specrails-desktop 2.36.0 → 2.42.2

package/server/dist/core-update-manager.js

@@ -11,28 +11,13 @@ const path_1 = __importDefault(require("path"));
 const framework_manager_1 = require("./framework-manager");
 const semver_lite_1 = require("./semver-lite");
 const win_spawn_1 = require("./util/win-spawn");
-/**
- * CoreUpdateManager — the voluntary, app-global specrails-core update channel.
- *
- * The bundled framework (see FrameworkManager) is pinned to the core version
- * shipped inside the app build. This manager lets a user UPDATE specrails-core
- * independently of the desktop app: it queries npm for the latest published
- * version, and on an explicit request npm-installs that newer core into a temp
- * staging dir, materializes its framework into `~/.specrails/framework/<version>`
- * and atomically swaps `framework/current` to it — every project workspace that
- * symlinks `current/...` jumps to the new core with NO restart and NO per-project
- * `npx`. The previous `framework/<version>` dir is left intact (non-destructive).
- *
- * Detection is deliberately simple (KISS): npm `latest` strictly greater than the
- * installed `framework/current` version ⇒ an update is available. There is no
- * compatibility-range gate; the floor is the app-bundled core (the update only
- * ever moves the pointer UP — FrameworkManager.versionCheck has an anti-downgrade
- * guard so the next startup never reverts a manual update).
- *
- * The whole feature is gated on a bundled core being present (desktop mode); in
- * dev / non-desktop mode `isAvailable()` is false and projects use the legacy npx
- * path, so a core "update" would have no effect and the UI shows "unavailable".
- */
+const bundled_core_1 = require("./bundled-core");
+const core_runtime_1 = require("./core-runtime");
+const artifact_registry_1 = require("./artifact-registry");
+/** Voluntary Core updates retain the complete npm package and dependencies,
+ * publish its framework, then await every project refresh. Partial refreshes
+ * remain explicitly pending across restart and can retry without the network.
+ * Older packages/frameworks remain available for diagnosis and recovery. */
 exports.CORE_PACKAGE = 'specrails-core';
 const REGISTRY_URL = `https://registry.npmjs.org/${exports.CORE_PACKAGE}/latest`;
 const CHECK_TIMEOUT_MS = 10_000;
@@ -47,6 +32,9 @@ class CoreUpdateManager {
     latestVersion = null;
     lastCheckedAt = null;
     updating = false;
+    pendingVersion = null;
+    migrationError = null;
+    reseed;
     constructor(opts = {}) {
         this.home = opts.home;
         this.broadcast = opts.broadcast;
@@ -56,31 +44,49 @@ class CoreUpdateManager {
         this.makeFrameworkFn =
             opts.makeFramework ??
                 ((coreRoot) => new framework_manager_1.FrameworkManager({ home: this.home, broadcast: this.broadcast, coreRoot }));
-    }
-    /** A read-only FrameworkManager pointed at the bundled core. */
-    bundledFramework() {
-        return new framework_manager_1.FrameworkManager({ home: this.home });
+        this.reseed = opts.reseed ?? (async () => []);
+        try {
+            const cached = JSON.parse(fs_1.default.readFileSync(path_1.default.join((0, core_runtime_1.managedCoreRoot)(this.home), 'update-status.json'), 'utf8'));
+            if (typeof cached.latestVersion === 'string' && (0, semver_lite_1.isValidVersion)(cached.latestVersion) && Number.isFinite(cached.lastCheckedAt)) {
+                this.latestVersion = cached.latestVersion;
+                this.lastCheckedAt = cached.lastCheckedAt;
+            }
+            if (typeof cached.pendingVersion === 'string' && (0, semver_lite_1.isValidVersion)(cached.pendingVersion)) {
+                this.pendingVersion = cached.pendingVersion;
+                this.migrationError = typeof cached.migrationError === 'string' ? cached.migrationError : 'Core project refresh was interrupted. Retry to finish updating project files.';
+            }
+        }
+        catch { /* first launch / cache unavailable: installed state is independent */ }
     }
     /** True when the bundled-framework system is active (a bundled core is present). */
     isAvailable() {
-        return this.bundledFramework().isAvailable();
+        return (0, core_runtime_1.getCoreRuntimeStatus)(this.home).runtime !== null || (0, framework_manager_1.readCurrentFrameworkVersion)(this.home) !== null;
     }
     /** Current status — no network (uses the cached latest from the last check). */
