specrails-desktop 2.29.0 → 2.29.2

package/server/dist/project-router-git.js

@@ -4,6 +4,8 @@ exports.registerGitRoutes = registerGitRoutes;
 const project_git_1 = require("./project-git");
 const git_diagnostics_1 = require("./git-diagnostics");
 const pr_publisher_1 = require("./pr-publisher");
+const repo_lock_1 = require("./repo-lock");
+const process_admission_1 = require("./process-admission");
 // ─── Git domain routes (/api/projects/:projectId/git) ─────────────────────────
 //
 // Backs the Agent-Mode git bar: current branch + last commit + local branches,
@@ -70,9 +72,14 @@ function registerGitRoutes(deps) {
             res.status(400).json({ error: 'branch is required' });
             return;
         }
-        const repoDir = ctx(req).project.path;
+        const project = ctx(req).project;
+        const repoDir = project.path;
         try {
-            const result = await (0, project_git_1.checkoutProjectBranch)(repoDir, branch);
+            const admission = (0, process_admission_1.captureProcessAdmission)(project.id);
+            const result = await (0, repo_lock_1.withRepoLock)(repoDir, () => {
+                admission.assertCurrent();
+                return (0, project_git_1.checkoutProjectBranch)(repoDir, branch);
+            });
             if (!result.ok) {
                 // 409: the working tree state (or an unknown branch) refused the switch.
                 res.status(409).json({ error: result.error });
@@ -81,6 +88,10 @@ function registerGitRoutes(deps) {
             res.json(await (0, project_git_1.getProjectGitInfo)(repoDir));
         }
         catch (err) {
+            if (err instanceof process_admission_1.ProcessAdmissionClosedError) {
+                res.status(409).json({ error: 'project_recovery_in_progress' });
+                return;
+            }
             console.error('[project-git] checkout failed:', err);
             res.status(500).json({ error: 'Checkout failed' });
         }

package/server/dist/project-router-jobs.js

@@ -5,16 +5,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerJobsRoutes = registerJobsRoutes;
 const path_1 = __importDefault(require("path"));
+const ids_1 = require("./ids");
 const db_1 = require("./db");
 const queue_manager_1 = require("./queue-manager");
 const feature_flags_1 = require("./feature-flags");
 const types_1 = require("./types");
 const hooks_1 = require("./hooks");
 const explore_smash_1 = require("./explore-smash");
+const job_spawn_idempotency_1 = require("./job-spawn-idempotency");
 const spec_models_1 = require("./spec-models");
 const provider_selection_1 = require("./provider-selection");
 const loop_runs_store_1 = require("./loop-runs-store");
 const metrics_1 = require("./metrics");
+const job_listing_1 = require("./job-listing");
 const ticket_store_1 = require("./ticket-store");
 const transient_children_1 = require("./transient-children");
 const project_router_helpers_1 = require("./project-router-helpers");
@@ -45,10 +48,23 @@ function registerJobsRoutes(deps) {
             res.status(400).json({ error: 'priority must be one of: low, normal, high, critical' });
             return;
         }
+        if (dependsOnJobId !== undefined &&
+            (typeof dependsOnJobId !== 'string' || !dependsOnJobId.trim())) {
+            res.status(400).json({ error: 'dependsOnJobId must be a non-empty string' });
+            return;
+        }
+        const normalizedDependsOnJobId = typeof dependsOnJobId === 'string'
+            ? dependsOnJobId.trim()
+            : undefined;
         // profileName accepts: undefined (default resolution), null (force legacy), string (explicit)
         const normalizedProfileName = profileName === null ? null
             : typeof profileName === 'string' && profileName.trim() ? profileName.trim()
                 : undefined;
+        const idempotencyKey = req.get('Idempotency-Key');
+        if (idempotencyKey !== undefined && !/^[A-Za-z0-9._:-]{1,128}$/.test(idempotencyKey)) {
+            res.status(400).json({ error: 'Idempotency-Key must be 1-128 URL-safe characters' });
+            return;
+        }
         // aiEngine: optional per-job provider override; must be installed on the
         // project. Omitting it runs on the project's primary provider.
