specrails-desktop 2.36.0 → 2.42.2

package/server/dist/mobile/mobile-router.js

@@ -7,6 +7,7 @@ const auth_1 = require("../auth");
 const mobile_redact_1 = require("./mobile-redact");
 const mobile_auth_1 = require("./mobile-auth");
 const mobile_devices_1 = require("./mobile-devices");
+const mobile_missions_1 = require("./mobile-missions");
 // The gateway's authenticated REST surface: the `/v1/*` allow-list. Each route
 // forwards, in-process, via a REAL loopback HTTP request to
 // http://127.0.0.1:<desktopPort> with the master token injected server-side as
@@ -34,7 +35,7 @@ function createMobileRouter(deps) {
     // any `:pid`-scoped route is gated against the device's granted project set.
     // An unrestricted device (null grant ⇒ all projects, legacy default) passes
     // through; a scoped device gets 403 for any project it wasn't granted. The
-    // bare `GET /v1/projects` list has no `:pid` and is unaffected.
+    // bare `GET /v1/projects` list applies the same grant when shaping its response.
     v1.use('/projects/:pid', (req, res, next) => {
         const pid = seg(req.params.pid);
         if (!PID_RE.test(pid)) {
@@ -56,11 +57,12 @@ function createMobileRouter(deps) {
     });
     /** Forward to the internal desktop API with the master token injected; redact
      *  the JSON response. `internalPath` is built from validated params only. */
-    async function forward(res, method, internalPath, query, body) {
+    async function forward(res, method, internalPath, query, body, transform) {
         const url = internalBase + internalPath + (query ? `?${query}` : '');
         try {
             const init = {
                 method,
+                signal: AbortSignal.timeout(30_000),
                 headers: {
                     'x-desktop-token': (0, auth_1.loadOrGenerateToken)(),
                     ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
@@ -79,7 +81,7 @@ function createMobileRouter(deps) {
                 res.status(502).json({ error: 'Bad upstream response' });
                 return;
             }
-            res.status(upstream.status).json((0, mobile_redact_1.redact)(json));
+            res.status(upstream.status).json((0, mobile_redact_1.redact)(upstream.ok && transform ? transform(json) : json));
         }
         catch {
             res.status(502).json({ error: 'Server unreachable' });
@@ -102,7 +104,13 @@ function createMobileRouter(deps) {
     // —— Reads ——
     v1.get('/projects', (req, res) => {
         // Exact GET /api/projects is served by the desktop router (mounted at /api).
-        void forward(res, 'GET', '/api/projects', '');
+        const allowed = (0, mobile_devices_1.getAllowedProjects)(deps.db, req.mobileDevice.id);
+        void forward(res, 'GET', '/api/projects', '', undefined, json => {
+            if (allowed === null || !json || typeof json !== 'object')
+                return json;
+            const value = json;
+            return { ...value, projects: value.projects?.filter(project => project.id && allowed.has(project.id)) ?? [] };
+        });
     });
     const projectReads = [
         ['/projects/:pid/tickets', '/tickets'],
@@ -164,6 +172,13 @@ function createMobileRouter(deps) {
             narrowed.priority = b.priority;
         if (typeof b.title === 'string')
             narrowed.title = b.title;
+        if (b.repositoryIds !== undefined) {
+            if (!Array.isArray(b.repositoryIds) || !b.repositoryIds.length || b.repositoryIds.length > 30 || b.repositoryIds.some(id => typeof id !== 'string' || !PID_RE.test(id))) {
+                res.status(400).json({ error: 'Invalid repository selection' });
+                return;
+            }
+            narrowed.repositoryIds = b.repositoryIds;
+        }
         void forward(res, 'PATCH', `/api/projects/${encodeURIComponent(pid)}/tickets/${encodeURIComponent(tid)}`, '', narrowed);
     });
     v1.delete('/projects/:pid/tickets/:tid', (req, res) => {
@@ -206,6 +221,13 @@ function createMobileRouter(deps) {
         }
         if (typeof b.interactive === 'boolean')
             narrowed.interactive = b.interactive;
+        if (b.repositoryIds !== undefined) {
+            if (!Array.isArray(b.repositoryIds) || !b.repositoryIds.length || b.repositoryIds.length > 30 || b.repositoryIds.some(id => typeof id !== 'string' || !PID_RE.test(id))) {
+                res.status(400).json({ error: 'Invalid repository selection' });
+                return;
+            }
+            narrowed.repositoryIds = b.repositoryIds;
+        }
         void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/rails/${encodeURIComponent(i)}/launch`, '', narrowed);
     });
     v1.put('/projects/:pid/rails/:i/engine', (req, res) => {
@@ -382,6 +404,12 @@ function createMobileRouter(deps) {
             narrowed.acceptanceCriteria = b.acceptanceCriteria.filter((x) => typeof x === 'string');
         void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/tickets/from-draft`, '', narrowed);
     });
+    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: async (method, path, body) => {
+            const response = await fetch(internalBase + path, { method, signal: AbortSignal.timeout(30_000),
+                headers: { 'x-desktop-token': (0, auth_1.loadOrGenerateToken)(), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
+                ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+            return { status: response.status, json: await response.json() };
+        } }));
     router.use('/v1', v1);
     // Any unmatched gateway path → 404 JSON (NEVER falls through to a SPA handler;
     // the gateway serves JSON/WS only, no static client).
