specrails-desktop 2.2.1 → 2.4.0

package/server/dist/jira/types.js

@@ -0,0 +1,9 @@
+"use strict";
+// Shared types for the per-project Jira integration.
+//
+// Design: Desktop is the sync layer. The local `.specrails/local-tickets.json`
+// store stays the canonical read cache (specrails-core reads it unchanged). Jira
+// is the system of record. Every write to Jira goes through a durable
+// transactional outbox in the per-project `jobs.sqlite`. See
+// docs/jira-integration-plan.md.
+Object.defineProperty(exports, "__esModule", { value: true });

package/server/dist/jira-router.js

@@ -0,0 +1,304 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJiraRouter = createJiraRouter;
+const express_1 = require("express");
+const jira_db_1 = require("./jira/jira-db");
+const feature_flags_1 = require("./feature-flags");
+// req.projectCtx is declared in project-router / rails-router.
+/**
+ * Per-project Jira router, mounted at /api/projects/:projectId/jira. Gated by
+ * SPECRAILS_JIRA_SECTION; 404s entirely when the flag is off. Endpoints back the
+ * step-by-step setup wizard (test → pick project → optional status map → connect)
+ * and the sync/outbox management surfaces. The token is never returned to the
+ * client (connection responses carry `hasToken` only).
+ */
+function createJiraRouter() {
+    const router = (0, express_1.Router)({ mergeParams: true });
+    function ctx(req) {
+        return req.projectCtx;
+    }
+    // Feature-flag gate for every route under /jira.
+    router.use((_req, res, next) => {
+        if (!(0, feature_flags_1.isJiraEnabled)()) {
+            res.status(404).json({ error: 'Jira integration disabled' });
+            return;
+        }
+        next();
+    });
+    // ─── Connection ──────────────────────────────────────────────────────────────
+    // GET /connection — current connection (token redacted) or { connected: false }.
+    router.get('/connection', (req, res) => {
+        const c = ctx(req);
+        const conn = (0, jira_db_1.getConnectionPublic)(c.db, c.project.id);
+        if (!conn) {
+            res.json({ connected: false });
+            return;
+        }
+        res.json({ connected: true, connection: conn, outbox: c.jiraSyncManager.outboxCounts() });
+    });
+    // POST /test — wizard step 1: validate credentials without saving.
+    router.post('/test', async (req, res) => {
+        const { baseUrl, accountEmail, token } = req.body ?? {};
+        if (!isNonEmptyString(baseUrl) || !isNonEmptyString(token)) {
+            res.status(400).json({ error: 'baseUrl and token are required' });
+            return;
+        }
+        const result = await ctx(req).jiraSyncManager.probeCredentials({
+            baseUrl: baseUrl.trim(),
+            accountEmail: isNonEmptyString(accountEmail) ? accountEmail.trim() : null,
+            token,
+        });
+        if (!result.ok) {
+            res.status(result.status === 401 ? 401 : 400).json({ error: result.error });
+            return;
+        }
+        res.json(result);
+    });
+    // POST /discover-projects — wizard step 2: list visible projects.
+    router.post('/discover-projects', async (req, res) => {
+        const { baseUrl, accountEmail, token, query } = req.body ?? {};
+        if (!isNonEmptyString(baseUrl) || !isNonEmptyString(token)) {
+            res.status(400).json({ error: 'baseUrl and token are required' });
+            return;
+        }
+        const result = await ctx(req).jiraSyncManager.discoverProjects({
+            baseUrl: baseUrl.trim(),
+            accountEmail: isNonEmptyString(accountEmail) ? accountEmail.trim() : null,
+            token,
+            query: isNonEmptyString(query) ? query.trim() : undefined,
+        });
+        if (!result.ok) {
+            res.status(400).json({ error: result.error });
+            return;
+        }
+        res.json({ projects: result.projects });
+    });
+    // POST /discover-statuses — wizard step 3 (optional): the project's statuses.
