specrails-desktop 2.32.0 → 2.34.0

package/server/dist/project-router-spending.js

@@ -64,7 +64,17 @@ function registerSpendingRoutes(deps) {
             return;
         }
         try {
-            res.json((0, spending_1.getSpending)(ctx(req).db, ctx(req).project.id, filters, makeTitleResolver(req)));
+            const spending = (0, spending_1.getSpending)(ctx(req).db, ctx(req).project.id, filters, makeTitleResolver(req));
+            // Agent-mission spend (app-level desktop.sqlite ledger, pinned to this
+            // project) folds in additively — a failure never breaks the dashboard.
+            let agentMissions;
+            try {
+                agentMissions = (0, spending_1.getAgentMissionSpending)(registry.desktopDb, ctx(req).project.id, filters);
+            }
+            catch (err) {
+                console.error('[project-router] agent-mission spending error (non-fatal):', err);
+            }
+            res.json({ ...spending, ...(agentMissions ? { agentMissions } : {}) });
         }
         catch (err) {
             console.error('[project-router] spending error:', err);

package/server/dist/provider-detection.js

@@ -0,0 +1,222 @@
+"use strict";
+// App-level provider detection singleton.
+//
+// Provider availability is a property of the MACHINE, not of any project: this
+// module probes every registered adapter (binary presence, version, auth state),
+// applies the beta-flag vetoes at the source, and caches the result for 60s.
+// Consumers (provider-selection, routers, setup) read the same snapshot, so the
+// whole app agrees on which providers exist at any moment.
+//
+// Spec: openspec/changes/global-core-zero-friction/specs/provider-auto-detection/spec.md
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_PROBE_TIMEOUT_MS = void 0;
+exports.isCodexBetaDisabled = isCodexBetaDisabled;
+exports.isGeminiBetaDisabled = isGeminiBetaDisabled;
+exports.getDetectionSnapshot = getDetectionSnapshot;
+exports.getDetectedIdsSync = getDetectedIdsSync;
+exports.getSnapshotSync = getSnapshotSync;
+exports.refreshDetection = refreshDetection;
+exports._resetDetectionForTests = _resetDetectionForTests;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const providers_1 = require("./providers");
+const core_compat_1 = require("./core-compat");
+const CACHE_TTL_MS = 60_000;
+/** Auth probes are offline file checks today, but keep the contract bounded. */
+exports.AUTH_PROBE_TIMEOUT_MS = 1500;
+// Emergency rollback for the codex provider: SPECRAILS_CODEX_BETA=0 forces
+// codex unavailable without redeploying. The pre-rebrand SPECRAILS_HUB_CODEX_BETA
+// name is read as a legacy fallback when the new var is unset.
+function isCodexBetaDisabled() {
+    const v = process.env.SPECRAILS_CODEX_BETA ?? process.env.SPECRAILS_HUB_CODEX_BETA;
+    return v === '0';
+}
+// Gemini parity kill switch: only the exact string '0' disables.
+function isGeminiBetaDisabled() {
+    return process.env.SPECRAILS_GEMINI_BETA === '0';
+}
+function isVetoed(id) {
+    if (id === 'codex')
+        return isCodexBetaDisabled();
+    if (id === 'gemini')
+        return isGeminiBetaDisabled();
+    return false;
+}
+/**
+ * Offline, provider-specific auth probe. Never throws; degrades to 'unknown'.
+ * These are file-presence heuristics — cheap, offline, and bounded — chosen
+ * over spawning login-status subcommands (slow, sometimes network-bound).
+ */
+function probeAuthState(id, home) {
+    try {
+        switch (id) {
+            case 'claude':
+                // ~/.claude.json exists once the CLI has run/logged in. Credentials may
+                // also live in the OS keychain, so absence is 'unknown', never a hard
+                // 'unauthenticated'.
+                return fs.existsSync(path.join(home, '.claude.json')) ? 'authenticated' : 'unknown';
+            case 'codex':
+                // Codex persists auth at ~/.codex/auth.json; its absence reliably means
+                // no login has happened on this machine.
+                return fs.existsSync(path.join(home, '.codex', 'auth.json'))
+                    ? 'authenticated'
+                    : 'unauthenticated';
+            case 'gemini': {
+                // OAuth creds land under ~/.gemini; an API key via env also counts.