     getStatus() {
-        const fm = this.bundledFramework();
-        const bundledVersion = fm.bundledVersion();
-        const currentVersion = (0, framework_manager_1.readCurrentFrameworkVersion)(this.home) ?? bundledVersion;
-        const updateAvailable = this.latestVersion != null &&
-            currentVersion != null &&
-            (0, semver_lite_1.isNewer)(this.latestVersion, currentVersion);
+        const selected = (0, core_runtime_1.getCoreRuntimeStatus)(this.home);
+        const bundledVersion = (0, bundled_core_1.getBundledCoreVersion)();
+        const frameworkVersion = (0, framework_manager_1.readCurrentFrameworkVersion)(this.home);
+        const currentVersion = frameworkVersion ?? selected.runtime?.version ?? null;
+        const updateAvailable = this.pendingVersion !== null ||
+            this.latestVersion != null &&
+                currentVersion != null &&
+                ((0, semver_lite_1.isNewer)(this.latestVersion, currentVersion) || selected.error !== null && this.latestVersion === currentVersion) &&
+                Number(this.latestVersion.split('.')[0]) <= 5;
         return {
-            available: fm.isAvailable(),
+            available: this.isAvailable(),
             currentVersion,
             bundledVersion,
             latestVersion: this.latestVersion,
             updateAvailable,
             updating: this.updating,
             lastCheckedAt: this.lastCheckedAt,
+            runtimeVersion: selected.runtime?.version ?? null,
+            runtimeSource: selected.runtime?.source ?? null,
+            frameworkVersion,
+            runtimeError: selected.error,
+            pendingVersion: this.pendingVersion,
+            migrationError: this.migrationError,
         };
     }
     /** Hit npm for the latest published version, cache it, return refreshed status. */
@@ -91,6 +97,7 @@ class CoreUpdateManager {
         }
         this.latestVersion = latest.trim().replace(/^[v=]+/, '');
         this.lastCheckedAt = Date.now();
+        this.persistStatus();
         return this.getStatus();
     }
     /**
@@ -106,12 +113,15 @@ class CoreUpdateManager {
         if (!this.isAvailable()) {
             return { ok: false, error: 'Core updates are unavailable in this build.' };
         }
-        const requested = (targetVersion ?? this.latestVersion ?? '').trim().replace(/^[v=]+/, '');
+        const requested = (targetVersion ?? this.pendingVersion ?? this.latestVersion ?? '').trim().replace(/^[v=]+/, '');
         if (!requested || !(0, semver_lite_1.isValidVersion)(requested)) {
             return { ok: false, error: 'No valid target version to update to. Check for updates first.' };
         }
+        if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(requested) || ![4, 5].includes(Number(requested.split('.')[0]))) {
+            return { ok: false, error: 'This Desktop supports Core 4 and 5. Update Desktop before installing another major version.' };
+        }
         const current = (0, framework_manager_1.readCurrentFrameworkVersion)(this.home);
-        if (current && !(0, semver_lite_1.isNewer)(requested, current)) {
+        if (current && !(0, semver_lite_1.isNewer)(requested, current) && !(requested === current && ((0, core_runtime_1.getCoreRuntimeStatus)(this.home).error || this.pendingVersion === requested))) {
             return { ok: false, error: `Already on ${current}; ${requested} is not newer.` };
         }
         this.updating = true;
@@ -122,39 +132,112 @@ class CoreUpdateManager {
         // loader) against process.argv[1] (the literal spawn arg) — a symlinked
         // staging path makes them differ, so main() never runs and every
         // install-framework/swap-current child exits 0 as a silent no-op.
-        const tmp = fs_1.default.mkdtempSync(path_1.default.join(realTmpDir(), 'core-update-'));
+        let tmp;
         try {
-            this.npmInstallFn(`${exports.CORE_PACKAGE}@${requested}`, tmp);
-            const coreRoot = path_1.default.join(tmp, 'node_modules', exports.CORE_PACKAGE);
+            tmp = fs_1.default.mkdtempSync(path_1.default.join(realTmpDir(), 'core-update-'));
+            const retained = path_1.default.join((0, core_runtime_1.managedCoreRoot)(this.home), requested, 'node_modules', exports.CORE_PACKAGE);
+            if ((0, core_runtime_1.readCoreRuntime)(retained, 'managed')?.version === requested) {
+                // A project migration retry can finish fully offline.
