specrails-desktop 2.29.2 → 2.29.4

package/server/dist/db.js

@@ -1405,6 +1405,27 @@ const MIGRATIONS = [
         }
         backfillTerminalRailPrTicketEffects(db);
     },
+    // Migration 53: an allocation rollback is the one legal way a previously
+    // superseded delivery can become active again. Persist the failed replacement
+    // id on the restored predecessor so clients can distinguish that explicit
+    // rollback from an ordinary stale non-terminal replay.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all()
+            .map((row) => row.name));
+        if (!cols.has('restored_from_delivery_id')) {
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN restored_from_delivery_id TEXT`);
+        }
+    },
+    // Migration 54: automatic worktree release quarantines authenticated overlay
+    // roots instead of deleting them. Persist the bounded archive locations so
+    // recovery remains discoverable after restart and card refresh.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all()
+            .map((row) => row.name));
+        if (!cols.has('safety_archives')) {
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN safety_archives TEXT NOT NULL DEFAULT '[]'`);
+        }
+    },
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need

package/server/dist/mcp/tools/rails.js

@@ -120,6 +120,12 @@ function railsTools() {
                     .enum(['low', 'medium', 'high'])
                     .optional()
                     .describe('Reasoning-effort tier for loop launches (launch, loop mode). From the in-app agent chat, omitting it defaults to the launching conversation\'s effort when that is low/medium/high.'),
+                targetPrNumber: zod_1.z
+                    .number()
+                    .int()
+                    .min(1)
+                    .optional()
+                    .describe('Deliver INTO an existing open PR instead of creating a new one (launch). When the user names an existing PR ("extend PR #151"), pass its number here — the rail then works on that PR\'s head branch and settle pushes to it; NEVER launch without it in that case (a plain launch would create a duplicate PR). The PR must be open and same-repo (fork PRs are rejected with target_pr_fork).'),
             },
             async handler(ctx, args) {
                 const base = `${(0, types_1.projectPath)(ctx, args.projectId)}/rails`;
@@ -206,6 +212,8 @@ function railsTools() {
                             body.loopId = args.loopId;
                         if (args.reasoning_effort !== undefined)
                             body.reasoning_effort = args.reasoning_effort;
+                        if (args.targetPrNumber !== undefined)
+                            body.targetPrNumber = args.targetPrNumber;
                         // Origin link (safe-pr-review-flow): a launch driven by the in-app
                         // agent carries its conversation id (from the loopback header, via
                         // ctx) so the PR decision card is posted back into that conversation.