@@ -393,6 +421,20 @@ function createMobileRouter(deps) {
 /** The allow-list, exported for the CI drift test (asserts each entry resolves
  *  against a real internal route, and that no traversal param is accepted). */
 exports.MOBILE_ALLOWLIST = [
+    { method: 'GET', path: '/v1/capabilities' },
+    { method: 'GET', path: '/v1/mission-models' },
+    { method: 'GET', path: '/v1/projects/:pid/repositories' },
+    { method: 'GET', path: '/v1/projects/:pid/missions' },
+    { method: 'POST', path: '/v1/projects/:pid/missions' },
+    { method: 'GET', path: '/v1/projects/:pid/missions/:cid' },
+    { method: 'POST', path: '/v1/projects/:pid/missions/:cid/send' },
+    { method: 'POST', path: '/v1/projects/:pid/missions/:cid/abort' },
+    { method: 'PATCH', path: '/v1/projects/:pid/missions/:cid/queue/:queueId' },
+    { method: 'DELETE', path: '/v1/projects/:pid/missions/:cid/queue/:queueId' },
+    { method: 'POST', path: '/v1/projects/:pid/missions/:cid/queue/:queueId/steer' },
+    { method: 'GET', path: '/v1/projects/:pid/missions/:cid/processes' },
+    { method: 'GET', path: '/v1/projects/:pid/missions/:cid/processes/:processId/logs' },
+    { method: 'DELETE', path: '/v1/projects/:pid/missions/:cid/processes/:processId' },
     { method: 'GET', path: '/v1/projects' },
     { method: 'GET', path: '/v1/projects/:pid/tickets' },
     { method: 'GET', path: '/v1/projects/:pid/tickets/:tid' },

package/server/dist/mobile/mobile-ws.js

@@ -16,6 +16,24 @@ const LOG_LINE_MAX = 2048;
 const LOG_BATCH_MAX = 60;
 function topicFor(type) {
     switch (type) {
+        case 'agent_stream':
+        case 'agent_done':
+        case 'agent_partial':
+        case 'agent_error':
+        case 'agent_title':
+        case 'agent_tool':
+        case 'agent_tool_result':
+        case 'agent_queued':
+        case 'agent_dequeued':
+        case 'agent_steered':
+        case 'agent_queue_edited':
+        case 'agent_queue_removed':
+        case 'agent_queue_cleared':
+        case 'agent_input_receipt':
+        case 'agent_pr_decision':
+        case 'background_process.started':
+        case 'background_process.updated':
+        case 'background_process.exited': return 'missions';
         case 'queue': return 'queue';
         case 'phase': return 'phase';
         case 'ticket_created':
@@ -107,9 +125,11 @@ class MobileWsBridge {
     // it so a companion can only subscribe to projects it was granted. Default
     // resolver (undefined) keeps every device unrestricted — byte-identical legacy.