+    router.post('/discover-statuses', async (req, res) => {
+        const { baseUrl, accountEmail, token, projectKey } = req.body ?? {};
+        if (!isNonEmptyString(baseUrl) || !isNonEmptyString(token) || !isNonEmptyString(projectKey)) {
+            res.status(400).json({ error: 'baseUrl, token and projectKey are required' });
+            return;
+        }
+        const result = await ctx(req).jiraSyncManager.discoverStatuses({
+            baseUrl: baseUrl.trim(),
+            accountEmail: isNonEmptyString(accountEmail) ? accountEmail.trim() : null,
+            token,
+            projectKey: projectKey.trim(),
+        });
+        if (!result.ok) {
+            res.status(400).json({ error: result.error });
+            return;
+        }
+        res.json({ statuses: result.statuses });
+    });
+    // POST /connect — wizard final step: validate + persist + start sync.
+    router.post('/connect', async (req, res) => {
+        const c = ctx(req);
+        const { baseUrl, accountEmail, token, jiraProjectKey, statusMap, discardStatus } = req.body ?? {};
+        if (!isNonEmptyString(baseUrl) || !isNonEmptyString(token) || !isNonEmptyString(jiraProjectKey)) {
+            res.status(400).json({ error: 'baseUrl, token and jiraProjectKey are required' });
+            return;
+        }
+        const cleanMap = sanitizeStatusMap(statusMap);
+        const result = await c.jiraSyncManager.connect({
+            baseUrl: baseUrl.trim(),
+            accountEmail: isNonEmptyString(accountEmail) ? accountEmail.trim() : null,
+            token,
+            jiraProjectKey: jiraProjectKey.trim(),
+            statusMap: cleanMap,
+            discardStatus: isNonEmptyString(discardStatus) ? discardStatus.trim() : null,
+        });
+        if (!result.ok) {
+            res.status(result.status === 401 ? 401 : 400).json({ error: result.error });
+            return;
+        }
+        res.status(201).json({ connection: (0, jira_db_1.getConnectionPublic)(c.db, c.project.id) });
+    });
+    // PATCH /connection — toggle enabled (hot-swap local↔Jira) and/or update the
+    // discard "move-to" status. `discardStatus: ''`/null clears it.
+    router.patch('/connection', (req, res) => {
+        const c = ctx(req);
+        const existing = (0, jira_db_1.getConnectionPublic)(c.db, c.project.id);
+        if (!existing) {
+            res.status(404).json({ error: 'No Jira connection configured' });
+            return;
+        }
+        const { enabled, discardStatus, statusMap } = req.body ?? {};
+        if (typeof enabled === 'boolean') {
+            c.jiraSyncManager.setEnabled(enabled);
+        }
+        if (discardStatus !== undefined) {
+            c.jiraSyncManager.setDiscardStatus(isNonEmptyString(discardStatus) ? discardStatus.trim() : null);
+        }
+        if (statusMap !== undefined) {
+            c.jiraSyncManager.setStatusMap(sanitizeStatusMap(statusMap));
+        }
+        res.json({ connection: (0, jira_db_1.getConnectionPublic)(c.db, c.project.id) });
+    });
+    // GET /statuses — the connected project's real statuses (post-connect picker
+    // for the discard "move-to" status). Uses the stored credentials.
+    router.get('/statuses', async (req, res) => {
+        const result = await ctx(req).jiraSyncManager.listStatusesForConnection();
+        if (!result.ok) {
+            res.status(400).json({ error: result.error });
+            return;
+        }
+        res.json({ statuses: result.statuses });
+    });
+    // DELETE /connection — remove the connection + restore local backlog config.
+    router.delete('/connection', (req, res) => {
+        const c = ctx(req);
+        c.jiraSyncManager.disconnect();
+        res.json({ connected: false });
+    });
+    // POST /resume — re-paste of a fresh token after a 401: drain the parked outbox.
+    router.post('/resume', (req, res) => {
+        ctx(req).jiraSyncManager.resumeAfterReauth();
+        res.json({ ok: true });
+    });
+    // ─── Sync + outbox management ───────────────────────────────────────────────
+    // POST /sync — manual "Sync now": a FULL re-fetch (ignores the high-water) so
+    // it back-fills any data the cache is missing (e.g. sprint/epic fields).