+                // Force JS traversal: Node 22's native directory copy mishandles Unicode
+                // Windows profiles (nodejs/node#61878). Both copy targets are fresh
+                // staging directories, so native file replacement is avoided too.
+                fs_1.default.cpSync(path_1.default.dirname(path_1.default.dirname(retained)), tmp, { recursive: true, filter: () => true, mode: fs_1.default.constants.COPYFILE_FICLONE });
+            }
+            else {
+                this.npmInstallFn(`${exports.CORE_PACKAGE}@${requested}`, tmp);
+            }
+            let coreRoot = path_1.default.join(tmp, 'node_modules', exports.CORE_PACKAGE);
             const cli = path_1.default.join(coreRoot, 'dist', 'installer', 'cli.js');
             if (!fs_1.default.existsSync(cli)) {
                 throw new Error('downloaded core is missing dist/installer/cli.js');
             }
+            const staged = (0, core_runtime_1.readCoreRuntime)(coreRoot, 'managed');
+            if (!staged || staged.version !== requested)
+                throw new Error(`Downloaded Core version does not match requested ${requested}.`);
+            const installed = staged.version;
+            // Retain the complete npm installation, including sibling dependencies.
+            // Publication is a same-filesystem rename and occurs before current moves.
+            const store = (0, core_runtime_1.managedCoreRoot)(this.home);
+            fs_1.default.mkdirSync(store, { recursive: true, mode: 0o700 });
+            const destination = path_1.default.join(store, installed);
+            if ((0, core_runtime_1.readCoreRuntime)(path_1.default.join(destination, 'node_modules', exports.CORE_PACKAGE), 'managed')?.version !== installed) {
+                const staging = fs_1.default.mkdtempSync(path_1.default.join(store, '.stage-'));
+                let retainedBackup = null;
+                try {
+                    fs_1.default.cpSync(tmp, staging, { recursive: true, filter: () => true, mode: fs_1.default.constants.COPYFILE_FICLONE });
+                    try {
+                        fs_1.default.lstatSync(destination);
+                        const backup = fs_1.default.mkdtempSync(path_1.default.join(store, `.previous-${installed}-`));
+                        retainedBackup = path_1.default.join(backup, 'installation');
+                        fs_1.default.renameSync(destination, retainedBackup);
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    }
+                    fs_1.default.renameSync(staging, destination);
+                }
+                catch (error) {
+                    // Restore only when publication never created a destination. The
+                    // retained previous installation is never deleted, even on success.
+                    if (retainedBackup && !fs_1.default.existsSync(destination))
+                        fs_1.default.renameSync(retainedBackup, destination);
+                    throw error;
+                }
+                finally {
+                    fs_1.default.rmSync(staging, { recursive: true, force: true });
+                }
+            }
+            coreRoot = path_1.default.join(destination, 'node_modules', exports.CORE_PACKAGE);
+            if ((0, core_runtime_1.readCoreRuntime)(coreRoot, 'managed')?.version !== installed)
+                throw new Error('The retained Core package could not be verified. Retry the update.');
             const fm = this.makeFrameworkFn(coreRoot);
-            // The version actually installed (npm may resolve a dist-tag/range).
-            const installed = fm.bundledVersion() ?? requested;
             this.emit('materializing', { version: installed });
             const providers = uniqueProviders(this.providersFn());
-            const mat = fm.materialize(installed, providers);
-            if (!mat.ran) {
-                throw new Error('framework materialize did not run (no usable core)');
-            }
-            if (mat.errors.length > 0) {
-                throw new Error(`framework materialize failed: ${mat.errors.map((e) => `${e.provider}: ${e.message}`).join('; ')}`);
-            }
-            // A materialize that reports no errors but ALSO no materialized providers
-            // wrote nothing — swapping `current` at a nonexistent version dir would
-            // fail downstream with a misleading "swap-current failed". Surface the
-            // real condition instead (mirrors FrameworkManager.versionCheck's guard).