     _allowedProjectsFor;
+    _missionProjectFor;
     constructor(opts = {}) {
         this._clock = opts.clock ?? (() => Date.now());
         this._allowedProjectsFor = opts.allowedProjectsFor ?? (() => null);
+        this._missionProjectFor = opts.missionProjectFor ?? (() => null);
     }
     start() {
         if (this._unsub)
@@ -227,10 +247,34 @@ class MobileWsBridge {
         if (!topic)
             return;
         for (const s of this._socks) {
+            const allowed = this._allowedProjectsFor(s.deviceId);
+            if (topic === 'missions') {
+                if (allowed !== null || !s.topics.has('missions'))
+                    continue;
+                const value = msg;
+                const process = value.process;
+                const cid = typeof value.conversationId === 'string' ? value.conversationId : process?.chatId;
+                const projectId = cid ? this._missionProjectFor(cid) : null;
+                if (!projectId || !s.projects.has(projectId))
+                    continue;
+                // The snapshot is authoritative. Events are bounded invalidation hints;
+                // never stream tool inputs/results or arbitrary provider payloads.
+                this.send(s, (0, mobile_redact_1.redact)({ type: 'mission.updated', projectId, conversationId: cid, event: msg.type, timestamp: value.timestamp,
+                    ...(msg.type === 'agent_stream' ? { delta: String(value.delta ?? '').slice(0, 16_000) } : {}),
+                    ...(msg.type === 'agent_tool' ? { tool: String(value.tool ?? '').slice(0, 100) } : {}) }));
+                continue;
+            }
             if (topic === 'hub') {
                 // App-level (project registry): always forward, but translate to the
                 // legacy mobile wire types and redact (the projects payload carries `path`).
-                this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
+                if (msg.type === 'desktop.projects')
+                    this.send(s, (0, mobile_redact_1.redact)(toMobileWire({ ...msg, projects: allowed === null ? msg.projects : msg.projects.filter(project => allowed.has(project.id)) })));
+                else if (msg.type === 'desktop.project_added') {
+                    if (allowed === null || allowed.has(msg.project.id))
+                        this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
+                }
+                else if (msg.type === 'desktop.project_removed' && (allowed === null || allowed.has(msg.projectId)))
+                    this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
                 continue;
             }
             // App-level desktop budget alert: deliver to subscribers holding the
@@ -239,12 +283,12 @@ class MobileWsBridge {
             // topic gate like every other delivery — a device that never subscribed to
             // `alerts` (topics init empty) must NOT receive these frames (BUG-MOBILE-05).
             if (topic === 'alerts' && msg.type === 'desktop_daily_budget_exceeded') {
-                if (s.topics.has('alerts'))
+                if (allowed === null && s.topics.has('alerts'))
                     this.send(s, (0, mobile_redact_1.redact)(toMobileWire(msg)));
                 continue;
             }
             const projectId = msg.projectId;
-            if (!projectId || !s.projects.has(projectId))
+            if (!projectId || !s.projects.has(projectId) || (allowed !== null && !allowed.has(projectId)))
                 continue;
             if (topic === 'jobtail') {
                 if (!s.watchedJob || s.watchedJob.projectId !== projectId)
@@ -278,7 +322,8 @@ class MobileWsBridge {
     flushLogs() {
         for (const s of this._socks) {
             for (const [jobId, lines] of s.logBuf) {
-                if (lines.length === 0)
+                const allowed = this._allowedProjectsFor(s.deviceId);
+                if (lines.length === 0 || !s.watchedJob || s.watchedJob.jobId !== jobId || (allowed !== null && !allowed.has(s.watchedJob.projectId)))
                     continue;
                 const dropped = s.logDropped.get(jobId) ?? 0;
                 this.send(s, { type: 'log_batch', jobId, lines, dropped });

package/server/dist/multi-repo-bases.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRepositoryDeliveryBases = resolveRepositoryDeliveryBases;
+const rail_pr_store_1 = require("./rail-pr-store");
+const project_repositories_1 = require("./project-repositories");
+/** Resolve the latest delivered head per member from durable milestone history.