+    router.post('/sync', async (req, res) => {
+        const result = await ctx(req).jiraSyncManager.pollOnce(true);
+        res.json({ ok: true, upserted: result?.upserted ?? 0 });
+    });
+    // GET /outbox?state= — list outbox ops (defaults to all).
+    router.get('/outbox', (req, res) => {
+        const c = ctx(req);
+        const state = req.query.state;
+        const valid = ['pending', 'inflight', 'done', 'dead'];
+        const filter = valid.includes(state) ? state : undefined;
+        res.json({ ops: c.jiraSyncManager.listOutbox(filter), counts: c.jiraSyncManager.outboxCounts() });
+    });
+    // POST /outbox/:id/retry — re-queue a dead-lettered op for a manual retry.
+    router.post('/outbox/:id/retry', async (req, res) => {
+        const c = ctx(req);
+        const id = parseInt(req.params.id, 10);
+        if (Number.isNaN(id)) {
+            res.status(400).json({ error: 'Invalid op id' });
+            return;
+        }
+        const { retryDeadOutbox } = await Promise.resolve().then(() => __importStar(require('./jira/jira-db')));
+        const ok = retryDeadOutbox(c.db, id);
+        if (!ok) {
+            res.status(404).json({ error: 'Op not found or not in dead state' });
+            return;
+        }
+        void c.jiraSyncManager.drainOnce().catch(() => undefined);
+        res.json({ ok: true });
+    });
+    // POST /specs — Add Spec when the project source is Jira: create the issue in
+    // Jira and materialize it locally. Keeps the generic local ticket-create path
+    // untouched.
+    router.post('/specs', async (req, res) => {
+        const c = ctx(req);
+        const { title, description, labels, priority, issueType } = req.body ?? {};
+        if (!isNonEmptyString(title)) {
+            res.status(400).json({ error: 'title is required' });
+            return;
+        }
+        const result = await c.jiraSyncManager.createSpec({
+            title: title.trim(),
+            description: isNonEmptyString(description) ? description : undefined,
+            labels: Array.isArray(labels) ? labels.filter((l) => typeof l === 'string') : undefined,
+            priority: isNonEmptyString(priority) ? priority : undefined,
+            issueType: isNonEmptyString(issueType) ? issueType : undefined,
+        });
+        if (!result.ok) {
+            res.status(result.status === 401 ? 401 : 400).json({ error: result.error });
+            return;
+        }
+        res.status(201).json({ localId: result.localId, jiraKey: result.jiraKey });
+    });
+    // POST /specs/:localId/discard — "Move to <discard status>": transition the
+    // linked issue to the configured discard status (+ optional reason comment)
+    // instead of a destructive delete. Body: { comment?: string }.
+    router.post('/specs/:localId/discard', (req, res) => {
+        const c = ctx(req);
+        const localId = parseInt(req.params.localId, 10);
+        if (Number.isNaN(localId)) {
+            res.status(400).json({ error: 'Invalid spec id' });
+            return;
+        }
+        const comment = isNonEmptyString(req.body?.comment) ? req.body.comment : null;
+        const result = c.jiraSyncManager.discardSpec(localId, comment);
+        if (!result.ok) {
+            const status = result.reason === 'no-link' ? 404 : 409;
+            res.status(status).json({ error: result.reason });
+            return;
+        }
+        res.status(202).json({ ok: true });
+    });
+    // GET /specs/:localId/details — read-only "Jira details" + "Development" payload
+    // for the spec detail modal. Resilient: dev-status failures still return fields.
+    router.get('/specs/:localId/details', async (req, res) => {
+        const c = ctx(req);
+        const localId = parseInt(req.params.localId, 10);
+        if (Number.isNaN(localId)) {
+            res.status(400).json({ error: 'Invalid spec id' });
+            return;
+        }
+        const result = await c.jiraSyncManager.getSpecDetails(localId);
+        if (!result.ok) {
+            const status = result.reason === 'no-link' ? 404 : result.reason === 'not-active' ? 409 : (result.status ?? 502);
+            res.status(status).json({ error: result.reason });
+            return;
+        }
+        res.json(result.details);
+    });
+    // GET /links — the spec↔issue map (for the badge / diagnostics).