+                if (process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY)
+                    return 'authenticated';
+                return fs.existsSync(path.join(home, '.gemini', 'oauth_creds.json'))
+                    ? 'authenticated'
+                    : 'unknown';
+            }
+            default:
+                // Kimi (and future providers) have no safe offline probe today.
+                return 'unknown';
+        }
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function usabilityError(adapter, d) {
+    if (!d.installed)
+        return d.error ?? `${adapter.displayName} CLI was not found on PATH.`;
+    if (!d.executable)
+        return d.error ?? `${adapter.displayName} was found but its readiness probe failed.`;
+    if (adapter.minCliVersion && d.meetsMinimum !== true) {
+        return d.error
+            ?? `${adapter.displayName} ${d.version ?? '(unknown version)'} does not satisfy the required minimum ${adapter.minCliVersion}.`;
+    }
+    return undefined;
+}
+async function probeAdapter(adapter, home) {
+    const vetoed = isVetoed(adapter.id);
+    let detection;
+    try {
+        detection = await adapter.detectInstalled();
+    }
+    catch (err) {
+        detection = {
+            installed: false,
+            executable: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    const error = usabilityError(adapter, detection);
+    let usable = !vetoed && error === undefined;
+    // Kimi selection additionally requires a Core build that can render its
+    // skills — same gate /available-providers applies.
+    if (usable && adapter.id === 'kimi') {
+        try {
+            const core = await (0, core_compat_1.checkCoreCompat)();
+            if (!(0, core_compat_1.coreCompatSupportsProvider)(core, 'kimi'))
+                usable = false;
+        }
+        catch {
+            usable = false;
+        }
+    }
+    return {
+        id: adapter.id,
+        displayName: adapter.displayName,
+        installed: detection.installed,
+        executable: detection.executable,
+        version: detection.version,
+        meetsMinimum: detection.meetsMinimum,
+        authState: detection.installed ? probeAuthState(adapter.id, home) : 'unknown',
+        usable,
+        error,
+        ...(vetoed ? { vetoed: true } : {}),
+    };
+}
+let _snapshot = null;
+let _inflight = null;
+async function runDetection() {
+    const home = os.homedir();
+    const adapters = (0, providers_1.listAdapters)();
+    const results = await Promise.all(adapters.map((a) => probeAdapter(a, home)));
+    const providers = {};
+    for (const r of results)
+        providers[r.id] = r;
+    const snapshot = {
+        providers,
+        detected: results.filter((r) => r.usable).map((r) => r.id),
+        at: Date.now(),
+    };
+    _snapshot = snapshot;
+    return snapshot;
+}
+/**
+ * Read the detection snapshot. Cached for 60s; `refresh: true` bypasses the
+ * cache (still coalescing concurrent refreshes into one probe run).
+ */
+async function getDetectionSnapshot(opts) {
+    const fresh = _snapshot && Date.now() - _snapshot.at < CACHE_TTL_MS;
+    if (fresh && !opts?.refresh)
+        return _snapshot;
+    if (_inflight)
+        return _inflight;
+    _inflight = runDetection().finally(() => {
+        _inflight = null;
+    });
+    return _inflight;
+}
+/**
+ * Synchronous accessor for the last snapshot's usable ids. Returns null when no
+ * detection has completed yet — callers fall back to legacy project-row data.
+ */
+function getDetectedIdsSync() {
+    return _snapshot ? _snapshot.detected : null;
+}
+function getSnapshotSync() {
+    return _snapshot;
+}
+/**
+ * Refresh and report whether the usable set changed vs the previous snapshot.
+ * Callers use the flag to decide whether to broadcast `providers.detected_changed`.
+ */
+async function refreshDetection() {
+    const before = _snapshot?.detected.join(',') ?? null;
+    const snapshot = await getDetectionSnapshot({ refresh: true });
+    const after = snapshot.detected.join(',');
+    return { snapshot, changed: before !== null && before !== after };
+}
+/** Test-only: clear module state. */
+function _resetDetectionForTests() {
+    _snapshot = null;
+    _inflight = null;
+}