+ * The request names deliveries, never invents a repository/branch/SHA binding. */
+async function resolveRepositoryDeliveryBases(db, project, selectedIds, value, git) {
+    const repositoryBaseBranches = {};
+    const repositoryBaseShas = {};
+    if (value === undefined)
+        return { repositoryBaseBranches, repositoryBaseShas };
+    if (!Array.isArray(value) || value.length === 0 || value.length > 100 || value.some((id) => typeof id !== 'string' || id.length === 0 || id.length > 200)) {
+        throw new Error('baseDeliveryIds must be a nonempty list of at most 100 delivery IDs');
+    }
+    const primary = (0, project_repositories_1.resolveProjectRepository)(project);
+    const bases = new Map();
+    for (const id of value) {
+        const row = (0, rail_pr_store_1.getPrDelivery)(db, id);
+        if (!row || row.parent_delivery_id)
+            throw new Error(`Unknown base delivery: ${id}`);
+        const snapshot = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+        if (!['on_review', 'no_changes', 'pr_draft', 'pr_ready', 'completed', 'merged'].includes(snapshot.decision))
+            throw new Error(`Base delivery ${id} is not ready`);
+        const entries = snapshot.repositoryDeliveries?.length ? snapshot.repositoryDeliveries : [{
+                repositoryId: primary.id, decision: snapshot.decision, baseBranch: snapshot.baseBranch,
+                branch: snapshot.branch ?? (snapshot.branches.length === 1 ? snapshot.branches[0].branch : null),
+                deliverySha: snapshot.deliverySha ?? (snapshot.branches.length === 1 ? snapshot.branches[0].finalSha : null),
+            }];
+        for (const entry of entries) {
+            if (!selectedIds.includes(entry.repositoryId) || ['no_changes', 'completed'].includes(entry.decision))
+                continue;
+            const branch = entry.decision === 'merged' ? (('integrationBranch' in entry && entry.integrationBranch) || entry.baseBranch) : entry.branch;
+            if (!branch || !entry.deliverySha)
+                throw new Error(`Base delivery ${id} has no verified head for repository ${entry.repositoryId}`);
+            bases.set(entry.repositoryId, { branch, sha: entry.deliverySha, merged: entry.decision === 'merged' });
+        }
+    }
+    for (const [id, base] of bases) {
+        const repository = (0, project_repositories_1.resolveProjectRepository)(project, id);
+        const result = await git.run(['rev-parse', '--verify', `refs/heads/${base.branch}`], repository.path);
+        const head = result.stdout.trim();
+        if (result.code !== 0 || !/^[a-f0-9]{40,64}$/i.test(head))
+            throw new Error(`Missing base branch ${base.branch} in ${repository.name}`);
+        if (base.merged) {
+            const contains = await git.run(['merge-base', '--is-ancestor', base.sha, head], repository.path);
+            if (contains.code !== 0)
+                throw new Error(`Integrated base no longer contains the delivered commit in ${repository.name}`);
+        }
+        else if (head !== base.sha)
+            throw new Error(`Delivered base branch changed in ${repository.name}`);
+        repositoryBaseBranches[id] = base.branch;
+        repositoryBaseShas[id] = head;
+    }
+    return { repositoryBaseBranches, repositoryBaseShas };
+}

package/server/dist/multi-repo-checkout.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.repositoryDeliveryCheckoutTarget = repositoryDeliveryCheckoutTarget;
+exports.checkoutRepositoryDelivery = checkoutRepositoryDelivery;
+const ids_1 = require("./ids");
+const repo_lock_1 = require("./repo-lock");
+const project_git_1 = require("./project-git");
+const rail_pr_store_1 = require("./rail-pr-store");
+const rail_worktree_release_1 = require("./rail-worktree-release");
+const multi_repo_execution_1 = require("./multi-repo-execution");
+const agent_chat_registry_1 = require("./agent-chat-registry");
+function repositoryDeliveryCheckoutTarget(delivery) {
+    if (delivery.branch && delivery.deliverySha)
+        return { branch: delivery.branch, sha: delivery.deliverySha };
+    const units = delivery.branches;
+    if (!delivery.branch && !delivery.deliverySha && units.length === 1 && units[0].succeeded && units[0].finalSha &&
