rawScope?.specrails === 'boolean' ? rawScope.specrails : false,
-            openspec: typeof rawScope?.openspec === 'boolean' ? rawScope.openspec : false,
-            full: typeof rawScope?.full === 'boolean' ? rawScope.full : false,
-            mcp: false,
-            contractRefine: quickContractRefine,
-            // Quick mode never injects MCPs (user MCP is an Explore-only toggle).
-            userMcp: false,
-        };
-        // Persist Quick mode Contract Refine choice (per-project last value).
-        (0, db_1.setQuickContractRefineLast)(ctx(req).db, quickContractRefine);
-        const specsPrefix = (0, context_scope_1.buildScopedSystemPromptPrefix)(quickScope, project.path);
-        const codebaseRule = quickScope.full
-            ? `- You MAY use Read, Grep, and Glob to inspect the project codebase. Bash is not available.`
-            : hasAttachments
-                ? `- Do NOT explore the project codebase. The resources inside <user-attachment> blocks below are pre-loaded context the user intentionally provided — read and use them freely.`
-                : `- Do NOT read any files or explore the codebase. Work purely from the user's description.`;
-        // The specrails-tickets prefix (when scope.specrails is toggled on)
-        // dumps every ticket into the prompt as informational context. Without
-        // an explicit dedup instruction the model treats it as background and
-        // still proposes a near-duplicate of something already in the backlog.
-        // Adding the rule here, gated on `quickScope.specrails`, keeps the
-        // "toggle is the only gate" contract the user asked for.
-        const dedupRule = quickScope.specrails
-            ? `- The "Specrails Tickets" section above lists every ticket already in the backlog. Do NOT propose a duplicate or a near-duplicate of any of them. If the user's idea is already covered by an existing ticket, say so in "Problem Statement" and pick a *different* angle / sub-feature / next step that builds on the existing one — do not repeat it.\n`
-            : '';
-        const backlogRecommendationRule = quickScope.specrails
-            ? `- If the user's idea asks for the "next best spec" or a backlog recommendation, use the existing tickets and OpenSpec context to choose one concrete next spec. Do not respond with generic product directions.\n`
-            : '';
-        let baseSystemPrompt = `You are a senior product engineer generating a structured spec proposal.\n\n` +
-            (specsPrefix ? `${specsPrefix}\n\n` : '') +
-            `RULES:\n` +
-            `${codebaseRule}\n` +
-            dedupRule +
-            backlogRecommendationRule +
-            `- Do NOT create files, tickets, or issues.\n` +
-            `- Output ONLY the structured markdown below. No preamble, no explanation.\n\n` +
-            `REQUIRED FORMAT:\n` +
-            `## Spec Title\n[Concise, action-oriented title]\n\n` +
-            `## Labels\n[2-4 short kebab-case tags categorising the spec — comma-separated on one line, e.g. "ui, settings, dark-mode". Lowercase, no spaces inside a tag.]\n\n` +
-            `## Problem Statement\n[2-3 sentences]\n\n` +
-            `## Proposed Solution\n[3-5 sentences]\n\n` +
-            `## Out of Scope\n[Bullet list]\n\n` +
-            `## Acceptance Criteria\n[Numbered list of testable outcomes]\n\n` +
-            `## Technical Considerations\n[Bullet list]\n\n` +
-            `## Estimated Complexity\n[Low/Medium/High/Very High + one sentence justification]\n\n` +
-            `## Short Summary\n[One or two plain-language sentences, max 120 characters total, that capture the essence of this spec for a dashboard postit. No markdown, no bullets, no headings.]`;
-        if (hasAttachments)
-            baseSystemPrompt = `${baseSystemPrompt}\n\n${attachment_manager_1.USER_ATTACHMENT_SYSTEM_NOTE}`;
-        const systemPrompt = baseSystemPrompt;
-        const userPrompt = baseUserPrompt;
-        // Generate-spec spawn args are adapter-driven. For Claude the `--tools`
-        // flag set comes from `toolFlagsForScope(quickScope)` which the adapter
-        // doesn't model — pass them through `extraArgs` so they slot in after
-        // the standard COMMON_FLAGS. `imageFlags` (also Claude-only) goes the
-        // same way. For codex the system prompt folds into the user prompt
-        // (no --system-prompt flag) and the extra Claude-only flags are ignored
-        // by the codex adapter (it doesn't read extraArgs that don't apply).
-        const adapter = (0, providers_1.getAdapter)(provider);
-        const toolFlags = provider === 'claude' ? (0, context_scope_1.toolFlagsForScope)(quickScope) : { args: [] };
-        // Full scope grants Read/Grep/Glob. The model spends turns exploring the
-        // repo before it writes the spec; 6 was too tight (a few tool calls on a
-        // sparse/empty repo hit error_max_turns → exit 1 → opaque failure). 15
-        // leaves comfortable headroom while --max-turns still bounds runaway loops.
-        const claudeMaxTurns = quickScope.full ? 15 : (hasAttachments ? 3 : 1);
-        const args = adapter.buildArgs('spec-gen', {
-            prompt: userPrompt,
-            systemPrompt,
-            model: resolvedModel,
-            maxTurns: provider === 'claude' ? claudeMaxTurns : undefined,
-            extraArgs: provider === 'claude' ? [...toolFlags.args, ...imageFlags] : undefined,
-        });
-        const binary = adapter.binary;
-        // spawnAiCli reroutes multi-line argv values through stdin on Windows;
-        // POSIX argv path unchanged.
-        console.log(`[project-router] spec-gen spawn: ${binary} (cwd=${project.path}, requestId=${requestId})`);
-        const child = (0, cli_prompt_1.spawnAiCli)(binary, args, {
-            env: process.env,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            cwd: project.path,
-        });
-        // Watchdog: unlike ai-edit, generate-spec keeps no cancellable handle, so a
-        // hung CLI (network stall, model never emitting a terminating event) would
-        // otherwise leak this child + its readline for the app's lifetime. Cap is
-        // generous — the 'full' scope can legitimately run minutes and --max-turns
-        // bounds turns, not wall-clock. Cleared on close/error.
-        const GENERATE_SPEC_TIMEOUT_MS = 8 * 60 * 1000;
-        let specGenWatchdog = setTimeout(() => {
-            specGenWatchdog = null;
-            if (child.pid) {
-                try {
-                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-                }
-                catch { /* best-effort */ }
-            }
-            broadcast({
-                type: 'spec_gen_error', projectId, requestId,
-                error: `Spec generation timed out after ${Math.round(GENERATE_SPEC_TIMEOUT_MS / 1000)}s`,
-                timestamp: new Date().toISOString(),
-            });
-        }, GENERATE_SPEC_TIMEOUT_MS);
-        if (typeof specGenWatchdog.unref === 'function')
-            specGenWatchdog.unref();
-        const clearSpecGenWatchdog = () => {
-            if (specGenWatchdog) {
-                clearTimeout(specGenWatchdog);
-                specGenWatchdog = null;
-            }
-        };
-        // Capture stderr so failures (auth missing, model errors, etc.) surface
-        // in the server log instead of being swallowed.
-        let stderrBuf = '';
-        /* c8 ignore start -- diagnostic-only; fires only when claude writes stderr */
-        child.stderr?.on('data', (chunk) => {
-            const s = chunk.toString();
-            stderrBuf += s;
-            console.error(`[project-router] spec-gen stderr (${requestId}): ${s.trimEnd()}`);
-        });
-        /* c8 ignore stop */
-        // Without this listener, ENOENT (binary missing on PATH) propagates as
-        // an unhandled 'error' event and crashes the entire app process.
-        /* c8 ignore start -- spawn-failure path; exercised manually, not in CI */
-        child.on('error', (err) => {
-            clearSpecGenWatchdog();
-            console.error(`[project-router] spec-gen spawn failed (${binary}): ${err.message}`);
-            const errMsg = {
-                type: 'spec_gen_error', projectId, requestId,
-                error: `Failed to launch ${binary}: ${err.message}`,
-                timestamp: new Date().toISOString(),
-            };
-            broadcast(errMsg);
-        });
-        /* c8 ignore stop */
-        res.status(202).json({ requestId });
-        let buffer = '';
-        let lastResultEvent = null;
-        // Canonical adapter events feed finaliseInvocationResult on close, giving
-        // codex a real pricing-table cost estimate (+ estimated flag) and tokens,
-        // instead of the legacy hardcoded $0. Accumulated ALONGSIDE the existing
-        // buffer/delta plumbing below — never in place of it.
-        const adapterEvents = [];
-        const turnStartedAt = new Date().toISOString();
-        const stdoutReader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
-        stdoutReader.on('line', (line) => {
-            const adapterEv = adapter.parseStreamLine(line);
-            if (adapterEv)
-                adapterEvents.push(adapterEv);
-            let parsed = null;
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch { /* skip */ }
-            if (!parsed)
-                return;
-            if (provider === 'codex') {
-                // Codex `exec --json` emits one event per line. Capture the final
-                // `turn.completed` for usage extraction, and accumulate ONLY the
-                // assistant_message text — never the command_execution items or
-                // wrapper events, otherwise the raw JSONL ends up in the ticket
-                // description.
-                if (parsed.type === 'turn.completed') {
-                    lastResultEvent = parsed;
-                    return;
-                }
-                if (parsed.type !== 'item.completed')
-                    return;
-                const item = parsed.item;
-                if (!item || item.type !== 'agent_message')
-                    return;
-                const newText = (item.text ?? '').trim();
-                if (!newText)
-                    return;
-                // Each agent_message is a complete chunk — separate with a blank
-                // line so the parser regexes match cleanly across chunks.
-                buffer += (buffer.endsWith('\n') || buffer.length === 0 ? '' : '\n') + newText + '\n';
-                const msg = {
-                    type: 'spec_gen_stream', projectId, requestId,
-                    delta: newText + '\n', timestamp: new Date().toISOString(),
-                };
-                broadcast(msg);
-                return;
-            }
-            // Claude path.
-            if (parsed.type === 'result') {
-                lastResultEvent = parsed;
-            }
-            if (parsed.type === 'assistant') {
-                const msg = parsed.message;
-                const texts = (msg?.content ?? [])
-                    .filter((c) => c.type === 'text')
-                    .map((c) => c.text ?? '');
-                const newText = texts.join('');
-                if (newText) {
-                    buffer += newText;
-                    const wsMsg = {
-                        type: 'spec_gen_stream', projectId, requestId,
-                        delta: newText, timestamp: new Date().toISOString(),
-                    };
-                    broadcast(wsMsg);
-                }
-            }
-        });
-        child.on('close', async (code) => {
-            clearSpecGenWatchdog();
-            let createdTicketId = null;
-            // When claude burns its whole --max-turns budget it exits non-zero with
-            // a result event of subtype:error_max_turns — but it may already have
-            // emitted a complete spec. Salvage that usable output instead of failing
-            // the whole request on an exit code.
-            const resultSubtype = lastResultEvent?.subtype ?? null;
-            const hasUsableSpec = buffer.trim().length > 0 && /##\s*Spec Title/i.test(buffer);
-            const salvageMaxTurns = code !== 0 && resultSubtype === 'error_max_turns' && hasUsableSpec;
-            if ((code === 0 && buffer.trim()) || salvageMaxTurns) {
-                if (salvageMaxTurns) {
-                    console.warn(`[project-router] spec-gen salvaged partial output after error_max_turns (${requestId}); ` +
-                        `consider raising --max-turns if this recurs`);
-                }
-                // Extract title from generated spec
-                const titleMatch = buffer.match(/##\s*Spec Title\s*\n+(.+)/);
-                const specTitle = titleMatch ? titleMatch[1].trim() : idea.trim().slice(0, 80);
-                // Extract complexity for priority mapping
-                const complexityMatch = buffer.match(/##\s*Estimated Complexity\s*\n+(\w+)/);
-                const complexity = complexityMatch ? complexityMatch[1].toLowerCase() : 'medium';
-                const priority = complexity === 'low' ? 'low' : complexity === 'high' || complexity === 'very' ? 'high' : 'medium';
-                // Extract labels from the `## Labels` section. Comma- or
-                // newline-separated tags, normalised to lowercase kebab-case.
