specrails-desktop 2.36.0 → 2.42.2

package/server/dist/project-router-loop-runs.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLoopRunRoutes = registerLoopRunRoutes;
+const loop_graph_1 = require("./loop-graph");
 const feature_flags_1 = require("./feature-flags");
 const loops_store_1 = require("./loops-store");
 const loop_runs_store_1 = require("./loop-runs-store");
@@ -14,6 +15,12 @@ const spec_models_1 = require("./spec-models");
 const workspace_resolution_1 = require("./workspace-resolution");
 const loop_command_catalog_1 = require("./loop-command-catalog");
 const ids_1 = require("./ids");
+const project_repositories_1 = require("./project-repositories");
+const multi_repo_execution_1 = require("./multi-repo-execution");
+const rails_store_1 = require("./rails-store");
+const rail_pr_store_1 = require("./rail-pr-store");
+const rail_isolation_1 = require("./rail-isolation");
+const process_admission_1 = require("./process-admission");
 function registerLoopRunRoutes(deps) {
     const { router, ctx } = deps;
     // GET a single loop run's live/terminal state. Backs the companion's running
@@ -59,7 +66,7 @@ function registerLoopRunRoutes(deps) {
             : (0, run_duration_stats_1.getJobCommandDurationRange)(c.db, (0, run_duration_stats_1.jobCommandShape)(command));
         res.json({ range, minSamples: run_duration_stats_1.MIN_DURATION_SAMPLES });
     });
-    router.post('/:projectId/loop-runs', (req, res) => {
+    router.post('/:projectId/loop-runs', async (req, res) => {
         if (!(0, feature_flags_1.isLoopsEnabled)()) {
             res.status(404).json({ error: 'Not Found' });
             return;
@@ -80,6 +87,11 @@ function registerLoopRunRoutes(deps) {
             res.status(400).json({ error: 'Loop must be published before it can run' });
             return;
         }
+        const validation = (0, loop_graph_1.validateLoopGraph)(loop.graph);
+        if (!validation.valid) {
+            res.status(422).json({ error: 'Loop graph is invalid', errors: validation.errors });
+            return;
+        }
         const check = (0, provider_selection_1.validateRequestedProvider)(c.project, aiEngine ?? providerAlias);
         if (!check.ok) {
             res.status(400).json({ error: check.error });
@@ -139,6 +151,63 @@ function registerLoopRunRoutes(deps) {
             && (0, runtime_1.isReasoningEffortValidForModel)(adapter, model, globalAgentDefaults.pipelineEffort)) {
             effort = globalAgentDefaults.pipelineEffort;
         }
+        let repositoryIds;
+        const primary = (0, project_repositories_1.getProjectRepositories)(c.project).find((repository) => repository.isPrimary);
+        try {
+            repositoryIds = (0, project_repositories_1.validateTicketRepositoryIds)(c.project, body.repositoryIds) ?? [primary.id];
+            (0, loop_graph_1.assertLoopShellRepositoryScope)(loop.graph, repositoryIds);
+            (0, process_admission_1.assertProcessAdmission)(c.project.id);
+        }
+        catch (error) {
+            res.status(error instanceof project_repositories_1.RepositoryValidationError ? error.status : error instanceof process_admission_1.ProcessAdmissionClosedError ? 409 : 400).json({ error: error instanceof Error ? error.message : 'Invalid repository scope' });
+            return;
+        }
+        if (repositoryIds.length !== 1 || repositoryIds[0] !== primary.id) {
+            if (!(0, rail_isolation_1.isolationApplies)({ loopsEnabled: true, scope: 'all', ticketCount: 1, readOnly: false })) {
+                res.status(409).json({ error: 'repository_isolation_required' });
+                return;
+            }
+            // A real empty rail makes the grouped delivery reviewable from the board
+            // without manufacturing a spec for a ticket-less loop.