package/server/dist/pr-lifecycle.js

@@ -1,16 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PR_LIFECYCLE_JSON_FIELDS = void 0;
+exports.verifyPushRemoteForPr = verifyPushRemoteForPr;
 exports.observePrLifecycle = observePrLifecycle;
+exports.matchesRecordedPrIdentity = matchesRecordedPrIdentity;
 exports.isExactOpenPr = isExactOpenPr;
 const SHA_RE = /^[0-9a-f]{40,64}$/i;
-exports.PR_LIFECYCLE_JSON_FIELDS = 'state,isDraft,headRefName,baseRefName,headRefOid,mergeCommit,commits';
+exports.PR_LIFECYCLE_JSON_FIELDS = 'state,isDraft,headRefName,baseRefName,isCrossRepository,headRefOid,mergeCommit,commits';
 function firstLine(result) {
     return (result.stderr.trim() || result.stdout.trim()).split('\n')[0].trim().slice(0, 512);
 }
 function oid(value) {
     return typeof value === 'string' && SHA_RE.test(value) ? value.toLowerCase() : null;
 }
+function githubRepositoryIdentity(rawUrl, kind) {
+    const raw = rawUrl.trim();
+    if (!raw || raw.includes('\n') || raw.includes('\r'))
+        return null;
+    let host = '';
+    let pathname = '';
+    try {
+        const parsed = new URL(raw);
+        if (!['http:', 'https:', 'ssh:', 'git:'].includes(parsed.protocol))
+            return null;
+        // The verified target is later passed as an argv element. Never carry
+        // embedded credentials or token-like URL suffixes into a child process or
+        // its timeout/error diagnostics; credential helpers remain the only
+        // supported authentication channel. SSH's conventional `git` username is
+        // identity, not a secret, and is safe to retain.
+        if (parsed.password || parsed.search || parsed.hash)
+            return null;
+        if (parsed.username && !(parsed.protocol === 'ssh:' && parsed.username === 'git'))
+            return null;
+        host = parsed.hostname.toLowerCase();
+        pathname = parsed.pathname;
+    }
+    catch {
+        // SCP-style Git URL: git@github.com:owner/repository.git
+        const scp = /^(?:git@)?([^@:/\s]+):(.+)$/.exec(raw);
+        if (!scp)
+            return null;
+        host = scp[1].toLowerCase();
+        pathname = scp[2];
+        if (pathname.includes('?') || pathname.includes('#'))
+            return null;
+    }
+    const segments = pathname.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+    if (kind === 'pr') {
+        if (segments.length !== 4 || segments[2] !== 'pull' || !/^\d+$/.test(segments[3]))
+            return null;
+    }
+    else if (segments.length !== 2) {
+        return null;
+    }
+    const owner = segments[0]?.toLowerCase();
+    const repository = segments[1]?.replace(/\.git$/i, '').toLowerCase();
+    return host && owner && repository ? `${host}/${owner}/${repository}` : null;
+}
+/**
+ * Prove that the local push remote names the repository that owns a same-repo
+ * PR. Branch names alone are insufficient: another clone may call its fork
+ * `origin`, which would otherwise receive the exact recovery refspec.
+ */
+async function verifyPushRemoteForPr(exec, repoDir, prUrl, remote = 'origin') {
+    const expected = githubRepositoryIdentity(prUrl, 'pr');
+    if (!expected)
+        return { ok: false, detail: 'the recorded PR URL does not identify an exact GitHub repository' };
+    let result;
+    try {
+        result = await exec.run('git', ['remote', 'get-url', '--push', '--all', remote], repoDir);
+    }
+    catch (err) {
+        return { ok: false, detail: `the ${remote} push remote could not be inspected: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    if (result.code !== 0) {
+        return { ok: false, detail: `the ${remote} push remote could not be inspected: ${firstLine(result) || `exit ${result.code}`}` };
+    }