-                // `spec-proposal` is always retained as the marker label.
-                const labelsMatch = buffer.match(/##\s*Labels\s*\n+([^\n]+(?:\n(?!##)[^\n]+)*)/);
-                const claudeLabels = labelsMatch
-                    ? labelsMatch[1]
-                        .replace(/[\[\]]/g, '')
-                        .split(/[,\n]/)
-                        .map((s) => s.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, ''))
-                        .filter((s) => s.length > 0 && s.length <= 32)
-                        .slice(0, 6)
-                    : [];
-                const finalLabels = Array.from(new Set(['spec-proposal', ...claudeLabels]));
-                const shortSummary = (0, ticket_store_1.clampShortSummary)(extractShortSummary(buffer));
-                const description = stripSpecMetadataSections(buffer);
-                // Create ticket directly
-                try {
-                    const now = new Date().toISOString();
-                    let created;
-                    const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                        const id = s.next_id++;
-                        const ticket = {
-                            id,
-                            title: specTitle,
-                            description,
-                            status: 'todo',
-                            priority: priority,
-                            labels: finalLabels,
-                            assignee: null,
-                            prerequisites: [],
-                            metadata: {},
-                            comments: [],
-                            origin_conversation_id: null,
-                            is_epic: false,
-                            parent_epic_id: null,
-                            execution_order: null,
-                            short_summary: shortSummary,
-                            created_at: now,
-                            updated_at: now,
-                            created_by: 'sr-product-engineer',
-                            source: 'propose-spec',
-                        };
-                        s.tickets[String(id)] = ticket;
-                        created = ticket;
-                    });
-                    ticketWatcher.notifyDesktopWrite(store.revision);
-                    if (created)
-                        createdTicketId = created.id;
-                    // Migrate attachments from pendingSpecId → real ticket id (if any were uploaded).
-                    // Must complete BEFORE broadcasting ticket_created so WS listeners see the populated attachments[].
-                    if (pendingSpecId && created) {
-                        try {
-                            const migrated = await attachment_manager_1.attachmentManager.renameTicketDir({
-                                slug: project.slug,
-                                pendingId: pendingSpecId,
-                                realTicketId: created.id,
-                                projectPath: project.path,
-                            });
-                            if (migrated.length > 0) {
-                                created.attachments = migrated;
-                            }
-                        }
-                        catch (err) {
-                            console.error('[project-router] generate-spec attachment migration error:', err);
-                        }
-                    }
-                    const ticketMsg = {
-                        type: 'ticket_created', ticket: created,
-                        projectId, timestamp: new Date().toISOString(),
-                    };
-                    broadcast(ticketMsg);
-                    const doneMsg = {
-                        type: 'spec_gen_done', projectId, requestId,
-                        ticket: created, timestamp: new Date().toISOString(),
-                    };
-                    broadcast(doneMsg);
-                    // Quick mode Contract Refine: when toggle is on in the request body
-                    // AND the project setting + kill switch permit it, fire the no-resume
-                    // Quick refine path asynchronously. Claude-only today — codex
-                    // contract refine isn't wired (the spawn hardcodes the `claude`
-                    // binary). Skip silently on codex projects so the ticket lands
-                    // without the misleading "Contract layer skipped — model_error"
-                    // toast that the refine kill-switch would otherwise emit.
-                    if (quickContractRefine && created && provider === 'claude') {
-                        const refineTicketId = created.id;
-                        const refineTitle = created.title;
-                        const refineDescription = created.description;
-                        const refineModel = req.body?.model ?? null;
-                        process.nextTick(() => {
-                            void (0, contract_refine_runner_1.runContractRefineForQuick)({
-                                db: ctx(req).db,
-                                projectId: project.id,
-                                projectSlug: project.slug,
-                                projectPath: project.path,
-                                projectName: project.name,
-                                broadcast: broadcast,
-                            }, refineTicketId, refineTitle, refineDescription, refineModel).catch((err) => {
-                                console.error('[project-router] runContractRefineForQuick error:', err);
-                            });
-                        });
-                    }
-                    else if (quickContractRefine && created && provider === 'codex') {
-                        console.log(`[project-router] quick contract refine skipped for codex project (ticket #${created.id}); ` +
-                            `feature is claude-only today`);
-                    }
-                }
-                catch (err) {
-                    console.error('[project-router] generate-spec ticket creation error:', err);
-                    const errMsg = {
-                        type: 'spec_gen_error', projectId, requestId,
-                        error: 'Failed to create ticket', timestamp: new Date().toISOString(),
-                    };
-                    broadcast(errMsg);
-                }
-            }
-            else {
-                const reason = code === 0
-                    ? 'Empty response from AI'
-                    : resultSubtype === 'error_max_turns'
-                        ? 'AI hit its turn limit before finishing the spec. Try again, or narrow the idea / turn off full-codebase context.'
-                        : `Process exited with code ${code}`;
-                console.error(`[project-router] spec-gen failed (${requestId}): ${reason}` +
-                    (stderrBuf.trim() ? `\n  stderr: ${stderrBuf.trim()}` : '') +
-                    (buffer.trim() ? `\n  stdout-buffer: ${buffer.trim().slice(0, 500)}` : ''));
-                const msg = {
-                    type: 'spec_gen_error', projectId, requestId,
-                    error: reason,
-                    timestamp: new Date().toISOString(),
-                };
-                broadcast(msg);
-            }
-            // ai_invocations capture (surface='quick-spec'). Always emit a row, success or fail.
-            try {
-                // Adapter-driven finalisation: claude passes its native total_cost_usd
-                // through untouched; codex (nativeCostUsd:false) gets a pricing-table
-                // estimate from its captured token usage + estimated=true. This
-                // replaces the legacy normaliseResultEvent path that hardcoded codex
-                // cost to $0 and never set the estimated flag.
-                const { result: normalised, estimated } = (0, result_event_1.finaliseInvocationResult)(adapter, adapterEvents, { fallbackModel: resolvedModel });
-                // extractCodexResult does not surface duration (codex stream carries
-                // none); stamp wall-clock so the row's duration isn't lost. Claude's
-                // result event already provides duration_ms, so prefer it.
-                const wallMs = Date.now() - new Date(turnStartedAt).getTime();
-                (0, ai_invocations_1.recordInvocation)(ctx(req).db, {
-                    id: (0, crypto_1.randomUUID)(),
-                    project_id: projectId,
-                    provider: adapter.id,
-                    surface: 'quick-spec',
-                    surface_ref_id: requestId,
-                    ticket_id: createdTicketId,
-                    status: code === 0 && buffer.trim() ? 'success' : 'failed',
-                    started_at: turnStartedAt,
-                    finished_at: new Date().toISOString(),
-                    total_cost_usd_estimated: estimated,
-                    ...normalised,
-                    duration_ms: normalised.duration_ms ?? wallMs,
-                });
-                broadcast({ type: 'spending.invalidated', projectId });
-            }
-            catch (err) {
-                console.error('[project-router] generate-spec recordInvocation failed:', err);
-            }
-        });
-    });
-    // POST /:projectId/tickets/save-as-draft — Persist an in-progress Explore session as a draft ticket
-    router.post('/:projectId/tickets/save-as-draft', (req, res) => {
-        const body = req.body ?? {};
-        const conversationId = typeof body.conversationId === 'string' ? body.conversationId.trim() : '';
-        if (!conversationId) {
-            res.status(400).json({ error: 'conversationId is required' });
-            return;
-        }
-        const providedTitle = typeof body.title === 'string' ? body.title.trim() : '';
-        const labels = Array.isArray(body.labels)
-            ? body.labels.filter((l) => typeof l === 'string')
-            : [];
-        const description = typeof body.description === 'string' ? body.description : '';
-        // Optional editTicketId — when present, demote that specific ticket in
-        // place instead of looking up by conversationId. Drives the
-        // Continue-Editing-on-non-draft flow.
-        let editTicketId;
-        if (body.editTicketId !== undefined && body.editTicketId !== null) {
-            if (typeof body.editTicketId !== 'number' || !Number.isFinite(body.editTicketId)) {
-                res.status(400).json({ error: 'editTicketId must be a number' });
-                return;
-            }
-            editTicketId = body.editTicketId;
-        }
-        try {
-            const { db, project, broadcast, ticketWatcher } = ctx(req);
-            // Require at least one user-submitted turn before accepting a save
-            const messages = (0, db_1.getMessages)(db, conversationId);
-            const hasUserTurn = messages.some((m) => m.role === 'user' && (m.content ?? '').trim().length > 0);
-            if (!hasUserTurn) {
-                res.status(400).json({ error: 'conversation has no user-submitted turn yet' });
-                return;
-            }
-            const filePath = ticketPath(req);
-            const now = new Date().toISOString();
-            let saved;
-            let flippedInPlace = false;
-            let notFound = false;
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                if (editTicketId !== undefined) {
-                    const target = s.tickets[String(editTicketId)];
-                    if (!target) {
-                        notFound = true;
-                        return;
-                    }
-                    const title = providedTitle || target.title || (0, explore_draft_title_1.generateAutoTitle)(messages.map((m) => ({ role: m.role, content: m.content ?? '' })));
-                    target.title = title;
-                    if (description)
-                        target.description = description;
-                    if (labels.length > 0)
-                        target.labels = labels;
-                    target.status = 'draft';
-                    target.priority = null;
-                    target.origin_conversation_id = conversationId;
-                    target.updated_at = now;
-                    saved = target;
-                    flippedInPlace = true;
-                    return;
-                }
-                // Idempotent on conversationId: if a draft ticket already references this
-                // conversation, update in place rather than create a second one.
-                const existing = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId && t.status === 'draft');
-                const title = providedTitle || existing?.title || (0, explore_draft_title_1.generateAutoTitle)(messages.map((m) => ({ role: m.role, content: m.content ?? '' })));
-                if (existing) {
-                    existing.title = title;
-                    if (description)
-                        existing.description = description;
-                    if (labels.length > 0)
-                        existing.labels = labels;
-                    existing.updated_at = now;
-                    saved = existing;
-                    return;
-                }
-                const id = s.next_id++;
-                const ticket = {
-                    id,
-                    title,
-                    description,
-                    status: 'draft',
-                    priority: null,
-                    labels,
-                    assignee: null,
-                    prerequisites: [],
-                    metadata: {},
-                    comments: [],
-                    origin_conversation_id: conversationId,
-                    is_epic: false,
-                    parent_epic_id: null,
-                    execution_order: null,
-                    short_summary: null,
-                    created_at: now,
-                    updated_at: now,
-                    created_by: 'sr-explore-spec',
-                    source: 'explore-draft',
-                };
-                s.tickets[String(id)] = ticket;
-                saved = ticket;
-            });
-            if (notFound) {
-                res.status(404).json({ error: 'ticket not found' });
-                return;
-            }
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            if (flippedInPlace) {
-                const msg = {
-                    type: 'ticket_updated',
-                    ticket: saved,
-                    projectId: project.id,
-                    timestamp: now,
-                };
-                broadcast(msg);
-                res.status(200).json({ ticket: saved, revision: store.revision });
-                return;
-            }
-            const msg = saved.created_at === saved.updated_at
-                ? { type: 'ticket_created', ticket: saved, projectId: project.id, timestamp: now }
-                : { type: 'ticket_updated', ticket: saved, projectId: project.id, timestamp: now };
-            broadcast(msg);
-            res.status(201).json({ ticket: saved, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] save-as-draft error:', err);
-            res.status(500).json({ error: 'Failed to save draft' });
-        }
-    });
-    // POST /:projectId/tickets/from-draft — Commit an Explore Spec draft as a real ticket
-    // Two paths:
-    //   (1) Legacy: payload has no `draftTicketId` → create a brand-new ticket (status='todo').
-    //   (2) Flip in place: payload has `draftTicketId` referencing an existing
-    //       status='draft' ticket → update that ticket in place to status='todo',
-    //       set priority, replace title/description, preserve origin_conversation_id.