-            if (mat.providers.length === 0) {
-                throw new Error(`framework materialize completed without materializing any provider (requested: ${providers.join(', ') || 'none'})`);
+            (0, artifact_registry_1.withFileLock)(this.home, () => {
+                const now = (0, framework_manager_1.readCurrentFrameworkVersion)(this.home);
+                if (now && (0, semver_lite_1.isNewer)(now, installed))
+                    throw new Error(`Core advanced to ${now} while downloading; refusing to downgrade.`);
+                const mat = fm.materialize(installed, providers);
+                if (!mat.ran) {
+                    throw new Error('framework materialize did not run (no usable core)');
+                }
+                if (mat.errors.length > 0) {
+                    throw new Error(`framework materialize failed: ${mat.errors.map((e) => `${e.provider}: ${e.message}`).join('; ')}`);
+                }
+                // A materialize that reports no errors but ALSO no materialized providers
+                // wrote nothing — swapping `current` at a nonexistent version dir would
+                // fail downstream with a misleading "swap-current failed". Surface the
+                // real condition instead (mirrors FrameworkManager.versionCheck's guard).
+                if (mat.providers.length === 0) {
+                    throw new Error(`framework materialize completed without materializing any provider (requested: ${providers.join(', ') || 'none'})`);
+                }
+                // Recovery state is mandatory before publication. If this write fails,
+                // current stays on the previous usable version and no project is reseeded.
+                this.pendingVersion = installed;
+                this.migrationError = null;
+                this.persistStatus(true);
+                const swapped = fm.swapCurrentDetailed(installed);
+                if (!swapped.ok) {
+                    throw new Error(`framework swap-current failed${swapped.detail ? `: ${swapped.detail}` : ''}`);
+                }
+            });
+            const projects = await this.reseed(installed);
+            const failed = projects.filter(project => project.error);
+            if (failed.length)
+                throw new Error(`Core ${installed} is installed, but project refresh failed: ${failed.map(project => `${project.projectId}: ${project.error}`).join('; ')}. Retry the update to finish refreshing project files.`);
+            this.pendingVersion = null;
+            this.migrationError = null;
+            // Installation is not a registry-latest check. Preserve its cached value
+            // and timestamp, including a known version newer than this target.
+            try {
+                this.persistStatus(true);
             }
-            const swapped = fm.swapCurrentDetailed(installed);
-            if (!swapped.ok) {
-                throw new Error(`framework swap-current failed${swapped.detail ? `: ${swapped.detail}` : ''}`);
+            catch (error) {
+                this.pendingVersion = installed;
+                throw error;
             }
-            this.latestVersion = installed;
-            this.lastCheckedAt = Date.now();
+            this.updating = false;
             this.emit('done', { version: installed });
             // Reuse the existing app-level event so any listener that reacts to a
             // framework version bump (e.g. core-version banners) refreshes too.
@@ -163,19 +246,37 @@ class CoreUpdateManager {
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
+            if (this.pendingVersion) {
+                this.migrationError = message;
+                this.persistStatus();
+            }
+            this.updating = false;
             this.emit('error', { message });
             return { ok: false, error: message };
         }
         finally {
             this.updating = false;
             try {
-                fs_1.default.rmSync(tmp, { recursive: true, force: true });
+                if (tmp)
+                    fs_1.default.rmSync(tmp, { recursive: true, force: true });
             }
             catch {
                 /* best-effort temp cleanup */
             }
         }
     }
+    persistStatus(required = false) {
+        try {
+            const root = (0, core_runtime_1.managedCoreRoot)(this.home);
+            fs_1.default.mkdirSync(root, { recursive: true, mode: 0o700 });
+            (0, artifact_registry_1.atomicWrite)(path_1.default.join(root, 'update-status.json'), JSON.stringify({ latestVersion: this.latestVersion, lastCheckedAt: this.lastCheckedAt, pendingVersion: this.pendingVersion, migrationError: this.migrationError }));
+        }
+        catch (error) {
+            if (required)
+                throw new Error(`Could not persist Core update recovery state: ${error instanceof Error ? error.message : String(error)}`);
+            // A registry-cache failure does not erase the installed version.