+            const rails = (0, rails_store_1.getRails)(c.db);
+            const used = new Set([...c.railJobs.values(), ...c.railLoopRuns.values()].map((run) => run.railIndex));
+            let rail = rails.find((candidate) => candidate.ticketIds.length === 0 && !used.has(candidate.railIndex) && !(0, rail_pr_store_1.getActivePrDeliveryByRail)(c.db, candidate.railIndex));
+            let created = false;
+            if (!rail) {
+                if (rails.length >= rails_store_1.MAX_RAILS) {
+                    res.status(409).json({ error: 'no_available_rail', detail: 'Finish a pending rail delivery before launching another isolated loop.' });
+                    return;
+                }
+                rail = (0, rails_store_1.createRail)(c.db, loop.name);
+                created = true;
+            }
+            const reservationId = `preparing-${(0, ids_1.newId)()}`;
+            c.railLoopRuns.set(reservationId, { railIndex: rail.railIndex, ticketIds: [], requiresTerminalIntent: true });
+            try {
+                let prDeliveryId;
+                const ids = await (0, multi_repo_execution_1.launchMultiRepositoryRail)({
+                    ctx: c, railIndex: rail.railIndex, ticketIds: [], repositoryIds, scope: 'all',
+                    loopId, loopName: loop.name, loopGraph: loop.graph, provider, model, effort,
+                    onPrDeliveryCreated: (id) => { prDeliveryId = id; },
+                });
+                res.status(202).json({ loopRunId: ids[0], railIndex: rail.railIndex, prDeliveryId, isolated: true });
+            }
+            catch (error) {
+                if (created && !(0, rail_pr_store_1.getActivePrDeliveryByRail)(c.db, rail.railIndex))
+                    (0, rails_store_1.deleteRail)(c.db, rail.railIndex);
+                res.status(409).json({ error: 'repository_launch_failed', detail: error instanceof Error ? error.message : String(error) });
+            }
+            finally {
+                c.railLoopRuns.delete(reservationId);
+                if (created && (0, rails_store_1.getRails)(c.db).some((candidate) => candidate.railIndex === rail.railIndex)) {
+                    const current = (0, rails_store_1.getRail)(c.db, rail.railIndex);
+                    c.broadcast({ type: 'rail.updated', projectId: c.project.id, railIndex: current.railIndex,
+                        changed: 'name', ticketIds: current.ticketIds, name: current.name ?? null,
+                        mode: current.mode, profileName: current.profileName ?? null, aiEngine: current.aiEngine ?? null });
+                }
+            }
+            return;
+        }
         const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: c.project.slug, path: c.project.path });
         const runId = (0, ids_1.newId)();
         c.loopRunManager
@@ -148,6 +217,7 @@ function registerLoopRunRoutes(deps) {
             loopName: loop.name,
             graph: loop.graph,
             projectId: c.project.id,
+            repositoryId: primary.id,
             cwd: exec.cwd,
             repoDir: exec.relocated ? exec.repoDir : undefined,
             railIndex: null,
@@ -158,7 +228,7 @@ function registerLoopRunRoutes(deps) {
             model,
             effort,
         })
-            .then((r) => c.onLoopRunFinished(r.runId, r.outcome))
+            .then((r) => c.onLoopRunFinished(r.runId, r.outcome, r.stallReason ? { stallReason: r.stallReason } : undefined))
             .catch((err) => {
             console.error('[loop-runs] standalone run failed:', err);
             c.onLoopRunFinished(runId, 'failed');

package/server/dist/project-router-tickets.js

@@ -40,6 +40,7 @@ exports.registerTicketsRoutes = registerTicketsRoutes;
 // Domain routes extracted from project-router.ts (tickets).
 // Registered on the shared router by createProjectRouter — behaviour-preserving.
 const fs_1 = __importDefault(require("fs"));
+const project_repositories_1 = require("./project-repositories");
 const ids_1 = require("./ids");
 const db_1 = require("./db");
 const providers_1 = require("./providers");
@@ -130,6 +131,26 @@ async function maybePromoteSpecToJira(c, ticketId, createLocal, broadcast) {
 }
 function registerTicketsRoutes(deps) {
     const { router, registry, ctx, ticketPath } = deps;
+    // Validate scope at every authoring boundary before writes, uploads or AI.