-    router.post('/:projectId/tickets/from-draft', async (req, res) => {
-        const body = req.body ?? {};
-        const rawTitle = typeof body.title === 'string' ? body.title.trim() : '';
-        if (!rawTitle) {
-            res.status(400).json({ error: 'title is required' });
-            return;
-        }
-        const draftTicketId = typeof body.draftTicketId === 'number' ? body.draftTicketId : null;
-        const pendingSpecId = typeof body.pendingSpecId === 'string' ? body.pendingSpecId : null;
-        const conversationId = typeof body.conversationId === 'string' ? body.conversationId : null;
-        const baseDescription = typeof body.description === 'string' ? body.description.trim() : '';
-        const labels = Array.isArray(body.labels)
-            ? body.labels.filter((l) => typeof l === 'string')
-            : [];
-        const acceptanceCriteria = Array.isArray(body.acceptanceCriteria)
-            ? body.acceptanceCriteria
-                .filter((c) => typeof c === 'string')
-                .map((c) => c.trim())
-                .filter((c) => c.length > 0)
-            : [];
-        const priority = (0, ticket_store_1.isValidPriority)(body.priority) ? body.priority : 'medium';
-        // Compose the final ticket body. The title is already its own ticket
-        // field, so we deliberately do NOT echo it as a `## Spec Title` heading
-        // inside the description. The body is just the structured sections from
-        // Claude (Problem Statement / Proposed Solution / Out of Scope /
-        // Technical Considerations / Estimated Complexity) followed by the
-        // Acceptance Criteria bullets.
-        const description = formatDescriptionWithCriteria(baseDescription, acceptanceCriteria);
-        // Short summary: explicit body field wins; otherwise try extracting a
-        // `## Short Summary` section from the description and stripping it.
-        let bodyShortSummary = null;
-        let descriptionForStore = description;
-        if (typeof body.shortSummary === 'string') {
-            bodyShortSummary = (0, ticket_store_1.clampShortSummary)(body.shortSummary);
-        }
-        else {
-            const extracted = extractShortSummary(description);
-            if (extracted !== null) {
-                bodyShortSummary = (0, ticket_store_1.clampShortSummary)(extracted);
-                descriptionForStore = description
-                    .replace(/##\s*Short Summary\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-                    .trim();
-            }
-        }
-        if (bodyShortSummary === null) {
-            bodyShortSummary = deriveFallbackShortSummary(rawTitle, descriptionForStore);
-        }
-        try {
-            const filePath = ticketPath(req);
-            const now = new Date().toISOString();
-            let created;
-            let wasFlip = false;
-            let explicitDraftMissing = false;
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                // Resolve flip target: explicit `draftTicketId` wins; otherwise look up
-                // an existing draft ticket whose origin_conversation_id matches the
-                // current conversation so a resumed session commits in place even when
-                // the client doesn't track the draft id explicitly.
-                let flipTarget;
-                if (draftTicketId !== null) {
-                    flipTarget = s.tickets[String(draftTicketId)];
-                    if (!flipTarget || flipTarget.status !== 'draft') {
-                        explicitDraftMissing = true;
-                        return;
-                    }
-                }
-                else if (conversationId) {
-                    flipTarget = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId && t.status === 'draft');
-                }
-                if (flipTarget) {
-                    flipTarget.status = 'todo';
-                    flipTarget.priority = priority;
-                    flipTarget.title = rawTitle;
-                    flipTarget.description = descriptionForStore;
-                    if (labels.length > 0)
-                        flipTarget.labels = labels;
-                    flipTarget.updated_at = now;
-                    // Preserve prior short_summary on flip when the model/body omits one;
-                    // overwrite only when a non-null value is provided.
-                    if (bodyShortSummary !== null) {
-                        flipTarget.short_summary = bodyShortSummary;
-                    }
-                    // origin_conversation_id is intentionally preserved
-                    created = flipTarget;
-                    wasFlip = true;
-                    return;
-                }
-                // B62: from-draft is idempotent only while the ticket is still a draft.
-                // After a successful commit the draft is 'todo', so the draft lookup above
-                // no longer matches and a second from-draft for the same conversation
-                // would insert a DUPLICATE ticket. If a (now non-draft) ticket already
-                // originates from this conversation, return it instead of re-inserting.
-                if (conversationId) {
-                    const alreadyCommitted = Object.values(s.tickets).find((t) => t.origin_conversation_id === conversationId);
-                    if (alreadyCommitted) {
-                        created = alreadyCommitted;
-                        wasFlip = true; // treat as in-place: broadcast ticket_updated, not created
-                        return;
-                    }
-                }
-                // Legacy: insert new ticket
-                const id = s.next_id++;
-                const ticket = {
-                    id,
-                    title: rawTitle,
-                    description: descriptionForStore,
-                    status: 'todo',
-                    priority,
-                    labels,
-                    assignee: null,
-                    prerequisites: [],
-                    metadata: {},
-                    comments: [],
-                    origin_conversation_id: conversationId,
-                    is_epic: false,
-                    parent_epic_id: null,
-                    execution_order: null,
-                    short_summary: bodyShortSummary,
-                    created_at: now,
-                    updated_at: now,
-                    created_by: 'sr-explore-spec',
-                    source: 'propose-spec',
-                };
-                s.tickets[String(id)] = ticket;
-                created = ticket;
-            });
-            if (explicitDraftMissing) {
-                res.status(404).json({ error: 'Draft ticket not found or not in draft status' });
-                return;
-            }
-            const { broadcast, ticketWatcher, project } = ctx(req);
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            // Migrate attachments from pendingSpecId → real ticket id (mirrors the
-            // generate-spec flow). Must complete before broadcasting ticket_created
-            // so listeners see the populated attachments[].
-            if (pendingSpecId && created) {
-                try {
-                    const migrated = await attachment_manager_1.attachmentManager.renameTicketDir({
-                        slug: project.slug,
-                        pendingId: pendingSpecId,
-                        realTicketId: created.id,
-                        projectPath: project.path,
-                    });
-                    if (migrated.length > 0) {
-                        created.attachments = migrated;
-                    }
-                }
-                catch (err) {
-                    console.error('[project-router] from-draft attachment migration error:', err);
-                }
-            }
-            const msg = wasFlip
-                ? {
-                    type: 'ticket_updated',
-                    ticket: created,
-                    projectId: project.id,
-                    timestamp: new Date().toISOString(),
-                }
-                : {
-                    type: 'ticket_created',
-                    ticket: created,
-                    projectId: project.id,
-                    timestamp: new Date().toISOString(),
-                };
-            broadcast(msg);
-            // Back-fill ticket_id on the conversation's prior ai_invocations rows.
-            if (conversationId && created) {
-                try {
-                    const changes = (0, ai_invocations_1.updateTicketIdForConversation)(ctx(req).db, conversationId, created.id);
-                    if (changes > 0) {
-                        broadcast({ type: 'spending.invalidated', projectId: project.id });
-                    }
-                }
-                catch (err) {
-                    console.error('[project-router] from-draft ai_invocations back-fill failed:', err);
-                }
-            }
-            res.status(201).json({ ticket: created, revision: store.revision });
-            // Fire Contract Refine post-commit (fire-and-forget). Toggle + kill-switch
-            // are checked inside runContractRefine. Claude-only today — codex
-            // contract refine isn't wired (the spawn hardcodes the `claude`
-            // binary). Skip silently on codex projects.
-            if (conversationId && created && project.provider === 'claude') {
-                const createdTicketId = created.id;
-                const convoId = conversationId;
-                console.log(`[project-router] from-draft hook: scheduling refine ticket=${createdTicketId} conv=${convoId}`);
-                process.nextTick(() => {
-                    void (0, contract_refine_runner_1.runContractRefine)({
-                        db: ctx(req).db,
-                        projectId: project.id,
-                        projectSlug: project.slug,
-                        projectPath: project.path,
-                        projectName: project.name,
-                        broadcast: broadcast,
-                    }, convoId, createdTicketId).catch((err) => {
-                        console.error('[project-router] runContractRefine error:', err);
-                    });
-                });
-            }
-            else if (conversationId && created && project.provider === 'codex') {
-                console.log(`[project-router] from-draft contract refine skipped for codex project (ticket #${created.id})`);
-            }
-        }
-        catch (err) {
-            console.error('[project-router] from-draft create error:', err);
-            res.status(500).json({ error: 'Failed to create ticket' });
-        }
-    });
-    // POST /:projectId/tickets/from-prompt — Create a spec directly from a
-    // free-form prompt (the "Raw" Add-Spec mode). NO AI is invoked: the user's
-    // text becomes the ticket description verbatim. The ticket lands as
-    // status='todo' (ready for rails) with source='free-prompt'. There is no
-    // ai_invocations row (nothing was billed) and no contract-refine (no origin
-    // conversation, no description format to refine).
-    router.post('/:projectId/tickets/from-prompt', async (req, res) => {
-        const body = req.body ?? {};
-        const rawDescription = typeof body.description === 'string' ? body.description.trim() : '';
-        if (!rawDescription) {
-            res.status(400).json({ error: 'description is required' });
-            return;
-        }
-        // Optional light-structuring (v1: the client always sends `false`; the flag
-        // keeps the contract stable for a future non-generative structuring pass).
-        const structured = body.structured === true;
-        const description = structured ? lightlyStructurePrompt(rawDescription) : rawDescription;
-        // Title: explicit value wins; otherwise derive a single-line summary from
-        // the body (reusing the deterministic Explore-draft summarizer).
-        const providedTitle = typeof body.title === 'string' ? body.title.trim() : '';
-        const title = providedTitle || (0, explore_draft_title_1.generateAutoTitle)([{ role: 'user', content: rawDescription }]);
-        const labels = Array.isArray(body.labels)
-            ? body.labels.filter((l) => typeof l === 'string')
-            : [];
-        // Priority: validate against the allowed set; default 'medium'. A
-        // status='todo' ticket MUST carry a non-null priority (see
-        // validatePriorityForStatus), so we never accept null here.
-        const priority = (0, ticket_store_1.isValidPriority)(body.priority) ? body.priority : 'medium';
-        const validationError = (0, ticket_store_1.validatePriorityForStatus)('todo', priority);
-        if (validationError) {
-            res.status(400).json({ error: validationError });
-            return;
-        }
-        const pendingSpecId = typeof body.pendingSpecId === 'string' ? body.pendingSpecId : null;
-        const shortSummary = deriveFallbackShortSummary(title, description);
-        try {
-            const filePath = ticketPath(req);
-            const now = new Date().toISOString();
-            let created;
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                const id = s.next_id++;
-                const ticket = {
-                    id,
-                    title,
-                    description,
-                    status: 'todo',
-                    priority,
-                    labels,
-                    assignee: null,
-                    prerequisites: [],
-                    metadata: {},
-                    comments: [],
-                    origin_conversation_id: null,
-                    is_epic: false,
-                    parent_epic_id: null,
-                    execution_order: null,
-                    short_summary: shortSummary,
-                    created_at: now,
-                    updated_at: now,
-                    created_by: 'hub', // legacy on-disk wire value (tickets.json, shared with specrails-core) — do not rename
-                    source: 'free-prompt',
-                };
-                s.tickets[String(id)] = ticket;
-                created = ticket;
-            });
-            const { broadcast, ticketWatcher, project } = ctx(req);
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            // Migrate attachments from pendingSpecId → real ticket id (mirrors the
-            // generate-spec / from-draft flow). Must complete before broadcasting so
-            // listeners see the populated attachments[].