+    router.get('/links', (req, res) => {
+        res.json({ links: ctx(req).jiraSyncManager.listLinks() });
+    });
+    return router;
+}
+function isNonEmptyString(v) {
+    return typeof v === 'string' && v.trim().length > 0;
+}
+function sanitizeStatusMap(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const states = ['todo', 'in_progress', 'done', 'cancelled'];
+    const out = {};
+    for (const s of states) {
+        const v = raw[s];
+        if (typeof v === 'string' && v.trim())
+            out[s] = v.trim();
+    }
+    return Object.keys(out).length > 0 ? out : null;
+}

package/server/dist/mobile/mobile-auth.js

@@ -29,6 +29,10 @@ function createMobileAuthMiddleware(opts) {
     const clock = opts.clock ?? (() => Date.now());
     const lastTouch = new Map();
     const ipHits = new Map();
+    // Periodically evict stale keys so these maps can't grow unbounded under a
+    // multi-source flood (each per-IP timestamp array self-bounds to the 60s
+    // window, but the Map KEYS would otherwise live forever, one per distinct IP).
+    let lastSweep = clock();
     return function mobileAuth(req, res, next) {
         // 1. Refuse browser-origin requests outright.
         if (req.headers['origin']) {
@@ -38,6 +42,18 @@ function createMobileAuthMiddleware(opts) {
         // 2. Coarse per-IP rate limit.
         const ip = req.socket?.remoteAddress ?? 'unknown';
         const now = clock();
+        // Sweep stale tracking at most once per window (cheap, amortized O(1)).
+        if (now - lastSweep > 60_000) {
+            lastSweep = now;
+            for (const [k, v] of ipHits) {
+                if (v.length === 0 || now - v[v.length - 1] >= 60_000)
+                    ipHits.delete(k);
+            }
+            for (const [k, t] of lastTouch) {
+                if (now - t >= 3_600_000)
+                    lastTouch.delete(k); // drop device touch-cache after 1h idle
+            }
+        }
         const hits = (ipHits.get(ip) ?? []).filter((t) => now - t < 60_000);
         hits.push(now);
         ipHits.set(ip, hits);

package/server/dist/project-registry.js

@@ -24,6 +24,7 @@ const terminal_manager_1 = require("./terminal-manager");
 const browser_capture_manager_1 = require("./browser-capture-manager");
 const explore_cwd_manager_1 = require("./explore-cwd-manager");
 const ticket_store_1 = require("./ticket-store");
+const jira_sync_manager_1 = require("./jira/jira-sync-manager");
 const rails_store_1 = require("./rails-store");
 const desktop_db_1 = require("./desktop-db");
 const config_1 = require("./config");
@@ -115,6 +116,11 @@ class ProjectRegistry {
             catch { /* ignore */ }
             // Tear down the embedded browser (closes pages + persistent context).
             void ctx.browserCaptureManager.shutdown().catch(() => { });
+            // Stop the Jira sync poll/drain timers (no children, just intervals).
+            try {
+                ctx.jiraSyncManager.stop();
+            }
+            catch { /* ignore */ }
             // Kill any terminal sessions belonging to this project
             try {
                 (0, terminal_manager_1.getTerminalManager)().killAllForProject(id);
@@ -201,6 +207,10 @@ class ProjectRegistry {
             }
             catch { /* ignore */ }
             void ctx.browserCaptureManager.shutdown().catch(() => { });
+            try {
+                ctx.jiraSyncManager.stop();
+            }
+            catch { /* ignore */ }
             // Release chokidar watchers + abort in-flight generations so a restart
             // does not leak handles/children — mirror removeProject()'s per-project teardown.
             try {
@@ -250,6 +260,14 @@ class ProjectRegistry {
         catch { /* queue_state table may not exist yet */ }
         const webhookManager = this._webhookManager;
         const railJobs = new Map();
+        // Jira sync (per-project, inert until a connection is configured). Constructed
+        // before QueueManager so the onJobFinished closure can reference it.