+    const validateRepositoryScope = (req, res, next) => {
+        try {
+            res.locals.repositoryIds = (0, project_repositories_1.validateTicketRepositoryIds)(ctx(req).project, req.body?.repositoryIds);
+            next();
+        }
+        catch (err) {
+            if (err instanceof project_repositories_1.RepositoryValidationError)
+                res.status(err.status).json({ error: err.message, code: err.code });
+            else
+                next(err);
+        }
+    };
+    router.post(['/:projectId/tickets', '/:projectId/tickets/generate-spec', '/:projectId/tickets/save-as-draft', '/:projectId/tickets/from-draft', '/:projectId/tickets/from-prompt'], validateRepositoryScope);
+    router.patch('/:projectId/tickets/:id', validateRepositoryScope);
+    const repositoryScope = (req, res) => {
+        // Generation can outlive a membership change; validate again when saving.
+        const ids = (0, project_repositories_1.validateTicketRepositoryIds)(ctx(req).project, res.locals.repositoryIds);
+        return ids === undefined ? {} : { repositoryIds: ids };
+    };
     // ─── Tickets ──────────────────────────────────────────────────────────────────
     /** Resolve the ticket storage file path for a project */
     // GET /:projectId/tickets — List all tickets with optional filters
@@ -326,6 +347,10 @@ function registerTicketsRoutes(deps) {
             `## Short Summary\n[One or two plain-language sentences, max 120 characters total, that capture the essence of this spec for a dashboard postit. No markdown, no bullets, no headings.]`;
         if (hasAttachments)
             baseSystemPrompt = `${baseSystemPrompt}\n\n${attachment_manager_1.USER_ATTACHMENT_SYSTEM_NOTE}`;
+        const selectedIds = res.locals.repositoryIds;
+        if ((0, project_repositories_1.getProjectRepositories)(project).length > 1) {
+            baseSystemPrompt += `\n\nThis logical project has one shared backlog across these repositories: ${JSON.stringify((0, project_repositories_1.getProjectRepositories)(project).map(({ id, name, path, isPrimary, kind }) => ({ id, name, path, isPrimary, kind })))}.\nThis spec targets repository IDs: ${JSON.stringify(selectedIds ?? [(0, project_repositories_1.getProjectRepositories)(project).find((repo) => repo.isPrimary).id])}. Describe cross-repository contracts when selected; do not create separate tickets per repository.`;
+        }
         const systemPrompt = baseSystemPrompt;
         const userPrompt = baseUserPrompt;
         // Generate-spec spawn args are adapter-driven. For Claude the `--tools`
@@ -512,6 +537,7 @@ function registerTicketsRoutes(deps) {
                     const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
                         const id = s.next_id++;
                         const ticket = {
+                            ...repositoryScope(req, res),
                             id,
                             title: specTitle,
                             description,
@@ -703,6 +729,7 @@ function registerTicketsRoutes(deps) {
                         return;
                     }
                     const title = providedTitle || target.title || (0, explore_draft_title_1.generateAutoTitle)(messages.map((m) => ({ role: m.role, content: m.content ?? '' })));
+                    Object.assign(target, repositoryScope(req, res));
                     target.title = title;
                     if (description)
                         target.description = description;
@@ -730,6 +757,7 @@ function registerTicketsRoutes(deps) {
                 const existing = anyExisting && anyExisting.status === 'draft' ? anyExisting : undefined;
                 const title = providedTitle || existing?.title || (0, explore_draft_title_1.generateAutoTitle)(messages.map((m) => ({ role: m.role, content: m.content ?? '' })));
                 if (existing) {
+                    Object.assign(existing, repositoryScope(req, res));
                     existing.title = title;
                     if (description)
                         existing.description = description;
@@ -741,6 +769,7 @@ function registerTicketsRoutes(deps) {
                 }
                 const id = s.next_id++;
                 const ticket = {
+                    ...repositoryScope(req, res),
                     id,
                     title,
                     description,
@@ -904,6 +933,7 @@ function registerTicketsRoutes(deps) {
                         flipTarget.labels = labels;
                     // PATCH-route semantics: apply only when the field was supplied;
                     // metadata merges keys instead of replacing the object.
+                    Object.assign(flipTarget, repositoryScope(req, res));
                     if (hasAssignee)
                         flipTarget.assignee = assignee;
                     if (hasPrerequisites)
@@ -937,6 +967,7 @@ function registerTicketsRoutes(deps) {
                 // Legacy: insert new ticket
                 const id = s.next_id++;
                 const ticket = {
+                    ...repositoryScope(req, res),
                     id,
                     title: rawTitle,
                     description: descriptionForStore,
@@ -1057,13 +1088,12 @@ function registerTicketsRoutes(deps) {
                 // --resume; seeded with the just-inserted spec body). Default OFF at
                 // this layer so Explore-client payloads stay byte-identical — the MCP
                 // specs facade defaults it ON for agent-authored commit_drafts. The
-                // kill switch is checked inside the runner; Claude-only because the
-                // refine spawn hardcodes the `claude` binary.