-            if (pendingSpecId && created) {
-                try {
-                    const migrated = await attachment_manager_1.attachmentManager.renameTicketDir({
-                        slug: project.slug,
-                        pendingId: pendingSpecId,
-                        realTicketId: created.id,
-                        projectPath: project.path,
-                    });
-                    if (migrated.length > 0) {
-                        created.attachments = migrated;
-                    }
-                }
-                catch (err) {
-                    console.error('[project-router] from-prompt attachment migration error:', err);
-                }
-            }
-            const msg = {
-                type: 'ticket_created',
-                ticket: created,
-                projectId: project.id,
-                timestamp: new Date().toISOString(),
-            };
-            broadcast(msg);
-            res.status(201).json({ ticket: created, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] from-prompt create error:', err);
-            res.status(500).json({ error: 'Failed to create ticket' });
-        }
-    });
-    // POST /:projectId/tickets/:id/contract-refine — Manually re-fire refine
-    router.post('/:projectId/tickets/:id/contract-refine', async (req, res) => {
-        const ticketId = Number.parseInt(String(req.params.id ?? ''), 10);
-        if (!Number.isFinite(ticketId)) {
-            res.status(400).json({ error: 'invalid ticket id' });
-            return;
-        }
-        const { project, db, broadcast } = ctx(req);
-        if ((0, explore_contract_refine_1.isExploreContractRefineKillSwitchActive)()) {
-            res.status(409).json({ error: 'feature_disabled_by_env' });
-            return;
-        }
-        if (project.provider === 'codex') {
-            res.status(409).json({ error: 'contract_refine_unsupported_for_codex' });
-            return;
-        }
-        // Validate the ticket exists.
-        try {
-            const filePath = ticketPath(req);
-            const { withLock } = await Promise.resolve().then(() => __importStar(require('./ticket-store')));
-            const ticket = withLock(filePath, (s) => s.tickets[String(ticketId)]);
-            if (!ticket) {
-                res.status(404).json({ error: 'ticket not found' });
-                return;
-            }
-            if (!ticket.origin_conversation_id) {
-                res.status(409).json({ error: 'ticket has no origin conversation' });
-                return;
-            }
-            const convoId = ticket.origin_conversation_id;
-            res.status(202).json({ scheduled: true });
-            process.nextTick(() => {
-                void (0, contract_refine_runner_1.runContractRefine)({
-                    db,
-                    projectId: project.id,
-                    projectSlug: project.slug,
-                    projectPath: project.path,
-                    projectName: project.name,
-                    broadcast: broadcast,
-                    ignoreConversationScope: true,
-                }, convoId, ticketId).catch((err) => {
-                    console.error('[project-router] retry runContractRefine error:', err);
-                });
-            });
-        }
-        catch (err) {
-            console.error('[project-router] retry endpoint error:', err);
-            res.status(500).json({ error: 'Failed to schedule retry' });
-        }
-    });
-    // POST /:projectId/tickets/:id/smash — Decompose ticket into N children
-    router.post('/:projectId/tickets/:id/smash', async (req, res) => {
-        const ticketId = Number.parseInt(String(req.params.id ?? ''), 10);
-        if (!Number.isFinite(ticketId)) {
-            res.status(400).json({ error: 'invalid ticket id' });
-            return;
-        }
-        if ((0, explore_smash_1.isSpecsSmashKillSwitchActive)()) {
-            res.status(409).json({ error: 'feature_disabled_by_env', reason: 'disabled' });
-            return;
-        }
-        const { project, db, broadcast } = ctx(req);
-        try {
-            const filePath = ticketPath(req);
-            const { readStore } = await Promise.resolve().then(() => __importStar(require('./ticket-store')));
-            const store = readStore(filePath);
-            const gate = (0, smash_runner_1.checkSmashEligibility)(store, ticketId);
-            if (!gate.ok) {
-                const statusCode = gate.reason === 'ticket-not-found' ? 404 : 409;
-                res.status(statusCode).json({ error: 'ineligible', reason: gate.reason });
-                return;
-            }
-            const rawMode = typeof req.body?.mode === 'string' ? req.body.mode : 'simple';
-            const mode = rawMode === 'full' ? 'full' : 'simple';
-            const model = typeof req.body?.model === 'string' && req.body.model.length > 0 ? req.body.model : null;
-            res.status(202).json({ scheduled: true, mode });
-            process.nextTick(() => {
-                void (0, smash_runner_1.runSmash)({
-                    db,
-                    projectId: project.id,
-                    projectSlug: project.slug,
-                    projectPath: project.path,
-                    projectName: project.name,
-                    broadcast: broadcast,
-                    mode,
-                    model,
-                }, ticketId).catch((err) => {
-                    console.error('[project-router] runSmash error:', err);
-                });
-            });
-        }
-        catch (err) {
-            console.error('[project-router] smash endpoint error:', err);
-            res.status(500).json({ error: 'Failed to schedule SMASH' });
-        }
-    });
-    // POST /:projectId/tickets/:id/smash/undo — Reverse a prior SMASH
-    router.post('/:projectId/tickets/:id/smash/undo', async (req, res) => {
-        const ticketId = Number.parseInt(String(req.params.id ?? ''), 10);
-        if (!Number.isFinite(ticketId)) {
-            res.status(400).json({ error: 'invalid ticket id' });
-            return;
-        }
-        if ((0, explore_smash_1.isSpecsSmashKillSwitchActive)()) {
-            res.status(409).json({ error: 'feature_disabled_by_env', reason: 'disabled' });
-            return;
-        }
-        const smashedAt = typeof req.body?.smashedAt === 'string' ? req.body.smashedAt : null;
-        if (!smashedAt) {
-            res.status(400).json({ error: 'smashedAt timestamp required' });
-            return;
-        }
-        const { project, db, broadcast } = ctx(req);
-        try {
-            const result = await (0, smash_runner_1.runSmashUndo)({
-                db,
-                projectId: project.id,
-                projectSlug: project.slug,
-                projectPath: project.path,
-                projectName: project.name,
-                broadcast: broadcast,
-            }, ticketId, smashedAt);
-            if (!result.ok) {
-                const statusCode = result.reason === 'ticket-not-found' ? 404 : 409;
-                res.status(statusCode).json({ error: 'undo_failed', reason: result.reason });
-                return;
-            }
-            res.json({ ok: true, deletedChildren: result.deletedChildren });
-        }
-        catch (err) {
-            console.error('[project-router] smash/undo endpoint error:', err);
-            res.status(500).json({ error: 'Failed to undo SMASH' });
-        }
-    });
-    // DELETE /:projectId/tickets/:id/children — Delete all children of an épica
-    router.delete('/:projectId/tickets/:id/children', (req, res) => {
-        const ticketId = Number.parseInt(String(req.params.id ?? ''), 10);
-        if (!Number.isFinite(ticketId)) {
-            res.status(400).json({ error: 'invalid ticket id' });
-            return;
-        }
-        if ((0, explore_smash_1.isSpecsSmashKillSwitchActive)()) {
-            res.status(409).json({ error: 'feature_disabled_by_env', reason: 'disabled' });
-            return;
-        }
-        const { project, broadcast, ticketWatcher } = ctx(req);
-        try {
-            const filePath = ticketPath(req);
-            const result = (0, smash_runner_1.applyDeleteEpicChildren)(filePath, ticketId);
-            // Pass the real post-write revision (not 0) so the chokidar echo is
-            // suppressed; a hardcoded 0 never matches the on-disk revision and
-            // triggers a spurious full-refresh broadcast to every client.
-            ticketWatcher.notifyDesktopWrite(result.revision);
-            const now = new Date().toISOString();
-            for (const id of result.deletedChildren) {
-                broadcast({
-                    type: 'ticket_deleted',
-                    ticketId: id,
-                    projectId: project.id,
-                    timestamp: now,
-                });
-            }
-            res.json({ ok: true, deletedChildren: result.deletedChildren });
-        }
-        catch (err) {
-            console.error('[project-router] delete-children error:', err);
-            res.status(500).json({ error: 'Failed to delete children' });
-        }
-    });
-    // POST /:projectId/tickets — Create new ticket
-    router.post('/:projectId/tickets', (req, res) => {
-        const { title, description, status, priority, labels, assignee, prerequisites, metadata, source } = req.body ?? {};
-        if (!title || typeof title !== 'string' || !title.trim()) {
-            res.status(400).json({ error: 'title is required' });
-            return;
-        }
-        if (status !== undefined && !(0, ticket_store_1.isValidStatus)(status)) {
-            res.status(400).json({ error: 'status must be one of: draft, todo, in_progress, done, cancelled' });
-            return;
-        }
-        const finalStatus = (status ?? 'todo');
-        const finalPriority = priority === undefined ? (finalStatus === 'draft' ? null : 'medium') : (priority === null ? null : priority);
-        const priorityError = (0, ticket_store_1.validatePriorityForStatus)(finalStatus, finalPriority);
-        if (priorityError) {
-            res.status(400).json({ error: priorityError });
-            return;
-        }
-        try {
-            const filePath = ticketPath(req);
-            const now = new Date().toISOString();
-            let created;
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                const id = s.next_id++;
-                const ticket = {
-                    id,
-                    title: title.trim(),
-                    description: typeof description === 'string' ? description : '',
-                    status: finalStatus,
-                    priority: finalPriority,
-                    labels: Array.isArray(labels) ? labels.filter((l) => typeof l === 'string') : [],
-                    assignee: typeof assignee === 'string' ? assignee : null,
-                    prerequisites: Array.isArray(prerequisites) ? prerequisites.filter((p) => typeof p === 'number') : [],
-                    metadata: typeof metadata === 'object' && metadata !== null ? metadata : {},
-                    comments: [],
-                    origin_conversation_id: null,
-                    is_epic: false,
-                    parent_epic_id: null,
-                    execution_order: null,
-                    short_summary: null,
-                    created_at: now,
-                    updated_at: now,
-                    created_by: 'hub', // legacy on-disk wire value (tickets.json, shared with specrails-core) — do not rename
-                    source: source === 'product-backlog' || source === 'propose-spec' || source === 'manual' ? source : 'hub', // legacy on-disk wire value — do not rename
-                };
-                s.tickets[String(id)] = ticket;
-                created = ticket;
-            });
-            const { broadcast, ticketWatcher } = ctx(req);
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            const msg = { type: 'ticket_created', ticket: created, projectId: ctx(req).project.id, timestamp: new Date().toISOString() };
-            broadcast(msg);
-            res.status(201).json({ ticket: created, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] ticket create error:', err);
-            res.status(500).json({ error: 'Failed to create ticket' });
-        }
-    });
-    // PATCH /:projectId/tickets/:id — Update ticket fields
-    router.patch('/:projectId/tickets/:id', (req, res) => {
-        const ticketId = req.params.id;
-        if (!/^\d+$/.test(ticketId)) {
-            res.status(400).json({ error: 'Invalid ticket ID' });
-            return;
-        }
-        const { title, description, status, priority, labels, assignee, prerequisites, metadata, acceptanceCriteria, short_summary } = req.body ?? {};
-        if (status !== undefined && !(0, ticket_store_1.isValidStatus)(status)) {
-            res.status(400).json({ error: 'status must be one of: draft, todo, in_progress, done, cancelled' });
-            return;
-        }
-        if (priority !== undefined && priority !== null && !(0, ticket_store_1.isValidPriority)(priority)) {
-            res.status(400).json({ error: 'priority must be one of: critical, high, medium, low' });
-            return;
-        }
-        if (title !== undefined && (typeof title !== 'string' || !title.trim())) {
-            res.status(400).json({ error: 'title cannot be empty' });
-            return;
-        }
-        if (acceptanceCriteria !== undefined) {
-            if (!Array.isArray(acceptanceCriteria) || !acceptanceCriteria.every((c) => typeof c === 'string')) {
-                res.status(400).json({ error: 'acceptanceCriteria must be an array of strings' });
-                return;
-            }
-        }
-        try {
-            const filePath = ticketPath(req);
-            let updated;
-            let validationError = null;
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                const ticket = s.tickets[ticketId];
-                if (!ticket)
-                    return;
-                const nextStatus = (status ?? ticket.status);
-                const nextPriority = priority === undefined ? ticket.priority : (priority === null ? null : priority);
-                const err = (0, ticket_store_1.validatePriorityForStatus)(nextStatus, nextPriority);
-                if (err) {
-                    validationError = err;
-                    return;
-                }
-                if (title !== undefined)
-                    ticket.title = title.trim();
-                if (description !== undefined)
-                    ticket.description = description;
-                if (acceptanceCriteria !== undefined) {
-                    // Fold criteria into the description body under a `## Acceptance Criteria`
-                    // section, replacing any existing one. Use the just-set description if
-                    // present, otherwise the ticket's current description.