         const engineCheck = (0, provider_selection_1.validateRequestedProvider)(ctx(req).project, aiEngine);
@@ -57,12 +73,42 @@ function registerJobsRoutes(deps) {
             return;
         }
         try {
-            const job = ctx(req).queueManager.enqueue(command, priority ?? 'normal', {
-                dependsOnJobId: dependsOnJobId || undefined,
+            const c = ctx(req);
+            const normalizedPriority = priority ?? 'normal';
+            const spawnFingerprint = idempotencyKey ? (0, job_spawn_idempotency_1.fingerprintJobSpawn)({
+                command,
+                priority: normalizedPriority,
+                dependsOnJobId: normalizedDependsOnJobId ?? null,
+                pipelineId: pipelineId || null,
+                profileName: normalizedProfileName === undefined ? '__project_default__' : normalizedProfileName,
+                provider: aiEngine ? engineCheck.provider : null,
+            }) : null;
+            if (idempotencyKey && spawnFingerprint) {
+                const existingJobId = (0, job_spawn_idempotency_1.findIdempotentJob)(c.db, idempotencyKey, spawnFingerprint);
+                if (existingJobId) {
+                    res.status(202).json({ jobId: existingJobId, position: null, idempotentReplay: true });
+                    return;
+                }
+            }
+            // Preassign the id and commit queued_jobs + the idempotency claim in
+            // QueueManager's ONE outer transaction. QueueManager broadcasts/drains
+            // only after that commit, so a crash can expose neither an unclaimed job
+            // nor a ledger entry whose job was never admitted.
+            const preparedJobId = idempotencyKey ? (0, ids_1.newId)() : null;
+            const enqueueOptions = {
+                dependsOnJobId: normalizedDependsOnJobId,
                 pipelineId: pipelineId || undefined,
-                profileName: normalizedProfileName,
+                ...(normalizedProfileName !== undefined
+                    ? { profileName: normalizedProfileName }
+                    : {}),
                 provider: aiEngine ? engineCheck.provider : undefined,
-            });
+            };
+            const job = idempotencyKey && spawnFingerprint && preparedJobId
+                ? c.queueManager.enqueue(command, normalizedPriority, enqueueOptions, {
+                    jobId: preparedJobId,
+                    commit: (db) => (0, job_spawn_idempotency_1.claimIdempotentJob)(db, idempotencyKey, spawnFingerprint, preparedJobId),
+                })
+                : c.queueManager.enqueue(command, normalizedPriority, enqueueOptions);
             const position = job.queuePosition ?? 0;
             res.status(202).json({ jobId: job.id, position });
         }
@@ -70,6 +116,15 @@ function registerJobsRoutes(deps) {
             if (err instanceof queue_manager_1.ClaudeNotFoundError) {
                 res.status(400).json({ error: err.message });
             }
+            else if (err instanceof queue_manager_1.InvalidJobDependencyError) {
+                res.status(409).json({ error: err.message });
+            }
+            else if (err instanceof job_spawn_idempotency_1.JobSpawnIdempotencyReplayError) {
+                res.status(202).json({ jobId: err.jobId, position: null, idempotentReplay: true });
+            }
+            else if (err instanceof job_spawn_idempotency_1.JobSpawnIdempotencyConflictError) {
+                res.status(409).json({ error: err.message });
+            }
             else {
                 console.error('[project-router] spawn error:', err);
                 res.status(500).json({ error: 'Internal server error' });
@@ -227,7 +282,10 @@ function registerJobsRoutes(deps) {
         const allowed = (0, spec_models_1.getModelsForProvider)(provider);
         res.json({ model, provider, allowed, providers: project.providers });
     });
-    router.delete('/:projectId/jobs/:id', (req, res) => {
+    // Cancellation is idempotent and intentionally separate from history
+    // deletion. A stale UI request that races with natural completion must never
+    // erase the just-finished job and its telemetry.