package/server/dist/provider-selection.js

@@ -1,60 +1,112 @@
 "use strict";
-// Per-invocation provider selection for multi-provider projects.
+// Per-invocation provider selection.
 //
-// A project carries a primary `provider` (single source for single-provider
-// projects, and the fallback default) plus a `providers` list of every
-// installed provider. Add Spec, rails and the terminal can request a specific
-// engine per invocation; these helpers resolve and validate that request
-// against what the project actually has installed.
+// Provider availability is a MACHINE property (see provider-detection.ts): every
+// project offers every detected, non-vetoed provider. These helpers resolve and
+// validate per-invocation engine requests against that detected set, with the
+// project row's `provider`/`providers` columns as the legacy fallback when no
+// detection snapshot exists yet (startup, unit tests).
 //
-// Invariant: when `providers.length === 1` every helper collapses to the single
-// provider, so single-provider projects behave exactly as before.
+// The detected set is injected via `setDetectedProvidersSupplier` so this module
+// stays synchronous and unit-testable with no detection singleton import cycle.
+//
+// Invariant: when the effective list has length 1 every helper collapses to the
+// single provider, so single-provider machines behave exactly as before.
+//
+// Spec: openspec/changes/global-core-zero-friction/specs/provider-auto-detection/spec.md
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_PREFERENCE_ORDER = void 0;
+exports.setDetectedProvidersSupplier = setDetectedProvidersSupplier;
+exports.installedProviders = installedProviders;
 exports.isProviderEnabled = isProviderEnabled;
 exports.isMultiProvider = isMultiProvider;
+exports.derivePrimaryProvider = derivePrimaryProvider;
 exports.resolveProvider = resolveProvider;
 exports.validateRequestedProvider = validateRequestedProvider;
+/** Fixed preference order for primary derivation when the stored primary is gone. */
+exports.PROVIDER_PREFERENCE_ORDER = ['claude', 'codex', 'gemini', 'kimi'];
+let _detectedSupplier = null;
+/**
+ * Wire the app-level detection singleton in (done once at startup in index.ts).
+ * A supplier returning null (no snapshot yet) falls back to project-row data.
+ */
+function setDetectedProvidersSupplier(fn) {
+    _detectedSupplier = fn;
+}
+function detectedProviders() {
+    if (!_detectedSupplier)
+        return null;
+    const list = _detectedSupplier();
+    if (!Array.isArray(list) || list.length === 0)
+        return null;
+    return list;
+}
 /**
- * Normalised installed-provider list. `getProject` always populates
- * `providers`, but this tolerates a row where it is missing/empty (legacy or
- * hand-built rows) by falling back to the primary provider.
+ * The effective provider list for a project: the detected set when available,
+ * else the row's `providers`, else the primary. Never empty.
  */
 function installedProviders(project) {
+    const detected = detectedProviders();
+    if (detected)
+        return detected;
     if (Array.isArray(project.providers) && project.providers.length > 0)
         return project.providers;
     return [project.provider ?? 'claude'];
 }
-/** True when `id` is one of the providers installed on the project. */
+/** True when `id` is one of the providers effectively available. */
 function isProviderEnabled(project, id) {
     if (!id)
         return false;
     return installedProviders(project).includes(id);
 }
-/** True when the project offers a choice of engines (more than one installed). */
+/** True when the project offers a choice of engines (more than one available). */
 function isMultiProvider(project) {
     return installedProviders(project).length > 1;
 }
+/**
+ * Primary derivation (spec: "Primary provider is derived with stability"):
+ * the stored primary while it is still available; otherwise claude if
+ * available; otherwise the first available provider in the fixed preference
+ * order; otherwise the stored primary (legacy, no detection snapshot).
+ */
+function derivePrimaryProvider(project) {
+    const available = installedProviders(project);
+    const stored = project.provider;
+    if (stored && available.includes(stored))
+        return stored;
+    for (const p of exports.PROVIDER_PREFERENCE_ORDER) {
+        if (available.includes(p))
+            return p;
+    }
+    return stored ?? available[0];
+}
 /**
  * Resolve the effective provider for a per-invocation request.
- * Returns the requested provider when it is installed on the project; otherwise
- * falls back to the project's primary provider. Never throws — callers that
- * want strict validation should use `validateRequestedProvider` first.
+ * Returns the requested provider when it is available; otherwise falls back to
+ * the derived primary. Never throws — callers that want strict validation
+ * should use `validateRequestedProvider` first.
  */
 function resolveProvider(project, requested) {
     if (isProviderEnabled(project, requested))
         return requested;
-    return project.provider ?? installedProviders(project)[0];
+    const primary = derivePrimaryProvider(project);
+    if (typeof requested === 'string' && requested !== '') {
+        // A stored engine reference (rail ai_engine, conversation provider) naming
+        // a provider that is no longer detected — substitute, never block.
+        console.warn(`[provider-selection] provider '${requested}' unavailable; falling back to '${primary}'`);
+    }
+    return primary;
 }
 /**
  * Strict validation for route handlers. Returns the resolved provider when the
  * request is acceptable, or an `error` string when an explicit, non-empty
- * provider was requested that the project does not have installed. Omitting the
+ * provider was requested that is not currently available. Omitting the
  * provider (undefined/null/empty) is always acceptable and resolves to primary.
  */
 function validateRequestedProvider(project, requested) {
     const installed = installedProviders(project);
     if (requested === undefined || requested === null || requested === '') {
-        return { ok: true, provider: project.provider ?? installed[0] };
+        return { ok: true, provider: derivePrimaryProvider(project) };
     }
     if (typeof requested !== 'string') {
         return { ok: false, error: 'provider must be a string' };