-                    ticket.description = formatDescriptionWithCriteria(ticket.description ?? '', acceptanceCriteria);
-                }
-                if (status !== undefined)
-                    ticket.status = status;
-                if (priority !== undefined)
-                    ticket.priority = nextPriority;
-                if (labels !== undefined && Array.isArray(labels))
-                    ticket.labels = labels.filter((l) => typeof l === 'string');
-                if (assignee !== undefined)
-                    ticket.assignee = typeof assignee === 'string' ? assignee : null;
-                if (prerequisites !== undefined && Array.isArray(prerequisites))
-                    ticket.prerequisites = prerequisites.filter((p) => typeof p === 'number');
-                if (metadata !== undefined && typeof metadata === 'object' && metadata !== null) {
-                    ticket.metadata = { ...ticket.metadata, ...metadata };
-                }
-                // Short summary: explicit non-empty overwrites; explicit null clears;
-                // omitted leaves the existing value untouched (preserves prior summary
-                // when AI Refine omits it for a partial edit).
-                if (short_summary === null) {
-                    ticket.short_summary = null;
-                }
-                else if (typeof short_summary === 'string') {
-                    ticket.short_summary = (0, ticket_store_1.clampShortSummary)(short_summary);
-                }
-                ticket.updated_at = new Date().toISOString();
-                updated = ticket;
-            });
-            if (validationError) {
-                res.status(400).json({ error: validationError });
-                return;
-            }
-            if (!updated) {
-                res.status(404).json({ error: 'Ticket not found' });
-                return;
-            }
-            const { broadcast, ticketWatcher } = ctx(req);
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            const msg = { type: 'ticket_updated', ticket: updated, projectId: ctx(req).project.id, timestamp: new Date().toISOString() };
-            broadcast(msg);
-            res.json({ ticket: updated, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] ticket update error:', err);
-            res.status(500).json({ error: 'Failed to update ticket' });
-        }
-    });
-    // POST /:projectId/tickets/:id/ai-edit — AI-powered description editing
-    const _aiEditProcesses = new Map();
-    router.post('/:projectId/tickets/:id/ai-edit', async (req, res) => {
-        const ticketId = req.params.id;
-        if (!/^\d+$/.test(ticketId)) {
-            res.status(400).json({ error: 'Invalid ticket ID' });
-            return;
-        }
-        const instructions = req.body?.instructions;
-        const currentDescription = req.body?.description;
-        const currentTitle = typeof req.body?.title === 'string' ? req.body.title : '';
-        if (!instructions?.trim()) {
-            res.status(400).json({ error: 'instructions is required' });
-            return;
-        }
-        if (!currentDescription) {
-            res.status(400).json({ error: 'description is required' });
-            return;
-        }
-        const attachmentIds = Array.isArray(req.body?.attachmentIds)
-            ? req.body.attachmentIds.filter((x) => typeof x === 'string')
-            : [];
-        const priorInstructions = Array.isArray(req.body?.priorInstructions)
-            ? req.body.priorInstructions.filter((x) => typeof x === 'string')
-            : [];
-        const priorProposalRaw = req.body?.priorProposal;
-        const priorProposal = typeof priorProposalRaw === 'string' && priorProposalRaw.length > 0 ? priorProposalRaw : null;
-        const isRefinement = priorProposal !== null;
-        const { project, broadcast } = ctx(req);
-        const provider = project.provider ?? 'claude';
-        const requestId = (0, ids_1.newId)();
-        const projectId = project.id;
-        // Build the focused pre-prompt
-        const baseRules = `- Output format MUST be exactly:\n` +
-            `    TITLE: <one-line spec title>\n` +
-            `    SHORT-SUMMARY: <one or two plain-language sentences, max 120 chars, summarising the spec for a dashboard postit. No markdown, no bullets.>\n` +
-            `    \n` +
-            `    <markdown description body>\n` +
-            `  The first line MUST start with "TITLE: " followed by the refined title.\n` +
-            `  The second line MUST start with "SHORT-SUMMARY: " followed by the summary.\n` +
-            `  Then exactly one blank line. Then the markdown description.\n` +
-            `- Keep the title concise (under 80 characters) and reflective of the latest description.\n` +
-            `  If the user's refinement does not affect the title's intent, you may keep it unchanged — but always emit the TITLE line.\n` +
-            `- The SHORT-SUMMARY line MUST always be present. If the user's refinement does not change what the spec is about, keep the previous summary verbatim. Never omit the line.\n` +
-            `- After the SHORT-SUMMARY line and blank line, output ONLY the modified description in markdown. No preamble, no explanation, no wrapping.\n` +
-            `- Preserve the existing markdown structure and section headings in the description.\n` +
-            `- If the user asks to add technical details, briefly check CLAUDE.md and the project directory structure (ls, not deep reads) to ground your edits.\n` +
-            `- Keep it concise and actionable.\n` +
-            `- Do NOT create files, tickets, or issues. Only output text.`;
-        const refinementRule = isRefinement
-            ? `\n- You are editing an in-progress draft, not the saved description. Apply the new refinement to the Latest Draft below.`
-            : '';
-        let systemPrompt = `You are a spec editor. You will receive a ticket title and description plus user instructions for how to modify them. ` +
-            `Your job is to produce an improved version of BOTH the title and the description.\n\n` +
-            `RULES:\n` +
-            `${baseRules}${refinementRule}`;
-        let userPrompt = isRefinement
-            ? `## Current Title (saved baseline)\n\n${currentTitle}\n\n` +
-                `## Current Description (saved baseline — do not rewrite)\n\n${currentDescription}\n\n` +
-                `## Prior Refinement Turns\n\n${priorInstructions.map((s, i) => `${i + 1}. ${s}`).join('\n')}\n\n` +
-                `## Latest Draft (from previous turn — apply the new refinement to this; the draft already includes a TITLE: line)\n\n${priorProposal}\n\n` +
-                `## New Refinement\n\n${instructions.trim()}\n\n` +
-                `Output the updated TITLE line followed by the updated description now.`
-            : `## Current Title\n\n${currentTitle}\n\n` +
-                `## Current Description\n\n${currentDescription}\n\n` +
-                `## User Instructions\n\n${instructions.trim()}\n\n` +
-                `Output the modified TITLE line followed by the modified description now.`;
-        let imageFlags = [];
-        if (attachmentIds.length > 0) {
-            try {
-                const extracted = await attachment_manager_1.attachmentManager.getClaudeArgs(project.slug, ticketId, attachmentIds);
-                imageFlags = extracted.imageFlags;
-                if (extracted.textBlocks.length > 0) {
-                    systemPrompt = `${systemPrompt}\n\n${attachment_manager_1.USER_ATTACHMENT_SYSTEM_NOTE}`;
-                    userPrompt = `${userPrompt}\n\n## Attached Files\n\n${extracted.textBlocks.join('\n\n')}`;
-                }
-            }
-            catch (err) {
-                console.error('[project-router] ai-edit attachment extraction error:', err);
-            }
-        }
-        let binary;
-        let args;
-        if (provider === 'codex') {
-            binary = 'codex';
-            // Use gpt-5.5 (default for Codex per CODEX_MODELS/PRESET_DEFAULTS in ModelSelector); never hardcode o4-mini
-            args = ['exec', `${systemPrompt}\n\n${userPrompt}`, '--model', 'gpt-5.5'];
-        }
-        else {
-            binary = 'claude';
-            args = [
-                '--dangerously-skip-permissions',
-                '--tools', 'default',
-                '--output-format', 'stream-json',
-                '--verbose',
-                '--max-turns', '4',
-                ...imageFlags,
-                '--system-prompt', systemPrompt,
-                '-p', userPrompt,
-            ];
-        }
-        // spawnAiCli reroutes multi-line argv values through stdin on Windows.
-        console.log(`[project-router] ai-edit spawn: ${binary} (cwd=${project.path}, requestId=${requestId})`);
-        const child = (0, cli_prompt_1.spawnAiCli)(binary, args, {
-            env: process.env,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            cwd: project.path,
-        });
-        _aiEditProcesses.set(requestId, child);
-        // Pipe stderr to server log so failures surface for debugging.
-        let aiEditStderrBuf = '';
-        /* c8 ignore start -- diagnostic-only; fires only when claude writes stderr */
-        child.stderr?.on('data', (chunk) => {
-            const s = chunk.toString();
-            aiEditStderrBuf += s;
-            console.error(`[project-router] ai-edit stderr (${requestId}): ${s.trimEnd()}`);
-        });
-        /* c8 ignore stop */
-        // Without this listener, ENOENT (binary missing on PATH) propagates as
-        // an unhandled 'error' event and crashes the entire app process.
-        /* c8 ignore start -- spawn-failure path; exercised manually, not in CI */
-        child.on('error', (err) => {
-            console.error(`[project-router] ai-edit spawn failed (${binary}): ${err.message}`);
-            _aiEditProcesses.delete(requestId);
-            const errMsg = {
-                type: 'ticket_ai_edit_error', projectId, ticketId: Number(ticketId),
-                requestId, error: `Failed to launch ${binary}: ${err.message}`,
-                timestamp: new Date().toISOString(),
-            };
-            broadcast(errMsg);
-        });
-        /* c8 ignore stop */
-        res.status(202).json({ requestId });
-        let buffer = '';
-        const stdoutReader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
-        stdoutReader.on('line', (line) => {
-            if (provider === 'codex') {
-                if (line) {
-                    buffer += line + '\n';
-                    const msg = {
-                        type: 'ticket_ai_edit_stream', projectId, ticketId: Number(ticketId),
-                        requestId, delta: line + '\n', timestamp: new Date().toISOString(),
-                    };
-                    broadcast(msg);
-                }
-            }
-            else {
-                let parsed = null;
-                try {
-                    parsed = JSON.parse(line);
-                }
-                catch { /* skip */ }
-                if (!parsed)
-                    return;
-                if (parsed.type === 'assistant') {
-                    const msg = parsed.message;
-                    const texts = (msg?.content ?? [])
-                        .filter((c) => c.type === 'text')
-                        .map((c) => c.text ?? '');
-                    const newText = texts.join('');
-                    if (newText) {
-                        buffer += newText;
-                        const wsMsg = {
-                            type: 'ticket_ai_edit_stream', projectId, ticketId: Number(ticketId),
-                            requestId, delta: newText, timestamp: new Date().toISOString(),
-                        };
-                        broadcast(wsMsg);
-                    }
-                }
-            }
-        });
-        child.on('close', (code) => {
-            _aiEditProcesses.delete(requestId);
-            if (code === 0 && buffer.trim()) {
-                const msg = {
-                    type: 'ticket_ai_edit_done', projectId, ticketId: Number(ticketId),
-                    requestId, fullText: buffer.trim(), timestamp: new Date().toISOString(),
-                };
-                broadcast(msg);
-            }
-            else {
-                const reason = code === 0 ? 'Empty response from AI' : `Process exited with code ${code}`;
-                console.error(`[project-router] ai-edit failed (${requestId}): ${reason}` +
-                    (aiEditStderrBuf.trim() ? `\n  stderr: ${aiEditStderrBuf.trim()}` : '') +
-                    (buffer.trim() ? `\n  stdout-buffer: ${buffer.trim().slice(0, 500)}` : ''));
-                const msg = {
-                    type: 'ticket_ai_edit_error', projectId, ticketId: Number(ticketId),
-                    requestId, error: reason,
-                    timestamp: new Date().toISOString(),
-                };
-                broadcast(msg);
-            }
-        });
-    });
-    router.delete('/:projectId/tickets/:id/ai-edit', (req, res) => {
-        const requestId = req.query.requestId;
-        if (!requestId) {
-            res.status(400).json({ error: 'requestId query param required' });
-            return;
-        }
-        const child = _aiEditProcesses.get(requestId);
-        if (!child?.pid) {
-            res.status(404).json({ error: 'No active AI edit for this request' });
-            return;
-        }
-        (0, tree_kill_1.default)(child.pid, 'SIGTERM');
-        _aiEditProcesses.delete(requestId);
-        res.json({ ok: true });
-    });
-    // DELETE /:projectId/tickets/:id — Delete ticket
-    router.delete('/:projectId/tickets/:id', (req, res) => {
-        const ticketId = req.params.id;
-        if (!/^\d+$/.test(ticketId)) {
-            res.status(400).json({ error: 'Invalid ticket ID' });
-            return;
-        }
-        try {
-            const filePath = ticketPath(req);
-            let found = false;
-            let orphanedConversationId = null;
-            const orphanedChildren = [];
-            const numericId = Number(ticketId);
-            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
-                const t = s.tickets[ticketId];
-                if (!t)
-                    return;
-                // If this is a draft and no other ticket references the same
-                // origin_conversation_id, mark it for cascade delete.