+        units[0].deliveryOutcome !== 'blocked' && units[0].deliveryOutcome !== 'no_changes' &&
+        units[0].implementationOutcome !== 'failed' && units[0].changed !== false) {
+        return { branch: units[0].branch, sha: units[0].finalSha };
+    }
+    return null;
+}
+function checkoutBlock(delivery) {
+    if ((0, rail_pr_store_1.isTerminalPrDecision)(delivery.decision) || ['building', 'implementation_failed', 'no_changes'].includes(delivery.decision))
+        return 'delivery is not awaiting implementation review';
+    if (delivery.deliveryOutcome === 'blocked')
+        return 'delivery is blocked and has no safely checkoutable result';
+    const target = repositoryDeliveryCheckoutTarget(delivery);
+    return target && /^[0-9a-f]{40,64}$/i.test(target.sha) ? null : 'delivery has no verified commit available for checkout';
+}
+/** Checkout changes one physical checkout; it never accepts a shared spec. */
+async function checkoutRepositoryDelivery(deps, input) {
+    const parent = (0, rail_pr_store_1.getPrDelivery)(deps.db, input.prDeliveryId);
+    if (!parent || parent.parent_delivery_id || !parent.execution_manifest)
+        return { status: 404, body: { error: 'Unknown repository delivery group' } };
+    const children = (0, multi_repo_execution_1.listRepositoryDeliveries)(deps.db, parent.id);
+    if (!input.repositoryId && children.length !== 1)
+        return { status: 400, body: { error: 'repositoryId_required', detail: 'Choose the repository checkout to move.' } };
+    const child = input.repositoryId ? children.find((row) => row.repository_id === input.repositoryId) : children[0];
+    if (!child?.repository_path)
+        return { status: 404, body: { error: 'Unknown repository in this delivery' } };
+    return (0, repo_lock_1.withRepoLock)(child.repository_path, async () => {
+        deps.assertAdmission?.();
+        const active = (0, rail_pr_store_1.getActivePrDeliveryByRail)(deps.db, parent.rail_index);
+        if (active?.id !== parent.id)
+            return { status: 409, body: { error: 'stale_decision', currentPrDeliveryId: active?.id ?? null } };
+        if (active.operation_token)
+            return { status: 409, body: { error: 'operation_in_progress' } };
+        const token = (0, ids_1.newId)();
+        if (!(0, rail_pr_store_1.claimPrDeliveryOperation)(deps.db, parent.id, active.decision, 'checkout', token))
+            return { status: 409, body: { error: 'operation_in_progress' } };
+        const perform = async () => {
+            const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, child.id);
+            const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(current);
+            const block = checkoutBlock(snap);
+            if (block)
+                return { status: 409, body: { error: 'checkout_not_deliverable', detail: block } };
+            const target = repositoryDeliveryCheckoutTarget(snap);
+            const cleanliness = await (0, project_git_1.inspectProjectCheckoutCleanliness)(child.repository_path);
+            if (!cleanliness.ok)
+                return { status: 409, body: { error: 'checkout_safety_unknown', detail: cleanliness.detail } };
+            const git = await (0, project_git_1.getProjectGitInfo)(child.repository_path);
+            if (!git.git)
+                return { status: 409, body: { error: 'checkout_unavailable', detail: 'repository is not a Git checkout' } };
+            const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+                db: deps.db, git: deps.git, repoDir: child.repository_path, worktreeIds: snap.worktreeIds,
+                expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches), overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+                settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+                onSafetyArchive: (archive) => {
+                    if (!(0, rail_pr_store_1.appendPrDeliverySafetyArchive)(deps.db, child.id, archive))
+                        throw new Error(`delivery ${child.id} disappeared while recording safety archive`);
+                },
+            });
+            (0, rail_pr_store_1.transitionDecision)(deps.db, child.id, current.decision, current.decision, {
+                cleanupWarnings,
+                ...(cleanupWarnings.length ? { statusCode: 'cleanup_incomplete' } : snap.statusCode === 'cleanup_incomplete' ? { statusCode: null } : {}),