+        }
+    }
     emit(phase, extra) {
         this.safeBroadcast({ type: 'core_update.progress', phase, ...extra });
     }

package/server/dist/core-update-state.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreUpdatePendingPath = void 0;
+exports.assertWorkspaceCoreReady = assertWorkspaceCoreReady;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const core_runtime_1 = require("./core-runtime");
+const coreUpdatePendingPath = (workspace) => path_1.default.join(workspace, '.specrails', 'core-update-pending.json');
+exports.coreUpdatePendingPath = coreUpdatePendingPath;
+/** Reading the project remains available; only implementation setup calls this. */
+function assertWorkspaceCoreReady(workspace, home) {
+    let pending = fs_1.default.existsSync((0, exports.coreUpdatePendingPath)(workspace));
+    // If a workspace was read-only and its marker could not be created, the
+    // durable global migration still prevents a launch using its old seed.
+    try {
+        const target = JSON.parse(fs_1.default.readFileSync(path_1.default.join((0, core_runtime_1.managedCoreRoot)(home), 'update-status.json'), 'utf8')).pendingVersion;
+        if (typeof target === 'string' && target) {
+            const recorded = fs_1.default.readFileSync(path_1.default.join(workspace, '.specrails', 'specrails-version'), 'utf8').trim();
+            pending ||= recorded !== target;
+        }
+    }
+    catch { /* no pending global migration / uninstalled workspace */ }
+    if (pending) {
+        throw new Error('This project has an unfinished Core update. Retry the Core update in Settings before starting an implementation.');
+    }
+}

package/server/dist/db.js

@@ -60,6 +60,10 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const secure_fs_1 = require("./util/secure-fs");
+const sqlite_migrations_1 = require("./util/sqlite-migrations");
+const multi_repo_execution_store_1 = require("./multi-repo-execution-store");
+const project_repository_provenance_1 = require("./project-repository-provenance");
+const file_story_1 = require("./file-story");
 /** Backfill only terminal Safe-PR rows whose ticket ownership is unambiguous.
  * Eligibility is intentionally deferred to the outbox drainer, which freezes
  * only candidates still parked at on_review in the external ticket JSON. */
@@ -1501,6 +1505,45 @@ const MIGRATIONS = [
             db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN revision_of TEXT`);
         }
     },
+    // Migration 58: premium-milestone-progress — server-durable milestone launch
+    // chains. One row per sequential "Launch Milestone": the chunk plan, the
+    // chunk in flight (rail / runs / delivery), the branch the next chunk stacks
+    // on, and a CAS status. The partial unique index enforces ONE non-terminal
+    // chain per milestone. Additive; nothing else references it.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS milestone_launch_chains (
+        id                   TEXT PRIMARY KEY,
+        milestone_n          INTEGER NOT NULL,
+        milestone_id         TEXT NOT NULL,
+        mode                 TEXT NOT NULL,
+        chunks               TEXT NOT NULL DEFAULT '[]',
+        next_chunk           INTEGER NOT NULL DEFAULT 0,
+        current_rail_index   INTEGER,
+        current_run_ids      TEXT NOT NULL DEFAULT '[]',
+        current_delivery_id  TEXT,
+        integration_branch   TEXT,
+        head_branch          TEXT,
+        status               TEXT NOT NULL DEFAULT 'running',
+        pause_reason         TEXT,
+        launched             TEXT NOT NULL DEFAULT '[]',
+        last_run_outcome     TEXT,
+        auto_advance         INTEGER NOT NULL DEFAULT 1,
+        retry_chunk          INTEGER,
+        created_at           TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at           TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_milestone_chains_active
+        ON milestone_launch_chains(milestone_n) WHERE status IN ('running','waiting','paused','awaiting_approval');
+      CREATE INDEX IF NOT EXISTS idx_milestone_chains_status ON milestone_launch_chains(status);
+    `);
+    },
+    // Migration 59: coordinated repository execution and grouped delivery.
+    multi_repo_execution_store_1.migrateMultiRepoExecution,
+    // Migration 60: repository-scoped provenance and code identity.
+    project_repository_provenance_1.migrateRepositoryProvenance,
+    // Migration 61: version and evidence identity of recorded-change explanations.