-                if (t.status === 'draft' && t.origin_conversation_id) {
-                    const otherRefs = Object.values(s.tickets).some((other) => other.id !== t.id && other.origin_conversation_id === t.origin_conversation_id);
-                    if (!otherRefs)
-                        orphanedConversationId = t.origin_conversation_id;
-                }
-                // SMASH: when deleting an épica, orphan its children (set
-                // parent_epic_id/execution_order to null) rather than cascade-delete.
-                if (t.is_epic) {
-                    const now = new Date().toISOString();
-                    for (const childId of Object.keys(s.tickets)) {
-                        const child = s.tickets[childId];
-                        if (child.parent_epic_id === numericId) {
-                            child.parent_epic_id = null;
-                            child.execution_order = null;
-                            child.updated_at = now;
-                            orphanedChildren.push(child);
-                        }
-                    }
-                }
-                delete s.tickets[ticketId];
-                found = true;
-            });
-            if (!found) {
-                res.status(404).json({ error: 'Ticket not found' });
-                return;
-            }
-            const { broadcast, ticketWatcher, db, chatManager } = ctx(req);
-            ticketWatcher.notifyDesktopWrite(store.revision);
-            // Cascade-delete attachments for this ticket
-            attachment_manager_1.attachmentManager.deleteAll(ctx(req).project.slug, ticketId).catch((e) => {
-                console.error('[project-router] attachment cascade delete failed:', e);
-            });
-            // Cascade-delete the orphaned Explore conversation, if any.
-            if (orphanedConversationId) {
-                try {
-                    const conv = (0, db_1.getConversation)(db, orphanedConversationId);
-                    if (conv && conv.kind === 'explore') {
-                        (0, db_1.deleteConversation)(db, orphanedConversationId);
-                        chatManager?.forgetSpecDraft(orphanedConversationId);
-                        chatManager?.forgetExploreLifecycle(orphanedConversationId);
-                    }
-                }
-                catch (err) {
-                    console.error('[project-router] orphan conversation cleanup failed:', err);
-                }
-            }
-            // Broadcast ticket_updated for each orphaned child so observers see them
-            // as regular tickets (no longer attached to the deleted épica).
-            for (const child of orphanedChildren) {
-                broadcast({
-                    type: 'ticket_updated',
-                    ticket: child,
-                    projectId: ctx(req).project.id,
-                    timestamp: new Date().toISOString(),
-                });
-            }
-            const msg = { type: 'ticket_deleted', ticketId: Number(ticketId), projectId: ctx(req).project.id, timestamp: new Date().toISOString() };
-            broadcast(msg);
-            res.json({ ok: true, revision: store.revision });
-        }
-        catch (err) {
-            console.error('[project-router] ticket delete error:', err);
-            res.status(500).json({ error: 'Failed to delete ticket' });
-        }
-    });
-    // ─── Ticket attachments ─────────────────────────────────────────────────────
-    const attachmentUpload = (0, multer_1.default)({
-        storage: multer_1.default.memoryStorage(),
-        limits: { fileSize: 25 * 1024 * 1024 }, // 25 MB per file
-        fileFilter: (_req, file, cb) => {
-            if ((0, attachment_manager_1.isSupportedUploadedFile)({ mimetype: file.mimetype, originalname: file.originalname }))
-                cb(null, true);
-            else
-                cb(null, false);
-        },
-    });
-    /** A ticket key is either a numeric real id or a UUID (pendingSpecId). */
-    function parseTicketKey(raw) {
-        if (/^\d+$/.test(raw))
-            return { key: raw, isPending: false };
-        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(raw)) {
-            return { key: raw, isPending: true };
-        }
-        return null;
-    }
-    router.post('/:projectId/tickets/:ticketId/attachments', attachmentUpload.single('file'), async (req, res) => {
-        const parsed = parseTicketKey(req.params.ticketId);
-        if (!parsed) {
-            res.status(400).json({ error: 'Invalid ticketId (must be numeric id or UUID)' });
-            return;
-        }
-        const file = req.file;
-        if (!file) {
-            res.status(400).json({ error: 'No file uploaded or file type unsupported' });
-            return;
-        }
-        if (!parsed.isPending) {
-            const store = (0, ticket_store_1.readStore)(ticketPath(req));
-            if (!store.tickets[parsed.key]) {
-                res.status(404).json({ error: 'Ticket not found' });
-                return;
-            }
-        }
-        try {
-            const attachment = await attachment_manager_1.attachmentManager.upload({
-                slug: ctx(req).project.slug,
-                ticketKey: parsed.key,
-                projectPath: parsed.isPending ? null : ctx(req).project.path,
-                file: {
-                    buffer: file.buffer,
-                    originalname: file.originalname,
-                    mimetype: file.mimetype,
-                    size: file.size,
-                },
-            });
-            res.status(201).json({ attachment });
-        }
-        catch (err) {
-            const status = err.status ?? 500;
-            const message = err instanceof Error ? err.message : 'Upload failed';
-            console.error('[project-router] attachment upload error:', err);
-            res.status(status).json({ error: message });
-        }
-    });
-    router.get('/:projectId/tickets/:ticketId/attachments', (req, res) => {
-        const parsed = parseTicketKey(req.params.ticketId);
-        if (!parsed) {
-            res.status(400).json({ error: 'Invalid ticketId' });
-            return;
-        }
-        const attachments = attachment_manager_1.attachmentManager.list(ctx(req).project.slug, parsed.key);
-        res.json({ attachments });
-    });
-    router.get('/:projectId/tickets/:ticketId/attachments/:attachmentId', (req, res) => {
-        const parsed = parseTicketKey(req.params.ticketId);
-        if (!parsed) {
-            res.status(400).json({ error: 'Invalid ticketId' });
-            return;
-        }
-        const attachmentId = req.params.attachmentId;
-        const slug = ctx(req).project.slug;
-        const meta = attachment_manager_1.attachmentManager.getMeta(slug, parsed.key, attachmentId);
-        const abs = meta ? attachment_manager_1.attachmentManager.getFilePath(slug, parsed.key, attachmentId) : null;
-        if (!meta || !abs) {
-            res.status(404).json({ error: 'Attachment not found' });
-            return;
-        }
-        res.setHeader('Content-Type', meta.mimeType);
-        // Strip quotes AND CR/LF: a newline in the stored (raw) original filename
-        // makes Node's setHeader throw ERR_INVALID_CHAR after Content-Type is
-        // already set, 500-ing the download. Also emit an RFC 5987 filename* so
-        // non-ASCII names survive.
-        const asciiName = meta.filename.replace(/[\r\n"]/g, '_');
-        res.setHeader('Content-Disposition', `inline; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(meta.filename)}`);
-        fs_1.default.createReadStream(abs).pipe(res);
-    });
-    router.delete('/:projectId/tickets/:ticketId/attachments/:attachmentId', async (req, res) => {
-        const parsed = parseTicketKey(req.params.ticketId);
-        if (!parsed) {
-            res.status(400).json({ error: 'Invalid ticketId' });
-            return;
-        }
-        const attachmentId = req.params.attachmentId;
-        try {
-            const ok = await attachment_manager_1.attachmentManager.delete({
-                slug: ctx(req).project.slug,
-                ticketKey: parsed.key,
-                attachmentId,
-                projectPath: parsed.isPending ? null : ctx(req).project.path,
-            });
-            if (!ok) {
-                res.status(404).json({ error: 'Attachment not found' });
-                return;
-            }
-            res.status(204).end();
-        }
-        catch (err) {
-            console.error('[project-router] attachment delete error:', err);
-            res.status(500).json({ error: 'Delete failed' });
-        }
-    });
-    router.delete('/:projectId/tickets/:ticketId/attachments', async (req, res) => {
-        const parsed = parseTicketKey(req.params.ticketId);
-        if (!parsed) {
-            res.status(400).json({ error: 'Invalid ticketId' });
-            return;
-        }
-        try {
-            await attachment_manager_1.attachmentManager.deleteAll(ctx(req).project.slug, parsed.key);
-            res.status(204).end();
-        }
-        catch (err) {
-            console.error('[project-router] attachment bulk delete error:', err);
-            res.status(500).json({ error: 'Bulk delete failed' });
-        }
-    });
-    // ─── Terminals ───────────────────────────────────────────────────────────────
-    function requireTerminalsEnabled(_req, res, next) {
-        if (!TERMINAL_PANEL_ENABLED) {
-            res.status(404).json({ error: 'Terminal panel disabled' });
-            return;
-        }
-        next();
-    }
-    router.get('/:projectId/terminals', requireTerminalsEnabled, (req, res) => {
-        const projectId = ctx(req).project.id;
-        const sessions = (0, terminal_manager_1.getTerminalManager)().listForProject(projectId);
-        res.json({ sessions, limit: terminal_manager_1.TERMINAL_MAX_PER_PROJECT });
-    });
-    router.post('/:projectId/terminals', requireTerminalsEnabled, (req, res) => {
-        const { cols, rows, name } = req.body ?? {};
-        const projectCtx = ctx(req);
-        const project = projectCtx.project;
-        const settings = (0, terminal_settings_1.resolveTerminalSettings)(registry.desktopDb, projectCtx.db);
-        try {
-            const meta = (0, terminal_manager_1.getTerminalManager)().create(project.id, {
-                cwd: project.path,
-                cols: typeof cols === 'number' ? cols : undefined,
-                rows: typeof rows === 'number' ? rows : undefined,
-                name: typeof name === 'string' ? name : undefined,
-                projectSlug: project.slug,
-                projectDb: projectCtx.db,
-                settings,
-            });
-            res.status(201).json({ session: meta });
-        }
-        catch (err) {
-            if (err instanceof terminal_manager_1.TerminalLimitExceededError) {
-                res.status(409).json({ error: 'terminal_limit_exceeded', limit: terminal_manager_1.TERMINAL_MAX_PER_PROJECT });
-                return;
-            }
-            if (err instanceof terminal_manager_1.TerminalNameInvalidError) {
-                res.status(400).json({ error: 'terminal_name_invalid' });
-                return;
-            }
-            if (err instanceof terminal_manager_1.TerminalSpawnError) {
-                // The shell failed to spawn (commonly the host running out of file
-                // descriptors). Surface a concrete, actionable reason — a bare 500 hid
-                // this and made the "+" button look like it did nothing.