-                const projectProviders = Array.isArray(project.providers) && project.providers.length > 0
-                    ? project.providers
-                    : [project.provider].filter((p) => typeof p === 'string');
-                const refineProvider = projectProviders.find((id) => (0, providers_1.getAdapter)(id).capabilities.structuredActions === true);
-                if (refineProvider) {
+                // The originating agent provider is forwarded by the authenticated MCP
+                // facade. Never borrow another installed provider (and its quota).
+                const requestedAgentProvider = typeof body.agentProvider === 'string' ? body.agentProvider : null;
+                const providerCheck = (0, provider_selection_1.validateRequestedProvider)(project, requestedAgentProvider);
+                const refineProvider = providerCheck.ok ? providerCheck.provider : null;
+                if (refineProvider && (0, providers_1.getAdapter)(refineProvider).capabilities.structuredActions === true) {
                     const refineTicketId = created.id;
                     const refineTitle = created.title;
                     const refineDescription = created.description;
@@ -1083,7 +1113,19 @@ function registerTicketsRoutes(deps) {
                     });
                 }
                 else {
-                    console.log(`[project-router] from-draft contract refine skipped (ticket #${created.id}): no capable provider installed`);
+                    console.info('[project-router] agent-authored contract refine skipped', JSON.stringify({
+                        ticketId: created.id,
+                        provider: refineProvider ?? requestedAgentProvider,
+                        reason: 'provider-unsupported',
+                    }));
+                    broadcast({
+                        type: 'explore.contract_refine_failed',
+                        projectId: project.id,
+                        provider: refineProvider ?? requestedAgentProvider ?? 'unknown',
+                        ticketId: created.id,
+                        reason: 'provider-unsupported',
+                        timestamp: new Date().toISOString(),
+                    });
                 }
             }
         }
@@ -1134,6 +1176,7 @@ function registerTicketsRoutes(deps) {
             const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
                 const id = s.next_id++;
                 const ticket = {
+                    ...repositoryScope(req, res),
                     id,
                     title,
                     description,
@@ -1457,6 +1500,7 @@ function registerTicketsRoutes(deps) {
             const store = (0, ticket_store_1.mutateStore)(filePath, (s) => {
                 const id = s.next_id++;
                 const ticket = {
+                    ...repositoryScope(req, res),
                     id,
                     title: title.trim(),
                     description: typeof description === 'string' ? description : '',
@@ -1532,6 +1576,7 @@ function registerTicketsRoutes(deps) {
                     validationError = err;
                     return;
                 }
+                Object.assign(ticket, repositoryScope(req, res));
                 if (title !== undefined)
                     ticket.title = title.trim();
                 if (description !== undefined)

package/server/dist/project-router.js

@@ -1,18 +1,28 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveDefaultSpecModel = exports.formatDescriptionWithCriteria = exports.lightlyStructurePrompt = exports.deriveFallbackShortSummary = exports.extractShortSummary = exports.stripSpecMetadataSections = void 0;
 exports.createProjectRouter = createProjectRouter;
 const express_1 = require("express");
+const node_fs_1 = __importDefault(require("node:fs"));
+const project_repositories_1 = require("./project-repositories");
+const file_summary_manager_1 = require("./file-summary-manager");
+const project_code_discovery_1 = require("./project-code-discovery");
+const feature_flags_1 = require("./feature-flags");
 const hooks_1 = require("./hooks");
 const rails_router_1 = require("./rails-router");
 const profiles_router_1 = require("./profiles-router");
 const plugins_router_1 = require("./plugins-router");
 const code_explorer_router_1 = require("./code-explorer-router");
+const code_activity_1 = require("./code-activity");
 const jira_router_1 = require("./jira-router");
 const ticket_store_1 = require("./ticket-store");
 const workspace_resolution_1 = require("./workspace-resolution");
 const workspace_manager_1 = require("./workspace-manager");
 const blueprint_render_1 = require("./blueprint-render");
+const milestone_progress_1 = require("./milestone-progress");
 const blueprint_draft_parser_1 = require("./blueprint-draft-parser");
 const blueprint_spec_quality_1 = require("./blueprint-spec-quality");
 const file_story_manager_1 = require("./file-story-manager");
@@ -45,6 +55,16 @@ function createProjectRouter(registry) {
         const projectId = req.params.projectId;
         const ctx = registry.getContext(projectId);
         if (!ctx) {
+            if (registry.getProjectRow(projectId)) {
+                const failure = registry.listFailedProjects().find((entry) => entry.project.id === projectId);
+                res.setHeader('Retry-After', '2');
+                res.status(503).json({
+                    error: 'project_unavailable',
+                    projectId,
+                    detail: failure?.error ?? 'Project is registered but its database is not available yet.',
+                });
+                return;
+            }
             res.status(404).json({ error: 'Project not found' });
             return;
         }
@@ -91,45 +111,115 @@ function createProjectRouter(registry) {
     const jiraRouter = (0, jira_router_1.createJiraRouter)();
     router.use('/:projectId/jira', jiraRouter);
     // Mount Code-Explorer router. FileSummaryManager comes from ProjectContext.