+            });
+            const stillActive = (0, rail_pr_store_1.getActivePrDeliveryByRail)(deps.db, parent.rail_index);
+            const outcome = stillActive?.id === parent.id
+                ? await (0, project_git_1.checkoutProjectReviewBranch)(child.repository_path, target.branch, target.sha)
+                : { ok: false, error: 'The delivery generation changed before checkout.' };
+            if (!outcome.ok)
+                return { status: 409, body: { error: 'checkout_failed', detail: [outcome.error, ...cleanupWarnings].join('\n') } };
+            return { status: 200, body: { ok: true, repositoryId: child.repository_id, branch: target.branch,
+                    git: await (0, project_git_1.getProjectGitInfo)(child.repository_path), cleanupWarnings } };
+        };
+        let result;
+        try {
+            result = await perform();
+        }
+        finally {
+            (0, rail_pr_store_1.releasePrDeliveryOperation)(deps.db, parent.id, token);
+        }
+        const updated = (0, multi_repo_execution_1.refreshRepositoryDeliveryGroup)(deps.db, parent.id);
+        const parentSnap = (0, rail_pr_store_1.toPrDeliverySnapshot)(updated);
+        deps.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(deps.project.id, parentSnap));
+        if (updated.origin_conversation_id)
+            (deps.agentChat ?? agent_chat_registry_1.getAgentChatManager)()?.updatePrDecisionCard(updated.origin_conversation_id, (0, rail_pr_store_1.toPrDecisionCardEnvelope)(deps.project.id, parentSnap));
+        return { status: result.status, body: { ...result.body, snapshot: parentSnap } };
+    });
+}

package/server/dist/multi-repo-delivery.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeRepositoryGroupDecision = executeRepositoryGroupDecision;
+const ids_1 = require("./ids");
+const repo_lock_1 = require("./repo-lock");
+const workspace_resolution_1 = require("./workspace-resolution");
+const agent_chat_registry_1 = require("./agent-chat-registry");
+const rail_pr_decision_1 = require("./rail-pr-decision");
+const rail_pr_store_1 = require("./rail-pr-store");
+const rail_pr_ticket_effects_1 = require("./rail-pr-ticket-effects");
+const multi_repo_execution_1 = require("./multi-repo-execution");
+const multi_repo_execution_store_1 = require("./multi-repo-execution-store");
+function completed(row) {
+    return row.decision === 'merged' || row.decision === 'completed';
+}
+/** A parent operation has one lease; each child keeps its own existing safe Git
+ * decision and immutable SHA. A retry never reintegrates accepted repositories. */
+async function executeRepositoryGroupDecision(deps, input) {
+    const parent = (0, rail_pr_store_1.getPrDelivery)(deps.db, input.prDeliveryId);
+    if (!parent || !(0, multi_repo_execution_store_1.readExecutionManifest)(parent.execution_manifest))
+        return { status: 404, body: { error: 'Unknown repository delivery group' } };
+    if (parent.decision !== input.expectedDecision)
+        return { status: 409, body: { error: 'stale_decision', current: parent.decision } };
+    if (['building', 'merged', 'completed', 'discarded', 'superseded'].includes(parent.decision)) {
+        return { status: 409, body: { error: 'stale_decision', current: parent.decision, reason: 'illegal_action' } };
+    }
+    const children = (0, multi_repo_execution_1.listRepositoryDeliveries)(deps.db, parent.id);
+    const selected = input.repositoryId ? children.filter((row) => row.repository_id === input.repositoryId) : children;
+    if (selected.length === 0)
+        return { status: 404, body: { error: 'Unknown repository in this delivery' } };
+    if ((input.action === 'discard' || input.action === 'dismiss') && children.some(completed)) {
+        return { status: 409, body: { error: 'partial_delivery_already_integrated', detail: 'Complete the remaining repository deliveries; already accepted commits cannot be discarded.' } };
+    }
+    const steps = selected.flatMap((row) => {
+        if (completed(row) || row.decision === 'discarded' || row.decision === 'superseded')
+            return [];
+        const action = row.decision === 'no_changes' &&
+            ['merge-local', 'poll-merge', 'acknowledge-no-changes'].includes(input.action)