-                console.error('[project-router] terminal spawn failed:', err.reason, err.message);
-                res.status(502).json({ error: 'terminal_spawn_failed', reason: err.reason });
-                return;
-            }
-            console.error('[project-router] terminal create error:', err);
-            res.status(500).json({ error: 'Failed to create terminal' });
-        }
-    });
-    router.patch('/:projectId/terminals/:id', requireTerminalsEnabled, (req, res) => {
-        const { name } = req.body ?? {};
-        if (typeof name !== 'string') {
-            res.status(400).json({ error: 'name is required' });
-            return;
-        }
-        const projectId = ctx(req).project.id;
-        try {
-            const meta = (0, terminal_manager_1.getTerminalManager)().rename(projectId, req.params.id, name);
-            res.json({ session: meta });
-        }
-        catch (err) {
-            if (err instanceof terminal_manager_1.TerminalNotFoundError) {
-                res.status(404).json({ error: 'terminal_not_found' });
-                return;
-            }
-            if (err instanceof terminal_manager_1.TerminalNameInvalidError) {
-                res.status(400).json({ error: 'terminal_name_invalid' });
-                return;
-            }
-            console.error('[project-router] terminal rename error:', err);
-            res.status(500).json({ error: 'Failed to rename terminal' });
-        }
-    });
-    router.delete('/:projectId/terminals/:id', requireTerminalsEnabled, (req, res) => {
-        const projectId = ctx(req).project.id;
-        const ok = (0, terminal_manager_1.getTerminalManager)().kill(projectId, req.params.id);
-        if (!ok) {
-            res.status(404).json({ error: 'terminal_not_found' });
-            return;
-        }
-        res.json({ ok: true });
-    });
-    // ─── Embedded browser ("Add Spec from browser") ──────────────────────────────
-    function requireBrowserCaptureEnabled(_req, res, next) {
-        if (!(0, feature_flags_1.isBrowserCaptureEnabled)()) {
-            res.status(404).json({ error: 'browser_capture_disabled' });
-            return;
-        }
-        next();
-    }
-    function parseRect(raw) {
-        if (!raw || typeof raw !== 'object')
-            return null;
-        const r = raw;
-        const nums = [r.x, r.y, r.width, r.height];
-        if (!nums.every((n) => typeof n === 'number' && Number.isFinite(n)))
-            return null;
-        const x = r.x, y = r.y, width = r.width, height = r.height;
-        if (width <= 0 || height <= 0)
-            return null;
-        if (x < 0 || y < 0)
-            return null;
-        // Upper bound guards against an over-read request far past any real viewport.
-        if (x + width > 20000 || y + height > 20000)
-            return null;
-        return { x, y, width, height };
-    }
-    // pendingSpecId becomes a filesystem path segment inside attachmentManager
-    // (~/.specrails/projects/<slug>/attachments/<pendingSpecId>/). Reject anything
-    // that isn't a safe opaque token so a crafted value can't traverse the tree.
-    const SAFE_PENDING_ID = /^[A-Za-z0-9_-]{1,128}$/;
-    router.get('/:projectId/browser/sessions', requireBrowserCaptureEnabled, (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        res.json({ sessions: mgr.listSessions(), lastUrl: mgr.getLastUrl() });
-    });
-    router.post('/:projectId/browser/sessions', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const initialUrl = typeof req.body?.initialUrl === 'string' ? req.body.initialUrl : undefined;
-        try {
-            const session = await mgr.create({ initialUrl });
-            res.status(201).json({ session });
-        }
-        catch (err) {
-            if (err instanceof browser_capture_types_1.BrowserLimitExceededError) {
-                res.status(409).json({ error: 'browser_session_limit_exceeded', limit: err.limit });
-                return;
-            }
-            if (err instanceof browser_capture_types_1.BrowserLaunchError) {
-                console.error('[project-router] browser launch failed:', err.cause?.message ?? err.message);
-                res.status(502).json({ error: 'browser_launch_failed' });
-                return;
-            }
-            console.error('[project-router] browser session create error:', err);
-            res.status(500).json({ error: 'Failed to create browser session' });
-        }
-    });
-    router.post('/:projectId/browser/sessions/:id/navigate', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const action = req.body?.action ?? 'goto';
-        const validActions = new Set(['goto', 'back', 'forward', 'reload']);
-        if (!validActions.has(action)) {
-            res.status(400).json({ error: 'action must be one of: goto, back, forward, reload' });
-            return;
-        }
-        let url;
-        if (action === 'goto') {
-            url = typeof req.body?.url === 'string' ? req.body.url.trim() : '';
-            if (!url) {
-                res.status(400).json({ error: 'url is required for goto' });
-                return;
-            }
-            // Only allow web schemes (or bare hosts the manager will https-prefix).
-            // Blocks file://, data:, javascript: etc. from reaching the embedded browser.
-            if (/^[a-z][a-z0-9+.-]*:/i.test(url) && !/^https?:\/\//i.test(url)) {
-                res.status(400).json({ error: 'only http(s) URLs are allowed' });
-                return;
-            }
-        }
-        try {
-            const result = await mgr.navigate(req.params.id, action, url);
-            if (!result) {
-                res.status(404).json({ error: 'browser_session_not_found' });
-                return;
-            }
-            res.json(result);
-        }
-        catch (err) {
-            console.error('[project-router] browser navigate error:', err);
-            res.status(500).json({ error: 'Failed to navigate' });
-        }
-    });
-    router.post('/:projectId/browser/sessions/:id/capture', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const rect = parseRect(req.body?.rect);
-        if (!rect) {
-            res.status(400).json({ error: 'rect {x,y,width,height} with positive size is required' });
-            return;
-        }
-        const pendingSpecId = typeof req.body?.pendingSpecId === 'string' ? req.body.pendingSpecId.trim() : '';
-        if (!pendingSpecId) {
-            res.status(400).json({ error: 'pendingSpecId is required' });
-            return;
-        }
-        if (!SAFE_PENDING_ID.test(pendingSpecId)) {
-            res.status(400).json({ error: 'pendingSpecId has an invalid format' });
-            return;
-        }
-        const captureNetwork = req.body?.captureNetwork !== false;
-        try {
-            const result = await mgr.capture(req.params.id, rect, pendingSpecId, { captureNetwork });
-            if (!result) {
-                res.status(404).json({ error: 'browser_session_not_found' });
-                return;
-            }
-            res.json(result);
-        }
-        catch (err) {
-            console.error('[project-router] browser capture error:', err);
-            res.status(500).json({ error: 'Failed to capture' });
-        }
-    });
-    router.post('/:projectId/browser/sessions/:id/capture-breakpoints', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const rect = parseRect(req.body?.rect);
-        if (!rect) {
-            res.status(400).json({ error: 'rect {x,y,width,height} with positive size is required' });
-            return;
-        }
-        const pendingSpecId = typeof req.body?.pendingSpecId === 'string' ? req.body.pendingSpecId.trim() : '';
-        if (!pendingSpecId || !SAFE_PENDING_ID.test(pendingSpecId)) {
-            res.status(400).json({ error: 'pendingSpecId is required and must be well-formed' });
-            return;
-        }
-        // Validate the per-breakpoint viewport dims (client-supplied; single source).
-        const rawDims = req.body?.breakpoints;
-        const dims = {};
-        if (rawDims && typeof rawDims === 'object') {
-            for (const [k, v] of Object.entries(rawDims)) {
-                if (Object.keys(dims).length >= 4)
-                    break;
-                if (!/^[a-z0-9_-]{1,20}$/i.test(k))
-                    continue;
-                const d = v;
-                const w = Math.round(Number(d?.width));
-                const h = Math.round(Number(d?.height));
-                if (Number.isFinite(w) && Number.isFinite(h) && w >= 1 && h >= 1 && w <= 4000 && h <= 4000) {
-                    dims[k] = { width: w, height: h };
-                }
-            }
-        }
-        if (Object.keys(dims).length === 0) {
-            res.status(400).json({ error: 'breakpoints {name:{width,height}} is required' });
-            return;
-        }
-        const a = req.body?.anchorPoint;
-        const anchorPoint = a && typeof a.x === 'number' && typeof a.y === 'number'
-            ? { x: a.x, y: a.y }
-            : { x: rect.x + rect.width / 2, y: rect.y + rect.height / 2 };
-        try {
-            const result = await mgr.captureBreakpoints(req.params.id, rect, anchorPoint, pendingSpecId, dims);
-            if (!result) {
-                res.status(404).json({ error: 'browser_session_not_found' });
-                return;
-            }
-            res.json(result);
-        }
-        catch (err) {
-            console.error('[project-router] browser capture-breakpoints error:', err);
-            res.status(500).json({ error: 'Failed to capture' });
-        }
-    });
-    router.post('/:projectId/browser/sessions/:id/element', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const selector = typeof req.body?.selector === 'string' ? req.body.selector : '';
-        const direction = req.body?.direction;
-        if (!selector || (direction !== 'parent' && direction !== 'child' && direction !== 'self')) {
-            res.status(400).json({ error: 'selector and direction (parent|child|self) are required' });
-            return;
-        }
-        try {
-            // probe may be null (can't step further / element gone) — still 200.
-            const probe = await mgr.navigateElement(req.params.id, selector.slice(0, 4000), direction);
-            res.json({ probe });
-        }
-        catch (err) {
-            console.error('[project-router] browser element navigate error:', err);
-            res.status(500).json({ error: 'Failed to resolve element' });
-        }
-    });
-    router.post('/:projectId/browser/sessions/:id/clipboard', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const action = req.body?.action;
-        if (action !== 'copy' && action !== 'paste' && action !== 'cut') {
-            res.status(400).json({ error: 'action must be copy | paste | cut' });
-            return;
-        }
-        const text = typeof req.body?.text === 'string' ? req.body.text.slice(0, 100_000) : undefined;
-        try {
-            const out = await mgr.clipboard(req.params.id, action, text);
-            if (!out) {
-                res.status(404).json({ error: 'browser_session_not_found' });
-                return;
-            }
-            res.json(out);
-        }
-        catch (err) {
-            console.error('[project-router] browser clipboard error:', err);
-            res.status(500).json({ error: 'Failed clipboard op' });
-        }
-    });
-    router.delete('/:projectId/browser/sessions/:id', requireBrowserCaptureEnabled, async (req, res) => {
-        const mgr = ctx(req).browserCaptureManager;
-        const ok = await mgr.kill(req.params.id);
-        if (!ok) {
-            res.status(404).json({ error: 'browser_session_not_found' });
-            return;
-        }
-        res.json({ ok: true });
-    });
-    // ─── Project settings (pipeline telemetry) ───────────────────────────────────
-    router.get('/:projectId/settings', (req, res) => {
-        const settings = (0, db_1.getProjectSettings)(ctx(req).db);
-        res.json(settings);
-    });
-    // ─── Per-project Quick mode Contract Refine last-used value ─────────────────
-    router.get('/:projectId/add-spec-quick-contract-refine-last', (req, res) => {
-        res.json({
-            enabled: (0, db_1.getQuickContractRefineLast)(ctx(req).db),
-            configured: (0, db_1.hasQuickContractRefineLast)(ctx(req).db),
-        });
-    });
-    router.patch('/:projectId/add-spec-quick-contract-refine-last', (req, res) => {
-        const enabled = req.body?.enabled;
-        if (typeof enabled !== 'boolean') {
-            res.status(400).json({ error: 'enabled must be a boolean' });
-            return;
-        }
-        (0, db_1.setQuickContractRefineLast)(ctx(req).db, enabled);
-        res.json({ enabled: (0, db_1.getQuickContractRefineLast)(ctx(req).db) });
-    });
-    // ─── Add Spec context scope ────────────────────────────────────────────────
-    router.get('/:projectId/context-budget', (req, res) => {
-        const { project } = ctx(req);
-        try {
-            const budget = (0, context_budget_1.getContextBudget)(project.id, project.path);
-            res.json(budget);
-        }
-        catch (err) {
-            console.error('[project-router] context-budget failed:', err);
-            res.status(500).json({ error: 'failed to compute context budget' });
-        }
-    });
-    router.get('/:projectId/context-scope-last', (req, res) => {
-        const scope = (0, context_scope_1.getLastContextScope)(ctx(req).db, 'explore');
-        res.json({ scope });
-    });
-    router.patch('/:projectId/context-scope-last', (req, res) => {
-        const body = req.body;
-        if (!body || typeof body !== 'object') {
-            res.status(400).json({ error: 'body must be an object' });
-            return;
-        }
-        // Validate booleans-only for any provided key.