+    router.post('/:projectId/jobs/:id/cancel', (req, res) => {
         const id = req.params.id;
         const c = ctx(req);
         // A loop run is backed by a job row but is NOT a QueueManager job — it is
@@ -249,17 +307,21 @@ function registerJobsRoutes(deps) {
                 // the loop is still executing — cancel through the engine instead of
                 // 404ing with a live child (the mission-modal "cancel did nothing" bug).
                 const loopRun = (0, loop_runs_store_1.getLoopRun)(c.db, id);
-                if (loopRun && (loopRun.status === 'running' || loopRun.status === 'paused') && c.loopRunManager) {
-                    c.loopRunManager.cancel(id);
-                    res.json({ ok: true, status: 'canceling' });
-                    return;
+                if (loopRun) {
+                    if ((loopRun.status === 'running' || loopRun.status === 'paused') && c.loopRunManager) {
+                        c.loopRunManager.cancel(id);
+                        res.json({ ok: true, status: 'canceling' });
+                        return;
+                    }
+                    if (loopRun.status === 'completed') {
+                        res.json({ ok: true, status: 'already_terminal' });
+                        return;
+                    }
                 }
                 res.status(404).json({ error: 'Job not found' });
             }
             else if (err instanceof queue_manager_1.JobAlreadyTerminalError) {
-                // Job already finished — delete it from the DB
-                (0, db_1.deleteJob)(ctx(req).db, req.params.id);
-                res.json({ ok: true, status: 'deleted' });
+                res.json({ ok: true, status: 'already_terminal' });
             }
             else {
                 // Surface the real error (name/message/stack) so an unexpected cancel
@@ -271,6 +333,33 @@ function registerJobsRoutes(deps) {
             }
         }
     });
+    // Explicit history deletion. Active work must be canceled through the
+    // idempotent endpoint above and can only be deleted after it is terminal.
+    router.delete('/:projectId/jobs/:id', (req, res) => {
+        const id = req.params.id;
+        const c = ctx(req);
+        const job = (0, db_1.getJob)(c.db, id);
+        if (!job) {
+            res.status(404).json({ error: 'Job not found' });
+            return;
+        }
+        if (job.status === 'running' || job.status === 'queued') {
+            res.status(409).json({ error: 'Active jobs must be canceled before deletion' });
+            return;
+        }
+        try {
+            (0, db_1.deleteJob)(c.db, id);
+            res.json({ ok: true, status: 'deleted' });
+        }
+        catch (err) {
+            if (err instanceof db_1.JobRecoveryPendingError) {
+                res.status(409).json({ error: err.message, code: 'job_recovery_pending' });
+                return;
+            }
+            console.error(`[jobs] delete ${id} failed:`, err);
+            res.status(500).json({ error: 'Failed to delete job' });
+        }
+    });
     // ─── Interactive jobs (manager-agnostic) ───────────────────────────────────
     // Send one more user prompt to a running interactive job (queued behind the
     // active turn — see InteractiveJobSession). The job row may be owned by
@@ -374,46 +463,12 @@ function registerJobsRoutes(deps) {
         // Clamp to [1, 200] (H-11): a negative limit is LIMIT -1 in SQLite, which
         // means UNLIMITED — without the lower bound `?limit=-1` dumps the whole table.
         const limit = Math.max(1, Math.min(parseInt(String(req.query.limit ?? '50'), 10) || 50, 200));
-        const offset = parseInt(String(req.query.offset ?? '0'), 10) || 0;
+        const offset = Math.max(0, parseInt(String(req.query.offset ?? '0'), 10) || 0);
         const status = req.query.status;
         const from = req.query.from;
         const to = req.query.to;
         const { db } = ctx(req);
-        const result = (0, db_1.listJobs)(db, { limit, offset, status, from, to });
-        // Merge in-memory queued jobs that haven't been persisted to DB yet
-        const { queueManager } = ctx(req);
-        const dbIds = new Set(result.jobs.map((j) => j.id));
-        const queuedRows = queueManager
-            .getJobs()
-            .filter((j) => j.status === 'queued' && !dbIds.has(j.id))
-            .filter((j) => !status || j.status === status)
-            .map((j) => ({
-            id: j.id,
-            command: j.command,
-            started_at: j.startedAt ?? new Date().toISOString(),
-            finished_at: j.finishedAt,
-            status: j.status,
-            exit_code: j.exitCode,
-            queue_position: j.queuePosition,
-            priority: j.priority,
-            tokens_in: null,
-            tokens_out: null,
-            tokens_cache_read: null,
-            tokens_cache_create: null,
-            total_cost_usd: null,
-            num_turns: null,
-            model: null,
-            duration_ms: null,
-            duration_api_ms: null,
-            session_id: null,
-            depends_on_job_id: j.dependsOnJobId,
-            pipeline_id: j.pipelineId,
-            skip_reason: j.skipReason,
-        }));
-        if (queuedRows.length > 0) {
-            result.jobs = [...queuedRows, ...result.jobs];
-            result.total += queuedRows.length;
-        }
+        const result = (0, job_listing_1.listUnifiedJobs)(db, { limit, offset, status, from, to });
         // Annotate each job with hasTelemetry so the client can show the
         // Export diagnostic button without an extra round trip.