package/server/dist/queue-manager.js

@@ -15,6 +15,7 @@ const win_spawn_1 = require("./util/win-spawn");
 const types_1 = require("./types");
 const command_resolver_1 = require("./command-resolver");
 const rail_isolation_1 = require("./rail-isolation");
+const repo_map_1 = require("./repo-map");
 const cli_prompt_1 = require("./util/cli-prompt");
 const stream_display_1 = require("./util/stream-display");
 const hooks_1 = require("./hooks");
@@ -2368,6 +2369,9 @@ class QueueManager {
         if (profileSnapshotPath) {
             spawnEnv = { ...spawnEnv, SPECRAILS_PROFILE_PATH: profileSnapshotPath };
         }
+        // Deterministic repo map (zero-AI, best-effort) — orients the pipeline's
+        // exploration phase so it doesn't spend its first turns on `ls`/`find`.
+        spawnEnv = (0, repo_map_1.injectRepoMapEnv)(spawnEnv, execution.repoDir);
         // ─── Plugin resolution + snapshot ──────────────────────────────────────
         // Active = installed + verify ok; degraded = installed but verify failed
         // or timed out. Degraded does NOT block spawn — rail proceeds, UI gets

package/server/dist/rail-pr-decision.js

@@ -73,6 +73,7 @@ const rail_pr_delivery_1 = require("./rail-pr-delivery");
 const rail_worktree_release_1 = require("./rail-worktree-release");
 const pr_naming_1 = require("./pr-naming");
 const pr_body_1 = require("./pr-body");
+const ai_invocations_1 = require("./ai-invocations");
 const jira_db_1 = require("./jira/jira-db");
 const rail_pr_store_1 = require("./rail-pr-store");
 const rail_worktrees_store_1 = require("./rail-worktrees-store");
@@ -1292,12 +1293,21 @@ async function runCreatePr(deps, row) {
     catch {
         changes = null;
     }
+    // Cost footer is best-effort: a lookup failure omits the line, never blocks.
+    let costUsd = null;
+    try {
+        costUsd = (0, ai_invocations_1.sumInvocationCostForRuns)(deps.db, snap.runIds);
+    }
+    catch {
+        costUsd = null;
+    }
     const title = (0, pr_naming_1.buildPrTitle)(ticketData, { loopName: row.loop_name });
     const body = (0, pr_body_1.buildCanonicalPrBody)({
         loopName: row.loop_name,
         baseBranch: row.base_branch,
         tickets: ticketData.map((t) => ({ ...t, branch: branchFor(t.ticketId) })),
         changes,
+        costUsd,
     });
     let next;
     // Underlying git/gh failure detail for a degraded or failed delivery —

package/server/dist/rails-router.js

@@ -460,6 +460,17 @@ function createRailsRouter() {
             res.status(400).json({ error: 'Rail has no tickets assigned' });
             return;
         }
+        // Per-rail spec cap: a single launch may carry at most
+        // MAX_TICKETS_PER_RAIL_LAUNCH specs — bigger batches must be chunked
+        // across rails (the milestone launcher does this automatically).
+        if (rail.ticketIds.length > rails_store_1.MAX_TICKETS_PER_RAIL_LAUNCH) {
+            res.status(400).json({
+                error: 'rail_ticket_cap_exceeded',
+                max: rails_store_1.MAX_TICKETS_PER_RAIL_LAUNCH,
+                ticketCount: rail.ticketIds.length,
+            });
+            return;
+        }
         // Concurrent-launch safety (parallel rails): a ticket already worked by an
         // ACTIVE run — this rail relaunched mid-run, or the same ticket sitting on
         // two rails — must not spawn a second concurrent writer. The per-ticket

package/server/dist/rails-store.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_RAILS = exports.BASE_RAIL_COUNT = void 0;
+exports.MAX_TICKETS_PER_RAIL_LAUNCH = exports.MAX_RAILS = exports.BASE_RAIL_COUNT = void 0;
 exports.ensureRailMeta = ensureRailMeta;
 exports.listRailIndices = listRailIndices;
 exports.railCount = railCount;
@@ -22,6 +22,10 @@ exports.BASE_RAIL_COUNT = 3;
 /** Hard cap on rails per project — keeps railIndex-keyed maps (metrics,
  *  pr-deliveries, worktree progress) bounded and the board renderable. */
 exports.MAX_RAILS = 12;
+/** Hard cap on specs a single rail may LAUNCH with — a bigger batch must be
+ *  chunked across several rails (the milestone launcher does this client-side;
+ *  the launch route rejects oversized rails with `rail_ticket_cap_exceeded`). */
+exports.MAX_TICKETS_PER_RAIL_LAUNCH = 3;
 /** Read the per-rail display names from rail_meta into a lookup map. */
 function railNames(db) {
     const rows = db.prepare('SELECT rail_index, name FROM rail_meta').all();