-        for (const key of ['specrails', 'openspec', 'full', 'mcp', 'contractRefine', 'userMcp']) {
-            if (body[key] !== undefined && typeof body[key] !== 'boolean') {
-                res.status(400).json({ error: `${key} must be a boolean` });
-                return;
-            }
-        }
-        const current = (0, context_scope_1.getLastContextScope)(ctx(req).db, 'explore');
-        const merged = (0, context_scope_1.normalizeContextScope)({ ...current, ...body }, current);
-        (0, context_scope_1.setLastContextScope)(ctx(req).db, merged);
-        res.json({ scope: merged });
-    });
-    router.patch('/:projectId/settings', (req, res) => {
-        const { pipelineTelemetryEnabled, orchestratorModel, prePrompt, ultraPrePrompt } = req.body ?? {};
-        const patch = {};
-        if (pipelineTelemetryEnabled !== undefined) {
-            patch.pipelineTelemetryEnabled = Boolean(pipelineTelemetryEnabled);
-        }
-        const VALID_MODELS = ['sonnet', 'opus', 'haiku'];
-        if (orchestratorModel !== undefined) {
-            if (typeof orchestratorModel !== 'string' || !VALID_MODELS.includes(orchestratorModel)) {
-                res.status(400).json({ error: `orchestratorModel must be one of: ${VALID_MODELS.join(', ')}` });
-                return;
-            }
-            patch.orchestratorModel = orchestratorModel;
-        }
-        if (prePrompt !== undefined) {
-            if (typeof prePrompt !== 'string') {
-                res.status(400).json({ error: 'prePrompt must be a string' });
-                return;
-            }
-            patch.prePrompt = prePrompt;
-        }
-        if (ultraPrePrompt !== undefined) {
-            if (typeof ultraPrePrompt !== 'string') {
-                res.status(400).json({ error: 'ultraPrePrompt must be a string' });
-                return;
-            }
-            patch.ultraPrePrompt = ultraPrePrompt;
-        }
-        try {
-            (0, db_1.updateProjectSettings)(ctx(req).db, patch);
-            res.json({ ok: true, settings: (0, db_1.getProjectSettings)(ctx(req).db) });
-        }
-        catch (err) {
-            console.error('[project-router] settings patch error:', err);
-            res.status(500).json({ error: 'Failed to update settings' });
-        }
-    });
-    // ─── Agent models ────────────────────────────────────────────────────────────
-    router.get('/:projectId/agent-models', (req, res) => {
-        const { project } = ctx(req);
-        const agents = readAgentModels(project.path);
-        res.json({ agents });
-    });
-    router.patch('/:projectId/agent-models', (req, res) => {
-        const { project } = ctx(req);
-        const { defaultModel, overrides } = req.body ?? {};
-        // Validate defaultModel if provided
-        if (defaultModel !== undefined) {
-            if (typeof defaultModel !== 'string' || !VALID_MODEL_ALIASES.includes(defaultModel)) {
-                res.status(400).json({ error: `Invalid model alias. Must be one of: ${VALID_MODEL_ALIASES.join(', ')}` });
-                return;
-            }
-        }
-        // Validate overrides map if provided
-        if (overrides !== undefined) {
-            if (typeof overrides !== 'object' || Array.isArray(overrides) || overrides === null) {
-                res.status(400).json({ error: 'overrides must be an object' });
-                return;
-            }
-            for (const [agentName, modelValue] of Object.entries(overrides)) {
-                if (typeof modelValue !== 'string' || !VALID_MODEL_ALIASES.includes(modelValue)) {
-                    res.status(400).json({ error: `Invalid model alias for agent "${agentName}". Must be one of: ${VALID_MODEL_ALIASES.join(', ')}` });
-                    return;
-                }
-            }
-        }
-        const configDir = path_1.default.join(project.path, '.specrails');
-        const configPath = path_1.default.join(configDir, 'install-config.yaml');
-        // Read existing config or build default shape
-        let existingConfig = {
-            version: 1,
-            provider: 'claude',
-            tier: 'quick',
-            agents: { selected: [], excluded: [] },
-            models: { preset: 'balanced', defaults: { model: 'sonnet' }, overrides: {} },
-            agent_teams: false,
-        };
-        if (fs_1.default.existsSync(configPath)) {
-            try {
-                const text = fs_1.default.readFileSync(configPath, 'utf-8');
-                // Parse fields we care about from the existing config text
-                const versionMatch = text.match(/^version:\s*(\d+)/m);
-                const providerMatch = text.match(/^provider:\s*(\S+)/m);
-                const tierMatch = text.match(/^tier:\s*(\S+)/m);
-                const presetMatch = text.match(/preset:\s*(\S+)/);
-                const agentTeamsMatch = text.match(/^agent_teams:\s*(\S+)/m);
-                // Parse selected agents list
-                const selectedMatch = text.match(/selected:\s*\[([^\]]*)\]/);
-                const excludedMatch = text.match(/excluded:\s*\[([^\]]*)\]/);
-                const parsedSelected = selectedMatch
-                    ? selectedMatch[1].split(',').map(s => s.trim()).filter(Boolean)
-                    : [];
-                const parsedExcluded = excludedMatch
-                    ? excludedMatch[1].split(',').map(s => s.trim()).filter(Boolean)
-                    : [];
-                // Parse existing overrides to merge
-                const existingOverrides = {};
-                const overridesBlockMatch = text.match(/overrides:([\s\S]*?)(?:\n\S|$)/);
-                if (overridesBlockMatch) {
-                    const block = overridesBlockMatch[1];
-                    const overrideLines = block.match(/^ {2,}(\S+):\s*(\S+)/gm) ?? [];
-                    for (const line of overrideLines) {
-                        const m = line.match(/^\s+(\S+):\s*(\S+)/);
-                        if (m)
-                            existingOverrides[m[1]] = m[2];
-                    }
-                }
-                existingConfig = {
-                    version: versionMatch ? parseInt(versionMatch[1], 10) : 1,
-                    provider: providerMatch ? providerMatch[1] : 'claude',
-                    tier: tierMatch ? tierMatch[1] : 'quick',
-                    agents: { selected: parsedSelected, excluded: parsedExcluded },
-                    models: {
-                        preset: presetMatch ? presetMatch[1] : 'balanced',
-                        defaults: { model: 'sonnet' },
-                        overrides: existingOverrides,
-                    },
-                    agent_teams: agentTeamsMatch ? agentTeamsMatch[1] === 'true' : false,
-                };
-            }
-            catch {
-                // use defaults
-            }
-        }
-        // Merge new values into config
-        const mergedModels = existingConfig.models;
-        if (defaultModel !== undefined) {
-            mergedModels.defaults = { model: defaultModel };
-        }
-        if (overrides !== undefined) {
-            mergedModels.overrides = overrides;
-        }
-        existingConfig.models = mergedModels;
-        try {
-            fs_1.default.mkdirSync(configDir, { recursive: true });
-            const yaml = serializeInstallConfigYaml(existingConfig);
-            fs_1.default.writeFileSync(configPath, yaml, 'utf-8');
-            applyModelConfig(project.path);
-            const agents = readAgentModels(project.path);
-            res.json({ agents });
-        }
-        catch (err) {
-            console.error('[project-router] agent-models patch error:', err);
-            res.status(500).json({ error: `Failed to apply model config: ${err}` });
-        }
-    });
-    // ─── Diagnostic export ───────────────────────────────────────────────────────
-    router.get('/:projectId/jobs/:jobId/diagnostic', async (req, res) => {
-        const { db } = ctx(req);
-        const jobId = req.params.jobId;
-        const blob = (0, db_1.getTelemetryBlob)(db, jobId);
-        if (!blob) {
-            res.status(404).json({ error: 'No telemetry data for this job' });
-            return;
-        }
-        if (blob.state === 'expired') {
-            res.status(410).json({ error: 'Telemetry data has been expired and is no longer available' });
-            return;
-        }
-        const job = (0, db_1.getJob)(db, jobId);
-        if (!job) {
-            res.status(404).json({ error: 'Job not found' });
-            return;
-        }
-        const summaries = (0, db_1.getTelemetrySummaries)(db, jobId);
-        const events = (0, db_1.getJobEvents)(db, jobId);
-        try {
-            const dateStr = new Date().toISOString().slice(0, 10);
-            const filename = `specrails-diagnostic-${jobId}-${dateStr}.zip`;
-            res.setHeader('Content-Type', 'application/zip');
-            res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
-            const profileRow = db
-                .prepare(`SELECT profile_name, profile_json FROM job_profiles WHERE job_id = ?`)
-                .get(jobId);
-            const { homeJobSnapshotPath } = require('./plugins/paths');
-            const pluginSnap = homeJobSnapshotPath(req.projectCtx.project.slug, jobId);
-            await (0, telemetry_export_1.createDiagnosticZip)(res, {
-                job,
-                blob,
-                summaries,
-                events,
-                profile: profileRow ? { name: profileRow.profile_name, json: profileRow.profile_json } : null,
-                pluginSnapshotPath: pluginSnap,
-            });
-        }
-        catch (err) {
-            if (!res.headersSent) {
-                console.error('[project-router] diagnostic export error:', err);
-                res.status(500).json({ error: 'Failed to create diagnostic export' });
-            }
-        }
-    });
-    // ─── Terminal command marks ────────────────────────────────────────────────
-    // GET /api/projects/:projectId/terminals/:id/marks?limit=&before=
-    router.get('/:projectId/terminals/:id/marks', (req, res) => {
-        const projectCtx = ctx(req);
-        const sessionId = req.params.id;
-        const limit = parseInt(req.query.limit ?? '100', 10);
-        const before = req.query.before ? parseInt(req.query.before, 10) : undefined;
-        const marks = (0, terminal_marks_store_1.listMarks)(projectCtx.db, sessionId, {
-            limit: Number.isFinite(limit) ? limit : 100,
-            before: typeof before === 'number' && Number.isFinite(before) ? before : undefined,
-        });
-        res.json({ marks });
-    });
-    // ─── Terminal settings (per-project override layer) ────────────────────────
-    // GET /api/projects/:projectId/terminal-settings — returns { resolved, override, desktopDefaults }
-    router.get('/:projectId/terminal-settings', (req, res) => {
-        const projectCtx = ctx(req);
-        const desktopDefaults = (0, terminal_settings_1.getDesktopTerminalSettings)(registry.desktopDb);
-        const override = (0, terminal_settings_1.getProjectOverride)(projectCtx.db);
-        const resolved = (0, terminal_settings_1.resolveTerminalSettings)(registry.desktopDb, projectCtx.db);
-        res.json({ resolved, override, desktopDefaults });
-    });
-    // PATCH /api/projects/:projectId/terminal-settings — partial update of override
-    // (null value for a field clears that override)
-    router.patch('/:projectId/terminal-settings', (req, res) => {
-        const projectCtx = ctx(req);
-        if (!req.body || typeof req.body !== 'object' || Array.isArray(req.body)) {
-            res.status(400).json({ error: 'invalid body' });
-            return;
-        }
-        try {
-            (0, terminal_settings_1.patchProjectOverride)(projectCtx.db, req.body);
-            const desktopDefaults = (0, terminal_settings_1.getDesktopTerminalSettings)(registry.desktopDb);
-            const override = (0, terminal_settings_1.getProjectOverride)(projectCtx.db);
-            const resolved = (0, terminal_settings_1.resolveTerminalSettings)(registry.desktopDb, projectCtx.db);
-            res.json({ resolved, override, desktopDefaults });
-        }
-        catch (err) {
-            if (err instanceof terminal_settings_1.TerminalSettingsValidationError) {
-                res.status(400).json({ error: 'validation_failed', field: err.field, message: err.message });
-                return;
-            }
-            throw err;
-        }
-    });
+    const ticketPath = (req) => (0, ticket_store_1.resolveTicketStoragePath)(ctx(req).project.path);
+    const deps = { router, registry, ctx, ticketPath };
+    (0, project_router_jobs_1.registerJobsRoutes)(deps);
+    (0, project_router_spending_1.registerSpendingRoutes)(deps);
+    (0, project_router_chat_1.registerChatRoutes)(deps);
+    (0, project_router_setup_1.registerSetupRoutes)(deps);
+    (0, project_router_tickets_1.registerTicketsRoutes)(deps);
+    (0, project_router_terminals_1.registerTerminalsRoutes)(deps);
+    (0, project_router_settings_1.registerSettingsRoutes)(deps);
     return router;
 }