         const jobsWithTelemetry = (0, db_1.getJobsWithTelemetry)(db);
@@ -518,19 +573,20 @@ function registerJobsRoutes(deps) {
         const jobId = req.params.id;
         const job = (0, db_1.getJob)(db, jobId);
         if (!job) {
-            // Queued jobs live only in memory until spawn time (createJob runs on spawn,
-            // not enqueue). Fall back to the in-memory queue so /jobs/:id returns a
-            // usable payload instead of 404 — the detail page then renders a "queued"
-            // state and flips to live logs via WS once the job starts.
+            // Queued jobs have a durable admission timestamp but no execution start.
+            // Prefer SQLite so repeated detail reads return the same enqueued_at;
+            // retain the in-memory fallback only for non-project/test managers.
+            const durableQueued = (0, job_listing_1.getQueuedJobForListing)(db, jobId);
             const inMemory = queueManager.getJobs().find((j) => j.id === jobId);
-            if (!inMemory) {
+            if (!durableQueued && !inMemory) {
                 res.status(404).json({ error: 'Job not found' });
                 return;
             }
-            const synthetic = {
+            const synthetic = durableQueued ?? {
                 id: inMemory.id,
                 command: inMemory.command,
-                started_at: inMemory.startedAt ?? '',
+                started_at: null,
+                enqueued_at: null,
                 finished_at: inMemory.finishedAt,
                 status: inMemory.status,
                 exit_code: inMemory.exitCode,

package/server/dist/project-router-tickets.js

@@ -57,6 +57,7 @@ const ticket_store_1 = require("./ticket-store");
 const explore_draft_title_1 = require("./explore-draft-title");
 const cli_prompt_1 = require("./util/cli-prompt");
 const transient_children_1 = require("./transient-children");
+const process_admission_1 = require("./process-admission");
 const readline_1 = require("readline");
 const tree_kill_1 = __importDefault(require("tree-kill"));
 const workspace_resolution_1 = require("./workspace-resolution");
@@ -176,6 +177,7 @@ function registerTicketsRoutes(deps) {
         }
         const requestId = (0, ids_1.newId)();
         const projectId = project.id;
+        const admission = (0, process_admission_1.captureProcessAdmission)(projectId);
         const filePath = ticketPath(req);
         let hasAttachments = false;
         let baseUserPrompt = `Generate a spec for the following idea:\n\n${idea.trim()}`;
@@ -193,6 +195,10 @@ function registerTicketsRoutes(deps) {
                 console.error('[project-router] generate-spec attachment extraction error:', err);
             }
         }
+        if (!admission.isCurrent()) {
+            res.status(409).json({ error: 'Project is being removed' });
+            return;
+        }
         // Parse contextScope from body. Quick and Explore share the same Context
         // Awareness controls; Quick still keeps Contract Refine as a top-level
         // field for the refine scheduler.