+    router.get('/:projectId/code/discover', async (req, res) => {
+        if (!(0, feature_flags_1.isCodeExplorerEnabled)()) {
+            res.status(404).json({ error: 'code_explorer_disabled' });
+            return;
+        }
+        try {
+            res.json(await (0, project_code_discovery_1.discoverProjectCode)(ctx(req).project, {
+                kind: String(req.query.kind ?? 'find'),
+                query: String(req.query.q ?? ''),
+                ...(req.query.limit === undefined ? {} : { limit: Number(req.query.limit) }),
+                ...(req.query.path === undefined ? {} : { path: String(req.query.path) }),
+                caseSensitive: req.query.caseSensitive === 'true',
+            }));
+        }
+        catch (err) {
+            res.status(400).json({ error: err.message });
+        }
+    });
+    // Activity reads recorded evidence across memberships; unlike source reads it
+    // can report unavailable roots explicitly without hiding the rest of a project.
+    router.get(['/:projectId/code/activity', '/:projectId/repositories/:repositoryId/code/activity'], async (req, res) => {
+        if (!(0, feature_flags_1.isCodeExplorerEnabled)()) {
+            res.status(404).json({ error: 'code_explorer_disabled' });
+            return;
+        }
+        try {
+            const context = ctx(req);
+            res.json(await (0, code_activity_1.listCodeActivity)(context.db, context.project, (0, code_activity_1.parseCodeActivityQuery)(req.query, req.params.repositoryId), code_explorer_router_1.filterCodeExplorerActivityPaths));
+        }
+        catch (err) {
+            res.status(err instanceof code_activity_1.CodeActivityQueryError ? err.status : 500).json({ error: err instanceof code_activity_1.CodeActivityQueryError ? err.message : 'activity_unavailable' });
+        }
+    });
     const codeRouterByCtx = new WeakMap();
-    router.use('/:projectId/code', (req, res, next) => {
+    const storyManagerByCtx = new WeakMap();
+    router.use(['/:projectId/repositories/:repositoryId/code', '/:projectId/code'], (req, res, next) => {
         const projectCtx = ctx(req);
-        const codeRouter = memoizedSubRouter(codeRouterByCtx, projectCtx, () => {
+        let repository;
+        try {
+            repository = (0, project_repositories_1.resolveProjectRepository)(projectCtx.project, req.params.repositoryId);
+        }
+        catch (err) {
+            res.status(404).json({ error: 'repository_not_found', detail: err.message });
+            return;
+        }
+        try {
+            if (!node_fs_1.default.statSync(repository.path).isDirectory())
+                throw new Error('not a directory');
+        }
+        catch {
+            res.status(503).json({ error: 'repository_unavailable', repositoryId: repository.id });
+            return;
+        }
+        let cache = codeRouterByCtx.get(projectCtx);
+        if (!cache) {
+            cache = new Map();
+            codeRouterByCtx.set(projectCtx, cache);
+        }
+        const members = (0, project_repositories_1.getProjectRepositories)(projectCtx.project);
+        for (const [id, cached] of cache) {
+            if (!members.some(member => member.id === id && member.path === cached.path)) {
+                cache.delete(id);
+                projectCtx.fileSummaryManager.detachWatcher(projectCtx.project.id, id);
+            }
+        }
+        let codeRouter = cache.get(repository.id)?.router;
+        if (!codeRouter) {
             // Construction-story contribution generator — per-ctx (memoized with the
             // router). Reuses the file-summary spawn skeleton with the story prompt,
             // and the SAME monthly budget setting + ai_invocations surface, so the
             // whole Code-section AI spend rides one budget (see file-story-manager).