+        const jiraSyncManager = new jira_sync_manager_1.JiraSyncManager({
+            db,
+            projectId: project.id,
+            projectPath: project.path,
+            broadcast: boundBroadcast,
+        });
         const queueManager = new queue_manager_1.QueueManager(boundBroadcast, db, undefined, project.path, {
             zombieTimeoutMs: projectZombieTimeout,
             provider: project.provider ?? 'claude',
@@ -318,6 +336,26 @@ class ProjectRegistry {
                                 timestamp: ticket.updated_at,
                             });
                         }
+                        // Jira write-back (inert for non-Jira projects): enqueue the status
+                        // transition + completion comment per linked ticket. The LOCAL mutation
+                        // above stays synchronous; only the durable outbox enqueue happens here,
+                        // wrapped so a Jira failure can never break the job-exit handler.
+                        if (status === 'completed' || status === 'failed' || status === 'canceled' || status === 'zombie_terminated') {
+                            try {
+                                const needsReviewIds = completedTicketIds.filter((tid) => store.tickets[String(tid)]?.needs_review === true);
+                                jiraSyncManager.onJobOutcome({
+                                    ticketIds: completedTicketIds,
+                                    status,
+                                    jobId,
+                                    costUsd: costUsd ?? null,
+                                    durationMs: jobRow?.duration_ms ?? null,
+                                    needsReviewIds,
+                                });
+                            }
+                            catch (err) {
+                                console.error('[project-registry] jira onJobOutcome failed:', err);
+                            }
+                        }
                     }
                     catch (err) {
                         console.error('[project-registry] failed to apply job outcome to tickets:', err);
@@ -425,6 +463,10 @@ class ProjectRegistry {
         }
         const ticketWatcher = new ticket_watcher_1.TicketWatcher(project.path, project.id, boundBroadcast);
         ticketWatcher.start();
+        // Suppress the file-watcher echo for the Jira sync's own writes (the every-60s
+        // poll would otherwise trigger a full-board refresh = flicker). Late-bound
+        // because the JiraSyncManager is constructed before the watcher.
+        jiraSyncManager.setLocalWriteNotifier((rev) => ticketWatcher.notifyDesktopWrite(rev));
         // BrowserCaptureManager — "Add Spec from browser". Constructed for every
         // project regardless of the feature flag; the routes + WS endpoint 404 when
         // the flag is off, and the persistent Chromium context is launched lazily on
@@ -435,7 +477,7 @@ class ProjectRegistry {
             db,
             broadcast: boundBroadcast,
         });
-        const ctx = { project, db, queueManager, chatManager, setupManager, proposalManager, agentRefineManager, fileSummaryManager, specLauncherManager, ticketWatcher, browserCaptureManager, broadcast: boundBroadcast, railJobs };
+        const ctx = { project, db, queueManager, chatManager, setupManager, proposalManager, agentRefineManager, fileSummaryManager, specLauncherManager, ticketWatcher, browserCaptureManager, jiraSyncManager, broadcast: boundBroadcast, railJobs };
         this._contexts.set(project.id, ctx);
         return ctx;
     }

package/server/dist/project-router-chat.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerChatRoutes = registerChatRoutes;
+const ids_1 = require("./ids");
+const db_1 = require("./db");
+const context_scope_1 = require("./context-scope");
+const spec_models_1 = require("./spec-models");
+const provider_selection_1 = require("./provider-selection");
+const ticket_store_1 = require("./ticket-store");
+const project_router_helpers_1 = require("./project-router-helpers");
+function registerChatRoutes(deps) {
+    const { router, registry, ctx, ticketPath } = deps;
+    // ─── Chat routes ─────────────────────────────────────────────────────────────
+    router.get('/:projectId/chat/conversations', (req, res) => {
+        const conversations = (0, db_1.listConversations)(ctx(req).db);
+        res.json({ conversations });
+    });
+    router.post('/:projectId/chat/conversations', (req, res) => {
+        const { db, project } = ctx(req);
+        // Multi-provider: an optional aiEngine (alias: provider) picks which engine
+        // this conversation runs on. It must be installed on the project; omitting
+        // it uses the project's primary provider. The chosen provider drives model
+        // validation and is persisted on the conversation so resume turns and
+        // ai_invocations attribute to the right engine.