+    file_story_1.migrateFileStoryMetadata,
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need
@@ -1511,26 +1554,7 @@ function applyMigrations(db) {
       applied_at  TEXT NOT NULL DEFAULT (datetime('now'))
     )
   `);
-    const appliedVersions = new Set(db.prepare('SELECT version FROM schema_migrations').all()
-        .map((r) => r.version));
-    for (let i = 0; i < MIGRATIONS.length; i++) {
-        const version = i + 1;
-        if (!appliedVersions.has(version)) {
-            // M8: run each migration body and its version INSERT atomically. SQLite DDL
-            // is transactional, so a crash/failure mid-migration now rolls back the
-            // whole body instead of leaving a half-applied schema with the version
-            // unrecorded — which under the old code re-ran a bare `ALTER TABLE ADD
-            // COLUMN` on next startup and bricked it forever with 'duplicate column
-            // name'. With this, a failed migration leaves nothing applied and re-runs
-            // cleanly. (Pre-existing half-applied DBs are contained by the per-project
-            // load isolation in project-registry.ts — one bad DB no longer kills the app.)
-            const tx = db.transaction(() => {
-                MIGRATIONS[i](db);
-                db.prepare('INSERT OR IGNORE INTO schema_migrations (version) VALUES (?)').run(version);
-            });
-            tx();
-        }
-    }
+    (0, sqlite_migrations_1.applyNumberedMigrations)(db, MIGRATIONS);
 }
 // ─── Public API ──────────────────────────────────────────────────────────────
 function initDb(dbPath) {
@@ -1540,21 +1564,27 @@ function initDb(dbPath) {
         (0, secure_fs_1.secureDir)(dir); // H-13: owner-only data dir
     }
     const db = new better_sqlite3_1.default(dbPath);
-    db.pragma('journal_mode = WAL');
-    db.pragma('foreign_keys = ON');
-    // Under load, QueueManager / ChatManager / FileSummaryManager write the same
-    // per-project DB concurrently with /analytics reads. Wait up to 5s on a lock
-    // instead of throwing SQLITE_BUSY, and cap the WAL so a long checkpoint can't
-    // grow it without bound.
-    db.pragma('busy_timeout = 5000');
-    db.pragma('journal_size_limit = 10000000'); // ~10 MB
-    applyMigrations(db);
-    // H-13: restrict the db + its WAL sidecars to 0600 (jobs.sqlite holds chat
-    // transcripts and verbatim terminal command history). After migrations the
-    // WAL/SHM files exist, so this covers them too.
-    (0, secure_fs_1.secureDbFile)(dbPath);
-    // Orphan sweep: cancel any in-flight proposals from a previous server session
-    db.prepare("UPDATE proposals SET status = 'cancelled', updated_at = ? WHERE status IN ('exploring', 'refining')").run(new Date().toISOString());
+    try {
+        db.pragma('journal_mode = WAL');
+        db.pragma('foreign_keys = ON');
+        // Under load, QueueManager / ChatManager / FileSummaryManager write the same
+        // per-project DB concurrently with /analytics reads. Wait up to 5s on a lock
+        // instead of throwing SQLITE_BUSY, and cap the WAL so a long checkpoint can't
+        // grow it without bound.
+        db.pragma('busy_timeout = 5000');
+        db.pragma('journal_size_limit = 10000000'); // ~10 MB
+        applyMigrations(db);
+        // H-13: restrict the db + its WAL sidecars to 0600 (jobs.sqlite holds chat
+        // transcripts and verbatim terminal command history). After migrations the
+        // WAL/SHM files exist, so this covers them too.
+        (0, secure_fs_1.secureDbFile)(dbPath);
+        // Orphan sweep: cancel any in-flight proposals from a previous server session
+        db.prepare("UPDATE proposals SET status = 'cancelled', updated_at = ? WHERE status IN ('exploring', 'refining')").run(new Date().toISOString());
+    }
+    catch (err) {
+        db.close();
+        throw err;
+    }
     return db;
 }
 function createJob(db, job) {
@@ -2008,6 +2038,7 @@ exports.DEFAULT_FREESTYLE_PRE_PROMPT = [
     'Work independently until the feature is done: write the code, the tests, update docs as needed, and make sure everything builds and the test suite passes.',
     'Do NOT follow any structured architect/developer/reviewer pipeline — use your own judgement and the repo conventions.',
     'Never ask for confirmation; there is no human to answer. Choose the recommended option and proceed.',
+    'Run every command in the FOREGROUND and wait for it to finish — never background a command (no run_in_background, no trailing `&`): your reply ends the step and anything still running is killed with its output lost.',
 ].join('\n');
 exports.WORKTREE_ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const WORKTREE_ENV_MAX_NAMES = 64;