+            ? 'acknowledge-no-changes' : input.action;
+        return (0, rail_pr_decision_1.actionAllowed)(action, row) ? [{ row, action }] : [];
+    });
+    if (steps.length === 0)
+        return { status: 409, body: { error: 'stale_decision', current: parent.decision, reason: 'illegal_action' } };
+    const token = (0, ids_1.newId)();
+    if (!(0, rail_pr_store_1.claimPrDeliveryOperation)(deps.db, parent.id, parent.decision, input.action, token)) {
+        return { status: 409, body: { error: 'operation_in_progress', current: (0, rail_pr_store_1.getPrDelivery)(deps.db, parent.id)?.decision } };
+    }
+    const outcomes = [];
+    try {
+        deps.assertAdmission?.();
+        const ticketFile = deps.ticketFile ?? (0, workspace_resolution_1.resolveProjectExecution)(deps.project).ticketsPath;
+        for (const { row, action } of steps) {
+            const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+            if (!current || current.parent_delivery_id !== parent.id || current.repository_path !== row.repository_path) {
+                outcomes.push({ repositoryId: row.repository_id, status: 409, body: { error: 'repository_delivery_changed' } });
+                continue;
+            }
+            const childDeps = {
+                ...deps, project: { ...deps.project, path: row.repository_path }, ticketFile,
+                repositoryChildOf: parent.id, repositoryIntegrationBranch: (0, multi_repo_execution_store_1.readExecutionManifest)(row.execution_manifest)?.repositories.find((repo) => repo.repositoryId === row.repository_id)?.integrationBranch, jiraSyncManager: undefined, broadcast: () => { }, agentChat: () => null,
+            };
+            try {
+                const perform = () => (0, rail_pr_decision_1.executePrDecision)(childDeps, { prDeliveryId: row.id, action, expectedDecision: current.decision });
+                // merge-local already locks around its checkout resolution and merge.
+                const result = action === 'merge-local' ? await perform() : await (0, repo_lock_1.withRepoLock)(row.repository_path, perform);
+                outcomes.push({ repositoryId: row.repository_id, ...result });
+            }
+            catch (error) {
+                outcomes.push({ repositoryId: row.repository_id, status: 500, body: { error: 'repository_delivery_failed', detail: error instanceof Error ? error.message : String(error) } });
+            }
+            (0, multi_repo_execution_1.refreshRepositoryDeliveryGroup)(deps.db, parent.id);
+        }
+        const aggregate = (0, multi_repo_execution_1.refreshRepositoryDeliveryGroup)(deps.db, parent.id);
+        if (aggregate.decision === 'merged' || aggregate.decision === 'completed' || aggregate.decision === 'discarded') {
+            const effect = (0, rail_pr_ticket_effects_1.applyRailPrTicketEffect)(deps, aggregate.id);
+            if (!effect.ok)
+                (0, rail_pr_store_1.transitionClaimedDecision)(deps.db, aggregate.id, aggregate.decision, aggregate.decision, token, {
+                    statusCode: 'cleanup_incomplete', cleanupWarnings: [`Shared ticket update pending: ${effect.error ?? 'unknown error'}`],
+                });
+        }
+        const failure = outcomes.find((outcome) => outcome.status >= 400);
+        return {
+            status: failure?.status ?? 200,
+            body: { ok: !failure, ...(failure ? { error: 'repository_delivery_incomplete', detail: outcomes.filter((outcome) => outcome.status >= 400).map((outcome) => `${outcome.repositoryId}: ${outcome.body.detail ?? outcome.body.error ?? 'delivery failed'}`).join('; ') } : {}), repositories: outcomes,
+                decision: aggregate.decision, prState: aggregate.pr_state, statusCode: aggregate.status_code, statusDetail: aggregate.status_detail,
+                snapshot: (0, rail_pr_store_1.toPrDeliverySnapshot)((0, rail_pr_store_1.getPrDelivery)(deps.db, parent.id)), delivery: (0, rail_pr_store_1.toPrDeliverySnapshot)((0, rail_pr_store_1.getPrDelivery)(deps.db, parent.id)) },
+        };
+    }
+    finally {
+        (0, rail_pr_store_1.releasePrDeliveryOperation)(deps.db, parent.id, token);
+        const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, parent.id);
+        if (current) {