+    const pushTargets = result.stdout.split(/\r?\n/).map((value) => value.trim()).filter(Boolean);
+    if (pushTargets.length !== 1) {
+        return {
+            ok: false,
+            detail: `the ${remote} push remote must resolve to exactly one URL; found ${pushTargets.length}`,
+        };
+    }
+    const pushTarget = pushTargets[0];
+    const actual = githubRepositoryIdentity(pushTarget, 'remote');
+    if (!actual)
+        return { ok: false, detail: `the ${remote} push remote is not an unambiguous GitHub repository URL` };
+    if (actual !== expected) {
+        return { ok: false, detail: `the ${remote} push remote does not own the recorded PR repository` };
+    }
+    return { ok: true, identity: actual, pushTarget };
+}
 /**
  * Observe one exact PR and, when requested, whether its immutable commit/merge
  * evidence contains a delivery SHA. The helper never guesses from a ledger row:
@@ -42,11 +123,15 @@ async function observePrLifecycle(exec, repoDir, prUrl, expectedSha) {
         // A merged PR's live head branch can advance after the merge. Its current
         // headRefOid is therefore NOT proof that the merge included that object.
         // Only the PR's commit snapshot / merge commit are valid MERGED evidence.
-        const observedOids = new Set([
-            ...(normalizedState === 'OPEN' ? [headRefOid] : []),
-            mergeCommitOid,
-            ...commitOids,
-        ].filter((value) => value !== null));
+        // While OPEN, delivery verification is intentionally stronger than mere
+        // ancestry: the remote PR head itself must still be the frozen delivery
+        // object. Otherwise a concurrent writer could advance/substitute the head
+        // and a stale card would incorrectly report our exact push as verified.
+        // CLOSED/MERGED no longer have a mutable review head, so their immutable PR
+        // commit snapshot (or merge object) is the relevant inclusion evidence.
+        const observedOids = new Set((normalizedState === 'OPEN'
+            ? [headRefOid]
+            : [mergeCommitOid, ...commitOids]).filter((value) => value !== null));
         const includesExpectedSha = expected === null
             ? null
             : observedOids.has(expected)
@@ -60,6 +145,7 @@ async function observePrLifecycle(exec, repoDir, prUrl, expectedSha) {
             isDraft: parsed.isDraft === true,
             headRefName: typeof parsed.headRefName === 'string' ? parsed.headRefName : null,
             baseRefName: typeof parsed.baseRefName === 'string' ? parsed.baseRefName : null,
+            isCrossRepository: typeof parsed.isCrossRepository === 'boolean' ? parsed.isCrossRepository : null,
             headRefOid,
             mergeCommitOid,
             commitOids,
@@ -70,8 +156,14 @@ async function observePrLifecycle(exec, repoDir, prUrl, expectedSha) {
         return { ok: false, detail: 'unparseable gh pr view output' };
     }
 }
+/** Head/base identity is required in every lifecycle state. A PR retargeted to
+ * another base must never satisfy delivery merely because it still lists the
+ * expected commit. */
+function matchesRecordedPrIdentity(observation, branch, baseBranch) {
+    return observation.ok && observation.isCrossRepository === false &&
+        observation.headRefName === branch && observation.baseRefName === baseBranch;
+}
 /** OPEN is continuation-safe only for the same recorded head/base identity. */
 function isExactOpenPr(observation, branch, baseBranch) {
-    return observation.ok && observation.state === 'OPEN' &&
-        observation.headRefName === branch && observation.baseRefName === baseBranch;
+    return observation.ok && matchesRecordedPrIdentity(observation, branch, baseBranch) && observation.state === 'OPEN';
 }