             const storyAdapter = (0, providers_1.getAdapter)(projectCtx.project.provider ?? 'claude');
-            const fileStoryManager = new file_story_manager_1.FileStoryManager({
-                db: projectCtx.db,
-                broadcast: projectCtx.broadcast,
-                generate: (0, file_summary_generator_1.createFileSummaryGenerator)({
-                    adapter: storyAdapter,
-                    cwd: projectCtx.project.path,
-                    systemPrompt: file_story_manager_1.buildStorySystemPrompt,
-                }),
-                monthToDateSpend: (projectId) => {
-                    const row = projectCtx.db.prepare(`SELECT COALESCE(SUM(total_cost_usd), 0) AS total FROM ai_invocations
+            let fileStoryManager = storyManagerByCtx.get(projectCtx);
+            if (!fileStoryManager)
+                fileStoryManager = new file_story_manager_1.FileStoryManager({
+                    db: projectCtx.db,
+                    broadcast: projectCtx.broadcast,
+                    scheduler: projectCtx.fileSummaryManager,
+                    generate: (0, file_summary_generator_1.createFileSummaryGenerator)({
+                        adapter: storyAdapter,
+                        cwd: projectCtx.project.path,
+                        systemPrompt: file_story_manager_1.buildStorySystemPrompt,
+                    }),
+                    monthToDateSpend: (projectId) => {
+                        const row = projectCtx.db.prepare(`SELECT COALESCE(SUM(total_cost_usd), 0) AS total FROM ai_invocations
              WHERE project_id = ? AND surface = 'file-summary'
                AND started_at >= strftime('%Y-%m-01', 'now')`).get(projectId);
-                    return row?.total ?? 0;
-                },
-                monthlyBudgetUsd: () => {
-                    const raw = (0, desktop_db_1.getDesktopSetting)(projectCtx.desktopDb, 'summary_monthly_budget_usd');
-                    const n = parseFloat(raw ?? '5.00');
-                    return isNaN(n) ? 5.0 : n;
-                },
-                language: () => {
-                    const raw = (0, desktop_db_1.getDesktopSetting)(projectCtx.desktopDb, 'summary_language');
-                    return raw === 'es' ? 'es' : 'en';
-                },
-                providerId: () => storyAdapter.id,
-                getTicketSpec: projectCtx.getTicketSpec,
-            });
-            return (0, code_explorer_router_1.createCodeExplorerRouter)({
+                        return row?.total ?? 0;
+                    },
+                    monthlyBudgetUsd: () => {
+                        const raw = (0, desktop_db_1.getDesktopSetting)(projectCtx.desktopDb, 'summary_monthly_budget_usd');
+                        const n = parseFloat(raw ?? '5.00');
+                        return isNaN(n) ? 5.0 : n;
+                    },
+                    language: () => {
+                        const raw = (0, desktop_db_1.getDesktopSetting)(projectCtx.desktopDb, 'summary_language');
+                        return raw === 'es' ? 'es' : 'en';
+                    },
+                    providerId: () => storyAdapter.id,
+                    getTicketSpec: projectCtx.getTicketSpec,
+                });
+            storyManagerByCtx.set(projectCtx, fileStoryManager);
+            codeRouter = (0, code_explorer_router_1.createCodeExplorerRouter)({
                 db: projectCtx.db,
-                projectPath: projectCtx.project.path,
+                projectPath: repository.path,
                 projectId: projectCtx.project.id,
+                repositoryId: repository.id,
+                repositoryName: repository.name,
+                includeLegacyProvenance: repository.isPrimary,
                 broadcast: projectCtx.broadcast,
                 fileSummaryManager: projectCtx.fileSummaryManager,
                 getTicketSpec: projectCtx.getTicketSpec,
@@ -139,27 +229,123 @@ function createProjectRouter(registry) {
                 // relocated (source tree still read from project.path). Resolved per-call.