@@ -325,6 +331,8 @@ function registerTicketsRoutes(deps) {
                 }
                 catch { /* best-effort */ }
             }
+            if (!admission.isCurrent())
+                return;
             broadcast({
                 type: 'spec_gen_error', projectId, requestId,
                 error: `Spec generation timed out after ${Math.round(GENERATE_SPEC_TIMEOUT_MS / 1000)}s`,
@@ -355,6 +363,8 @@ function registerTicketsRoutes(deps) {
         child.on('error', (err) => {
             clearSpecGenWatchdog();
             console.error(`[project-router] spec-gen spawn failed (${binary}): ${err.message}`);
+            if (!admission.isCurrent())
+                return;
             const errMsg = {
                 type: 'spec_gen_error', projectId, requestId,
                 error: `Failed to launch ${binary}: ${err.message}`,
@@ -374,6 +384,8 @@ function registerTicketsRoutes(deps) {
         const turnStartedAt = new Date().toISOString();
         const stdoutReader = (0, readline_1.createInterface)({ input: child.stdout, crlfDelay: Infinity });
         stdoutReader.on('line', (line) => {
+            if (!admission.isCurrent())
+                return;
             const adapterEv = adapter.parseStreamLine(line);
             if (adapterEv)
                 adapterEvents.push(adapterEv);
@@ -454,6 +466,8 @@ function registerTicketsRoutes(deps) {
         });
         child.on('close', async (code) => {
             clearSpecGenWatchdog();
+            if (!admission.isCurrent())
+                return;
             let createdTicketId = null;
             // When claude burns its whole --max-turns budget it exits non-zero with
             // a result event of subtype:error_max_turns — but it may already have
@@ -539,6 +553,8 @@ function registerTicketsRoutes(deps) {
                         catch (err) {
                             console.error('[project-router] generate-spec attachment migration error:', err);
                         }
+                        if (!admission.isCurrent())
+                            return;
                     }
                     const ticketMsg = {
                         type: 'ticket_created', ticket: created,
@@ -566,6 +582,8 @@ function registerTicketsRoutes(deps) {
                         const refineDescription = created.description;
                         const refineModel = req.body?.model ?? null;
                         process.nextTick(() => {
+                            if (!admission.isCurrent())
+                                return;
                             void (0, contract_refine_runner_1.runContractRefineForQuick)({
                                 db: ctx(req).db,
                                 projectId: project.id,
@@ -1576,6 +1594,7 @@ function registerTicketsRoutes(deps) {
         const adapter = (0, providers_1.getAdapter)(provider);
         const requestId = (0, ids_1.newId)();
         const projectId = project.id;
+        const admission = (0, process_admission_1.captureProcessAdmission)(projectId);
         // Model used for the spawn (claude runs its CLI default, codex is pinned to
         // gpt-5.5, other providers use the adapter default). Used only as the
         // fallback model for cost accounting when the stream carries none.
@@ -1594,7 +1613,7 @@ function registerTicketsRoutes(deps) {
             `- The SHORT-SUMMARY line MUST always be present. If the user's refinement does not change what the spec is about, keep the previous summary verbatim. Never omit the line.\n` +
             `- After the SHORT-SUMMARY line and blank line, output ONLY the modified description in markdown. No preamble, no explanation, no wrapping.\n` +
             `- Preserve the existing markdown structure and section headings in the description.\n` +
-            `- If the user asks to add technical details, briefly check CLAUDE.md and the project directory structure (ls, not deep reads) to ground your edits.\n` +
+            `- If the user asks to add technical details, briefly check CLAUDE.md and the project directory structure with Read, Grep, or Glob (not deep reads) to ground your edits.\n` +
             `- Keep it concise and actionable.\n` +
             `- Do NOT create files, tickets, or issues. Only output text.`;
         const refinementRule = isRefinement
@@ -1629,6 +1648,10 @@ function registerTicketsRoutes(deps) {
                 console.error('[project-router] ai-edit attachment extraction error:', err);
             }
         }
+        if (!admission.isCurrent()) {
+            res.status(409).json({ error: 'Project is being removed' });
+            return;
+        }
         let binary;
         let args;
         if (provider === 'codex') {
@@ -1640,7 +1663,9 @@ function registerTicketsRoutes(deps) {
             binary = 'claude';
             args = [
                 '--dangerously-skip-permissions',
-                '--tools', 'default',
+                // AI Edit may ground prose in the repo, but it never needs shell,
+                // network, MCP, or filesystem mutation authority.