+            const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(current);
+            deps.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(deps.project.id, snap));
+            if (current.origin_conversation_id) {
+                (deps.agentChat ?? agent_chat_registry_1.getAgentChatManager)()?.updatePrDecisionCard(current.origin_conversation_id, (0, rail_pr_store_1.toPrDecisionCardEnvelope)(deps.project.id, snap));
+            }
+        }
+    }
+}

package/server/dist/multi-repo-execution-store.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrateMultiRepoExecution = migrateMultiRepoExecution;
+exports.readExecutionManifest = readExecutionManifest;
+exports.getRepositoryExecutionReferences = getRepositoryExecutionReferences;
+exports.executionManifestPrompt = executionManifestPrompt;
+/** Project DB migration 59. Desktop membership is migrated separately. */
+function migrateMultiRepoExecution(db) {
+    db.exec(`
+    ALTER TABLE rail_pr_deliveries ADD COLUMN parent_delivery_id TEXT REFERENCES rail_pr_deliveries(id);
+    ALTER TABLE rail_pr_deliveries ADD COLUMN repository_id TEXT;
+    ALTER TABLE rail_pr_deliveries ADD COLUMN repository_path TEXT;
+    ALTER TABLE rail_pr_deliveries ADD COLUMN execution_manifest TEXT;
+    ALTER TABLE rail_pr_deliveries ADD COLUMN repository_deliveries TEXT NOT NULL DEFAULT '[]';
+    ALTER TABLE rail_worktrees ADD COLUMN repository_id TEXT;
+    ALTER TABLE rail_worktrees ADD COLUMN repository_path TEXT;
+    ALTER TABLE loop_runs ADD COLUMN execution_manifest TEXT;
+    CREATE INDEX idx_rail_pr_delivery_parent ON rail_pr_deliveries(parent_delivery_id);
+    CREATE INDEX idx_rail_worktree_repository ON rail_worktrees(repository_id);
+    DROP INDEX IF EXISTS idx_rail_pr_deliveries_one_active_per_rail;
+    CREATE UNIQUE INDEX idx_rail_pr_deliveries_one_active_per_rail
+      ON rail_pr_deliveries(rail_index)
+      WHERE parent_delivery_id IS NULL AND decision NOT IN ('completed','merged','discarded','superseded');
+  `);
+}
+function readExecutionManifest(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        if (value.version !== 1 || !Array.isArray(value.repositories) || !Array.isArray(value.selectedRepositoryIds))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function getRepositoryExecutionReferences(db, repositoryId) {
+    const deliveries = db.prepare(`SELECT id, parent_delivery_id, run_ids FROM rail_pr_deliveries
+    WHERE repository_id = ? AND decision NOT IN ('completed','merged','discarded','superseded')`).all(repositoryId);
+    const worktrees = db.prepare(`SELECT run_id FROM rail_worktrees WHERE repository_id = ?
+    AND merge_state NOT IN ('merged','failed','released')`).all(repositoryId);
+    const runs = db.prepare("SELECT id, execution_manifest FROM loop_runs WHERE status <> 'completed' AND execution_manifest IS NOT NULL").all();
+    const manifestRunIds = runs.filter((row) => readExecutionManifest(row.execution_manifest)?.selectedRepositoryIds.includes(repositoryId)).map((row) => row.id);
+    return {
+        runIds: [...new Set([...worktrees.flatMap((row) => row.run_id ? [row.run_id] : []), ...manifestRunIds])],
+        deliveryIds: [...new Set(deliveries.map((row) => row.parent_delivery_id ?? row.id))],
+    };
+}
+function executionManifestPrompt(manifest) {
+    if (!manifest)
+        return '';
+    return [
+        'Specrails repository execution scope (immutable for this run):',
+        JSON.stringify({
+            projectId: manifest.projectId,
+            artifactRepositoryId: manifest.artifactRepositoryId,
+            repositories: manifest.repositories.map((repo) => ({ repositoryId: repo.repositoryId, name: repo.name, path: repo.worktreePath, branch: repo.branch, base: repo.baseSha })),
+        }),
+        'This is ONE shared spec and ONE coordinated implementation. Complete and verify every required repository and their shared contracts before reporting success.',
+        'Edit only the listed worktree paths. The original checkouts are not implementation targets. Keep the shared backlog in the project artifact workspace; keep OpenSpec changes in its designated artifact repository.',
+        'Specrails owns Git delivery: do not merge, push, delete branches or open pull requests yourself.',
+    ].join('\n');
+}