                 resolveSummaryRoot: () => {
                     const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: projectCtx.project.slug, path: projectCtx.project.path });
-                    return exec.relocated && exec.workspaceDir ? exec.workspaceDir : projectCtx.project.path;
+                    const artifactRoot = exec.relocated && exec.workspaceDir ? exec.workspaceDir : projectCtx.project.path;
+                    return (0, file_summary_manager_1.repositorySummaryRoot)(artifactRoot, repository);
                 },
             });
-        });
+            cache.set(repository.id, { path: repository.path, router: codeRouter });
+        }
         codeRouter(req, res, next);
     });
     // Project Builder sidebar re-entry (add-project-builder D5): read the
     // workspace-resident blueprint pair's source of truth. 404 when the project
     // has no blueprint (every non-Builder project) — the sidebar entry hides.
     router.get('/:projectId/blueprint', (req, res) => {
-        const project = ctx(req).project;
-        const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: project.slug, path: project.path });
-        const workspace = exec.relocated && exec.workspaceDir
-            ? exec.workspaceDir
-            : (project.slug ? (0, workspace_manager_1.workspacePathFor)(project.slug) : null);
-        const blueprint = workspace ? (0, blueprint_render_1.readBlueprint)(workspace) : null;
-        if (!blueprint) {
+        const projectCtx = ctx(req);
+        const project = projectCtx.project;
+        // `progress` is the server-derived live milestone model (premium-milestone-
+        // progress): counts by spec state, rails, chain, derived state — the same
+        // payload `blueprint.milestone_progress` re-broadcasts on every mutation.
+        const snapshot = (0, milestone_progress_1.readMilestoneProgress)({
+            db: projectCtx.db,
+            projectId: project.id,
+            workspaceDir: () => (0, milestone_progress_1.resolveBlueprintWorkspace)({ slug: project.slug, path: project.path }),
+            ticketsPath: () => ticketPath(req),
+            railJobs: projectCtx.railJobs,
+            railLoopRuns: projectCtx.railLoopRuns,
+            chains: projectCtx.milestoneChains ? () => projectCtx.milestoneChains.listActive() : undefined,
+        });
+        if (!snapshot) {
             res.status(404).json({ error: 'no blueprint for this project' });
             return;
         }
-        res.json({ blueprint });
+        res.json({ blueprint: snapshot.blueprint, progress: snapshot.progress });
+    });
+    // Milestone launch chain (premium-milestone-progress D3): "Launch Milestone
+    // N" is server-owned — chunked into ≤3-spec rails, launched through the
+    // ordinary rails launch route, and (sequential) chained on each chunk's
+    // delivered branch. The client keeps NO plan in browser storage.
+    router.post('/:projectId/blueprint/milestones/:n/launch', async (req, res) => {
+        const projectCtx = ctx(req);
+        const n = Number.parseInt(String(req.params.n), 10);
+        if (!Number.isInteger(n) || n < 1 || n > 999) {
+            res.status(400).json({ error: 'invalid_milestone' });
+            return;
+        }
+        const rawMode = (req.body ?? {}).mode;
+        if (rawMode !== undefined && rawMode !== 'sequential' && rawMode !== 'parallel') {
+            res.status(400).json({ error: "mode must be 'sequential' or 'parallel'" });
+            return;
+        }
+        const rawAuto = (req.body ?? {}).autoAdvance;
+        if (rawAuto !== undefined && typeof rawAuto !== 'boolean') {
+            res.status(400).json({ error: 'autoAdvance must be a boolean' });
+            return;
+        }
+        const chains = projectCtx.milestoneChains;
+        if (!chains) {
+            res.status(503).json({ error: 'milestone_chain_unavailable' });
+            return;
+        }
+        try {
+            const result = await chains.start(n, rawMode ?? 'sequential', { autoAdvance: rawAuto });
+            if (result.ok) {
+                res.status(202).json({ chainId: result.chainId, launched: result.launched, pending: result.pending });
+            }
+            else {
+                res.status(result.status).json({ error: result.error, ...(result.detail ? { detail: result.detail } : {}), ...(result.chainId ? { chainId: result.chainId } : {}) });
+            }
+        }
+        catch (err) {
+            console.error('[project-router] milestone launch error:', err);
+            res.status(500).json({ error: 'Failed to launch the milestone' });
+        }
+    });
+    router.post('/:projectId/blueprint/chains/:id/resume', async (req, res) => {
+        const chains = ctx(req).milestoneChains;
+        if (!chains) {
+            res.status(503).json({ error: 'milestone_chain_unavailable' });
+            return;
+        }
+        try {
+            const result = await chains.resume(String(req.params.id));
+            res.status(result.status).json(result.ok ? { chain: result.chain } : { error: result.error, ...(result.detail ? { detail: result.detail } : {}) });
+        }
+        catch (err) {
+            console.error('[project-router] chain resume error:', err);
+            res.status(500).json({ error: 'Failed to resume the chain' });
+        }
+    });
+    // Wave checkpoints (D9): flip auto-advance on a live chain; turning it on
+    // at a checkpoint launches the next chunk right away.