+                '--tools', 'Read,Grep,Glob',
                 '--output-format', 'stream-json',
                 '--verbose',
                 '--max-turns', '4',
@@ -1667,6 +1692,7 @@ function registerTicketsRoutes(deps) {
             stdio: ['ignore', 'pipe', 'pipe'],
             cwd: project.path,
         });
+        (0, transient_children_1.trackTransientChild)(projectId, child);
         _aiEditProcesses.set(requestId, child);
         // Pipe stderr to server log so failures surface for debugging.
         let aiEditStderrBuf = '';
@@ -1683,6 +1709,8 @@ function registerTicketsRoutes(deps) {
         child.on('error', (err) => {
             console.error(`[project-router] ai-edit spawn failed (${binary}): ${err.message}`);
             _aiEditProcesses.delete(requestId);
+            if (!admission.isCurrent())
+                return;
             const errMsg = {
                 type: 'ticket_ai_edit_error', projectId, ticketId: Number(ticketId),
                 requestId, error: `Failed to launch ${binary}: ${err.message}`,
@@ -1755,6 +1783,8 @@ function registerTicketsRoutes(deps) {
         });
         child.on('close', (code) => {
             _aiEditProcesses.delete(requestId);
+            if (!admission.isCurrent())
+                return;
             const delivered = code === 0 && buffer.trim().length > 0;
             if (delivered) {
                 const msg = {

package/server/dist/providers/claude-adapter.js

@@ -42,17 +42,8 @@ function normaliseModel(model) {
             return model || 'sonnet';
     }
 }
-/** Default arg block every claude spawn shares. `--setting-sources` is appended
- *  separately per-spawn (see `commonFlagsFor`) because its value depends on
- *  whether the caller opted into loading the user's full Claude environment. */
-const COMMON_FLAGS = [
-    '--dangerously-skip-permissions',
-    '--tools', 'default',
-    '--output-format', 'stream-json',
-    '--verbose',
-];
 /**
- * COMMON_FLAGS + the `--setting-sources` value for this spawn.
+ * Common flags + the effective tool boundary for this spawn.
  *
  * Default (`project,local`) isolates app-spawned claude from the *user's*
  * global Claude config. Without this, the child loads ~/.claude (user CLAUDE.md
@@ -68,8 +59,23 @@ const COMMON_FLAGS = [
  * CLAUDE.md + hooks, which is the user's explicit opt-in via the toggle.
  */
 function commonFlagsFor(opts) {
+    const toolPolicy = opts.toolPolicy ?? 'default';
+    const toolArgs = toolPolicy === 'none'
+        // Claude silently drops an empty tool list on some versions and falls back
+        // to the default toolkit. A non-existent sentinel is the established,
+        // tested way this repo disables every tool (see context-scope.ts).
+        ? ['--tools', '__none__']
+        : toolPolicy === 'read-only'
+            ? ['--tools', 'Read,Grep,Glob']
+            : ['--tools', 'default'];
     return [
-        ...COMMON_FLAGS,
+        // No approval bypass is necessary when no tool can be invoked. Keeping it
+        // off also makes the pure-output boundary fail closed if Claude ever
+        // changes how it interprets the sentinel.
+        ...(toolPolicy === 'none' ? [] : ['--dangerously-skip-permissions']),
+        ...toolArgs,
+        '--output-format', 'stream-json',
+        '--verbose',
         '--setting-sources',
         opts.loadUserEnv ? 'user,project,local' : 'project,local',
         // Native reasoning-effort flag (claude CLI accepts low|medium|high|xhigh|max).
@@ -80,7 +86,9 @@ function commonFlagsFor(opts) {
 function buildClaudeArgs(action, opts) {
     const args = [];
     const model = normaliseModel(opts.model);
-    const commonFlags = commonFlagsFor(opts);
+    // Titles are unconditionally pure-output. Centralising the policy here keeps
+    // both ChatManager and AgentChatManager from accidentally regaining tools.
+    const commonFlags = commonFlagsFor(action === 'auto-title' ? { ...opts, toolPolicy: 'none' } : opts);
     switch (action) {
         case 'chat-turn': {
             args.push('--model', model);
@@ -151,7 +159,7 @@ function buildClaudeArgs(action, opts) {
             if (opts.maxTurns != null)
                 args.push('--max-turns', String(opts.maxTurns));
             // Caller passes --tools override via extraArgs when scoped; otherwise
-            // 'default' from COMMON_FLAGS applies.
+            // the default policy from commonFlagsFor applies.
             if (opts.systemPrompt)
                 args.push('--system-prompt', opts.systemPrompt);
             args.push('-p', opts.prompt);