package/server/dist/project-git.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseWorktreePorcelain = parseWorktreePorcelain;
+exports.inspectProjectCheckoutCleanliness = inspectProjectCheckoutCleanliness;
 exports.getProjectGitInfo = getProjectGitInfo;
 exports.compactCheckoutError = compactCheckoutError;
 exports.checkoutProjectBranch = checkoutProjectBranch;
@@ -17,6 +18,7 @@ const integration_branch_1 = require("./integration-branch");
 // against `git branch` output, so no user string can smuggle flags or refs.
 const GIT_TIMEOUT_MS = 10_000;
 const GIT_MAX_BUFFER = 4 * 1024 * 1024;
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
 function git(repoDir, args) {
     return new Promise((resolve, reject) => {
         (0, child_process_1.execFile)('git', args, { cwd: repoDir, env: file_provenance_1.GIT_EXEC_ENV, timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, windowsHide: true }, (err, stdout, stderr) => {
@@ -57,6 +59,25 @@ async function listLocalBranches(repoDir) {
     const out = await git(repoDir, ['branch', '--format=%(refname:short)']);
     return out.split('\n').map((b) => b.trim()).filter(Boolean);
 }
+/** Lossless checkout preflight. Unlike the dashboard-oriented aggregate info,
+ * this result is tri-state: an unreadable status is never interpreted as a
+ * clean checkout. */
+async function inspectProjectCheckoutCleanliness(repoDir) {
+    try {
+        // Tracked modifications only. `git checkout` never loses untracked files —
+        // app-owned state (`.specrails/local-tickets.json`) or editor droppings
+        // must not permanently block Checkout; a genuine untracked collision still
+        // aborts inside git itself and surfaces as a failed checkout.
+        const status = await git(repoDir, ['status', '--porcelain', '--untracked-files=no']);
+        return { ok: true, clean: status === '' };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            detail: `Working tree cleanliness could not be verified: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
 async function getProjectGitInfo(repoDir) {
     try {
         await git(repoDir, ['rev-parse', '--is-inside-work-tree']);
@@ -159,14 +180,22 @@ async function remoteBranchExists(repoDir, branch) {
 /** Checkout a PR/review branch into the user's main repo. Unlike the small
  *  AgentGitBar switcher, this path may materialize a local tracking branch from
  *  `origin/<branch>` because a PR delivery can be remote-only after worktree
- *  cleanup or a fresh clone. It never overwrites dirty local work. */
-async function checkoutProjectReviewBranch(repoDir, branch) {
+ *  cleanup or a fresh clone. When supplied, `expectedSha` is an immutable
+ *  delivery lease: a divergent local/remote branch is preserved and checkout
+ *  succeeds only when the final branch HEAD equals that exact object. It never
+ *  overwrites dirty local work. */
+async function checkoutProjectReviewBranch(repoDir, branch, expectedSha) {
     const target = branch.trim();
     if (!(0, integration_branch_1.isValidBranchName)(target))
         return { ok: false, error: `Invalid branch name: ${branch}` };
+    const expected = expectedSha?.trim().toLowerCase() ?? null;
+    if (expected !== null && !COMMIT_SHA_RE.test(expected)) {
+        return { ok: false, error: 'The verified delivery commit is invalid; checkout was not attempted.' };
+    }
     let dirty = false;
     try {
-        dirty = (await git(repoDir, ['status', '--porcelain'])) !== '';
+        // Tracked modifications only — see inspectProjectCheckoutCleanliness.
+        dirty = (await git(repoDir, ['status', '--porcelain', '--untracked-files=no'])) !== '';
     }
     catch (err) {
         return { ok: false, error: err instanceof Error ? err.message : 'git status failed' };
@@ -185,9 +214,27 @@ async function checkoutProjectReviewBranch(repoDir, branch) {
     }
     try {
         if (branches.includes(target)) {
+            if (expected) {
+                const localSha = (await git(repoDir, ['rev-parse', '--verify', `refs/heads/${target}`])).toLowerCase();
+                if (localSha !== expected) {
+                    return {
+                        ok: false,
+                        error: `Local branch '${target}' points to ${localSha.slice(0, 8)}, not verified delivery ${expected.slice(0, 8)}. It was preserved and not checked out.`,
+                    };
+                }
+            }
             await git(repoDir, ['checkout', target]);
         }
         else if (await remoteBranchExists(repoDir, target)) {
+            if (expected) {
+                const remoteSha = (await git(repoDir, ['rev-parse', '--verify', `refs/remotes/origin/${target}`])).toLowerCase();
+                if (remoteSha !== expected) {
+                    return {
+                        ok: false,
+                        error: `Remote branch 'origin/${target}' points to ${remoteSha.slice(0, 8)}, not verified delivery ${expected.slice(0, 8)}. Checkout was not attempted.`,
+                    };
+                }
+            }
             await git(repoDir, ['checkout', '-b', target, '--track', `origin/${target}`]);
         }
         else {
@@ -197,6 +244,24 @@ async function checkoutProjectReviewBranch(repoDir, branch) {
     catch (err) {
         return { ok: false, error: compactCheckoutError(err instanceof Error ? err.message : 'git checkout failed') };
     }
+    if (expected) {
+        try {
+            const [currentBranch, currentSha] = await Promise.all([
+                git(repoDir, ['rev-parse', '--abbrev-ref', 'HEAD']),
+                git(repoDir, ['rev-parse', '--verify', 'HEAD']),
+            ]);
+            if (currentBranch !== target || currentSha.toLowerCase() !== expected) {
+                return {
+                    ok: false,
+                    error: `Checkout changed concurrently and did not land on verified delivery ${expected.slice(0, 8)}. No reset or cleanup was performed.`,
+                };
+            }
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: compactCheckoutError(err instanceof Error ? err.message : 'git checkout verification failed') };
+        }
+    }
     // A failed ff-only pull should not undo a successful checkout; the branch is
     // already where the user can inspect/fix it. Surface only hard checkout errors.
     await git(repoDir, ['pull', '--ff-only']).catch(() => { });