+    router.patch('/:projectId/blueprint/chains/:id', async (req, res) => {
+        const chains = ctx(req).milestoneChains;
+        if (!chains) {
+            res.status(503).json({ error: 'milestone_chain_unavailable' });
+            return;
+        }
+        const autoAdvance = (req.body ?? {}).autoAdvance;
+        if (typeof autoAdvance !== 'boolean') {
+            res.status(400).json({ error: 'autoAdvance must be a boolean' });
+            return;
+        }
+        try {
+            const result = await chains.setAutoAdvance(String(req.params.id), autoAdvance);
+            res.status(result.status).json(result.ok ? { chain: result.chain } : { error: result.error, ...(result.detail ? { detail: result.detail } : {}) });
+        }
+        catch (err) {
+            console.error('[project-router] chain patch error:', err);
+            res.status(500).json({ error: 'Failed to update the chain' });
+        }
+    });
+    router.post('/:projectId/blueprint/chains/:id/cancel', (req, res) => {
+        const chains = ctx(req).milestoneChains;
+        if (!chains) {
+            res.status(503).json({ error: 'milestone_chain_unavailable' });
+            return;
+        }
+        const result = chains.cancel(String(req.params.id));
+        res.status(result.status).json(result.ok ? { chain: result.chain } : { error: result.error, ...(result.detail ? { detail: result.detail } : {}) });
     });
     // Relocate-artifacts gate (single chokepoint for ALL project-router ticket
     // I/O): relocated ⇒ the registry entry's ticketsPath (workspace); legacy ⇒
@@ -190,6 +376,17 @@ function createProjectRouter(registry) {
             res.status(400).json({ error: 'specs must contain at least one titled spec' });
             return;
         }
+        let repositoryScopes;
+        try {
+            repositoryScopes = rawSpecs.map((spec) => (0, project_repositories_1.validateTicketRepositoryIds)(project, spec && typeof spec === 'object' ? spec.repositoryIds : undefined));
+        }
+        catch (err) {
+            if (err instanceof project_repositories_1.RepositoryValidationError) {
+                res.status(err.status).json({ error: err.message, code: err.code });
+                return;
+            }
+            throw err;
+        }
         const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: project.slug, path: project.path });
         const workspace = exec.relocated && exec.workspaceDir
             ? exec.workspaceDir
@@ -230,6 +427,7 @@ function createProjectRouter(registry) {
                         ? [indexToId.get(prerequisite)]
                         : [];
                     const ticket = {
+                        ...(repositoryScopes[index] ? { repositoryIds: repositoryScopes[index] } : {}),
                         id,
                         title: spec.title,
                         description: (0, project_router_helpers_1.formatDescriptionWithCriteria)(spec.description, spec.acceptanceCriteria),
@@ -257,6 +455,9 @@ function createProjectRouter(registry) {
             milestone.status = 'committed';
             milestone.ticketIds = created.map((t) => t.id);
             (0, blueprint_render_1.writeBlueprintPair)(workspace, blueprint);
+            // A blueprint now exists for sure — forget any "absent" memo so the
+            // ticket_created broadcasts below re-derive the milestone progress.
+            projectCtx.milestoneProgress?.invalidate();
             for (const ticket of created) {
                 projectCtx.broadcast({
                     type: 'ticket_created',