+        const requestedEngine = req.body?.aiEngine ?? req.body?.provider;
+        const engineCheck = (0, provider_selection_1.validateRequestedProvider)(project, requestedEngine);
+        if (!engineCheck.ok) {
+            res.status(400).json({ error: engineCheck.error });
+            return;
+        }
+        const provider = engineCheck.provider;
+        const rawModel = req.body?.model;
+        let model;
+        if (rawModel === undefined || rawModel === null || rawModel === '') {
+            model = (0, project_router_helpers_1.resolveDefaultSpecModel)({ projectPath: project.path, provider });
+        }
+        else if ((0, spec_models_1.isValidModelForProvider)(rawModel, provider)) {
+            model = rawModel;
+        }
+        else {
+            res.status(400).json({
+                error: `Invalid model "${String(rawModel)}" for provider "${provider}"`,
+                allowed: (0, spec_models_1.getModelsForProvider)(provider).map((m) => m.value),
+            });
+            return;
+        }
+        const rawKind = req.body?.kind;
+        const kind = rawKind === 'explore' ? 'explore' : 'sidebar';
+        const id = (0, ids_1.newId)();
+        const rawScope = req.body?.contextScope;
+        if (rawScope !== undefined && kind !== 'explore') {
+            res.status(400).json({ error: 'contextScope is only allowed for kind=explore' });
+            return;
+        }
+        let scope;
+        if (kind === 'explore') {
+            const fallback = (0, context_scope_1.getLastContextScope)(db, 'explore');
+            // Defence-in-depth: SMASH / Contract Layer is Claude-only. Strip
+            // contractRefine from the scope when the conversation's resolved provider
+            // is non-Claude so no downstream code (Contract Refine Runner, SMASH
+            // eligibility) ever sees a mismatched flag.
+            const safeRawScope = provider !== 'claude' && rawScope != null
+                ? { ...rawScope, contractRefine: false }
+                : rawScope;
+            scope = (0, context_scope_1.normalizeContextScope)(safeRawScope ?? fallback, fallback);
+            (0, context_scope_1.setLastContextScope)(db, scope);
+            console.log(`[project-router] new explore conv ${id} provider=${provider} scope=${JSON.stringify(scope)} rawScope=${JSON.stringify(rawScope)}`);
+        }
+        // Only persist provider when the project is multi-provider; single-provider
+        // projects leave it NULL so behaviour is byte-identical to before.
+        const persistProvider = (0, provider_selection_1.isMultiProvider)(project) ? provider : null;
+        (0, db_1.createConversation)(db, { id, model, kind, contextScope: scope, provider: persistProvider });
+        const conversation = (0, db_1.getConversation)(db, id);
+        res.status(201).json({ conversation });
+    });
+    router.get('/:projectId/chat/conversations/:id', (req, res) => {
+        const { db } = ctx(req);
+        const conversation = (0, db_1.getConversation)(db, req.params.id);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        const messages = (0, db_1.getMessages)(db, req.params.id);
+        res.json({ conversation, messages });
+    });
+    router.delete('/:projectId/chat/conversations/:id', (req, res) => {
+        const { db, chatManager, broadcast, project, ticketWatcher } = ctx(req);
+        const convId = req.params.id;
+        const conversation = (0, db_1.getConversation)(db, convId);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        (0, db_1.deleteConversation)(db, convId);
+        chatManager?.forgetSpecDraft(convId);
+        chatManager?.forgetExploreLifecycle(convId);
+        // Cascade-clear origin_conversation_id on any ticket that referenced this
+        // conversation (application-level "ON DELETE SET NULL").
+        try {
+            const filePath = ticketPath(req);
+            const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
+                for (const id of Object.keys(s.tickets)) {
+                    if (s.tickets[id].origin_conversation_id === convId) {
+                        s.tickets[id].origin_conversation_id = null;
+                        s.tickets[id].updated_at = new Date().toISOString();
+                    }
+                }
+            });
+            ticketWatcher.notifyDesktopWrite(store.revision);
+            // No per-ticket broadcast: the cleared field is metadata-only and the
+            // board card visual treatment doesn't depend on it.
+        }
+        catch (err) {
+            console.error('[project-router] conversation-cascade ticket update error:', err);
+        }
+        res.json({ ok: true });
+    });
+    router.patch('/:projectId/chat/conversations/:id', (req, res) => {
+        const { db } = ctx(req);
+        const conversation = (0, db_1.getConversation)(db, req.params.id);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        const { title, model } = req.body ?? {};
+        const patch = {};
+        if (title !== undefined)
+            patch.title = title;
+        if (model !== undefined)
+            patch.model = model;
+        (0, db_1.updateConversation)(db, req.params.id, patch);
+        const updated = (0, db_1.getConversation)(db, req.params.id);
+        res.json({ ok: true, conversation: updated });
+    });
+    router.get('/:projectId/chat/conversations/:id/messages', (req, res) => {
+        const { db } = ctx(req);
+        const conversation = (0, db_1.getConversation)(db, req.params.id);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        const messages = (0, db_1.getMessages)(db, req.params.id);
+        res.json({ messages });
+    });
+    // Returns the in-memory spec-draft state Claude has accumulated for this
+    // conversation. Used by useSpecDraftStream on mount to rehydrate updates
+    // that were broadcast while the client wasn't subscribed (refresh /
+    // minimize-and-restore). Returns 200 with `null` draft when no state yet.
+    router.get('/:projectId/chat/conversations/:id/spec-draft', (req, res) => {
+        const { db, chatManager } = ctx(req);
+        const conversation = (0, db_1.getConversation)(db, req.params.id);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        const state = chatManager.getSpecDraftState(req.params.id);
+        if (!state) {
+            res.json({ draft: null, ready: false, chips: [] });
+            return;
+        }
+        res.json({
+            draft: state.draft,
+            ready: state.ready,
+            chips: state.chips,
+        });
+    });
+    router.post('/:projectId/chat/conversations/:id/messages', async (req, res) => {
+        const { db, chatManager, project } = ctx(req);
+        const conversation = (0, db_1.getConversation)(db, req.params.id);
+        if (!conversation) {
+            res.status(404).json({ error: 'Conversation not found' });
+            return;
+        }
+        const text = req.body?.text;
+        if (!text || !text.trim()) {
+            res.status(400).json({ error: 'text is required' });
+            return;
+        }
+        if (chatManager.isActive(req.params.id)) {
+            res.status(409).json({ error: 'CONVERSATION_BUSY' });
+            return;
+        }
+        const lightweight = req.body?.lightweight === true;
+        const maxTurns = typeof req.body?.maxTurns === 'number' ? req.body.maxTurns : undefined;
+        let attachments;
+        const rawAtt = req.body?.attachments;
+        if (rawAtt && typeof rawAtt === 'object' && typeof rawAtt.ticketKey === 'string'
+            && Array.isArray(rawAtt.ids)) {
+            const ids = rawAtt.ids.filter((x) => typeof x === 'string');
+            if (ids.length > 0) {
+                attachments = { slug: project.slug, ticketKey: rawAtt.ticketKey, ids };
+            }
+        }
+        res.status(202).json({ ok: true });
+        chatManager.sendMessage(req.params.id, text.trim(), { lightweight, maxTurns, attachments }).catch((err) => {
+            console.error('[project-router] chat sendMessage error:', err);
+        });
+    });
+    router.delete('/:projectId/chat/conversations/:id/messages/stream', (req, res) => {
+        const { chatManager } = ctx(req);
+        if (!chatManager.isActive(req.params.id)) {
+            res.status(404).json({ error: 'No active stream for this conversation' });
+            return;
+        }
+        chatManager.abort(req.params.id);
+        res.json({ ok: true });
+    });
+    // Explore Spec lifecycle: minimize-to-toast hint and restore-from-toast hint.
+    // Idempotent; does not mutate persistent state. See design.md D7.
+    router.post('/:projectId/chat/conversations/:id/minimize', (req, res) => {
+        ctx(req).chatManager.notifyMinimized(req.params.id);
+        res.json({ ok: true });
+    });
+    router.post('/:projectId/chat/conversations/:id/restore', (req, res) => {
+        ctx(req).chatManager.notifyRestored(req.params.id);
+        res.json({ ok: true });
+    });
+}