specrails-desktop 2.42.2 → 2.43.0

package/docs/ci-cd.md

@@ -42,7 +42,7 @@ The macOS job retains `artifacts/chromium-signing/` as the `chromium-signing-mac
 ## Credentials and external requirements
 
 - `RELEASE_PAT` must be authorized for release-please's pull requests and releases. It also permits tag pushes to trigger publication workflows; events created with the repository's ordinary `GITHUB_TOKEN` generally do not trigger another workflow.
-- `NPM_TOKEN` must authenticate an account with publishing permission for `specrails-desktop`. The workflow checks authentication and gives an explicit error before publishing. Provenance requires `id-token: write`; it does **not** grant npm publishing permission. Trusted publishing requires separate registry configuration and is not silently enabled here. An npm `E404` during publication is not sufficient evidence to identify a particular token or permission failure. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
+- Publication uses one of two credentials. When the `NPM_TOKEN` secret is set, it must authenticate an account with publishing permission for `specrails-desktop` (npm now requires such tokens to be granular with *bypass 2FA*, and they expire within 90 days); the workflow checks authentication and gives an explicit error before publishing. When the secret is empty, the job publishes through npm **trusted publishing**: it installs npm 11, removes the empty token line that `setup-node` writes, and lets npm exchange the job's OIDC identity (`id-token: write`) for a short-lived publish grant. That path only works once the package's *Trusted publisher* on npmjs.com names this repository (`fjpulidop/specrails-desktop`) and workflow file (`npm-publish.yml`, no environment); registry configuration is never changed from here. Provenance does **not** grant publishing permission in either mode. An npm `E404` during publication is npm's answer to an unauthorized publish and does not identify which token or permission failed; an `E403` mentioning two-factor authentication means the stored token lacks *bypass 2FA*. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
 - Existing Apple signing/notarization and Tauri updater signing secrets remain required. Installer build steps retain their platform-specific checks.
 - Hostinger credentials must support **explicit FTPS**, a valid TLS certificate, uploads and `RNFR`/`RNTO` in the release directory. There is no plaintext FTP fallback. A failed transfer or rename fails the workflow before old files are removed. [FTP action protocol and security options](https://github.com/SamKirkland/FTP-Deploy-Action/blob/v4.3.6/action.yml).
 

package/docs/codex.md

@@ -46,9 +46,9 @@ binary isn't on `PATH`; it shows install commands if you click "More info".
    The first provider you select becomes the project default.
 4. Submit. The app writes `.specrails/install-config.yaml` (with
    `provider: codex` and `tier: quick` as YAML keys) and spawns
-   `npx --yes --prefer-online specrails-core@^4.12.0 init --yes --from-config <file>`
+   `npx --yes --prefer-online specrails-core@^5.1.0 init --yes --from-config <file>`
    — the provider and tier live in the YAML, not as CLI flags. (The app
-   pins `specrails-core@^4.12.0`; that floor is the version that ships the
+   pins `specrails-core@^5.1.0`; that floor is the version that ships the
    current provider targets, including Kimi and the Codex skill set.) The install
    produces:
    - `.codex/config.toml` — model, reasoning effort, sandbox mode, and

package/docs/customizing.md

@@ -148,7 +148,7 @@ Most settings live in the UI. A few app-level switches are env-only because they
 
 | Variable | Effect |
 |----------|--------|
-| `SPECRAILS_CORE_BIN` | Override the `specrails-core` binary (default: `npx --yes --prefer-online specrails-core@^4.12.0` — the 4.12.0 floor is the release that ships the Kimi provider target) |
+| `SPECRAILS_CORE_BIN` | Override the `specrails-core` binary (default: `npx --yes --prefer-online specrails-core@^5.1.0` — the 5.1.0 floor is the release that quotes the command path in its Windows shell runner, so OpenSpec init works from an install directory with spaces; it is also the version bundled with the app) |
 | `SPECRAILS_TECH_URL` | Override the specrails-tech proxy base URL |
 | `SPECRAILS_AGENTS_SECTION=false` | Hide the Agents section from every project |
 | `SPECRAILS_PLUGINS_SECTION=false` | Hide the Integrations section from every project |

package/docs/gemini.md

@@ -24,11 +24,11 @@ Specrails supports **four AI providers**: Anthropic's
 |---|---|---|
 | `gemini` CLI ≥ 0.11.0 | Earlier versions lack `--output-format stream-json` + headless `--resume`, which the app relies on | `npm i -g @google/gemini-cli` · check with `gemini --version` |
 | A Gemini API key | The app spawns Gemini headlessly, so it needs non-interactive auth | Set `GEMINI_API_KEY` to a paid Gemini Developer API key from [Google AI Studio](https://aistudio.google.com/apikey) |
-| `specrails-core` ≥ 4.8.0 in the project | 4.8.0 ships the Gemini provider target (`.gemini/` commands + agents) that the rails pipeline needs | The current Add-Project install flow uses `specrails-core@^4.12.0` automatically |
+| `specrails-core` ≥ 4.8.0 in the project | 4.8.0 ships the Gemini provider target (`.gemini/` commands + agents) that the rails pipeline needs | The current Add-Project install flow uses `specrails-core@^5.1.0` automatically |
 | `git`, `node`, `npm`, `npx` | Same as Claude — needed for `specrails-core init` | Use your usual installer |
 
 > **Two different minimums.** The `gemini` **binary** floor is **0.11.0**.
-> The current Desktop `specrails-core` **package** floor is **4.12.0** (a
+> The current Desktop `specrails-core` **package** floor is **5.1.0** (a
 > single shared version for all providers, including Kimi). They are separate
 > things — the binary on your
 > machine vs. the artifacts installed into the project.
@@ -52,7 +52,7 @@ the Gemini provider checkbox with a "not found" hint when the binary isn't on
    project](#running-multiple-providers-in-one-project)). The first provider
    you select becomes the project default.
 4. Submit. The app writes `.specrails/install-config.yaml` and spawns
-   `npx --yes --prefer-online specrails-core@^4.12.0 init --yes --from-config <file>`.
+   `npx --yes --prefer-online specrails-core@^5.1.0 init --yes --from-config <file>`.
    The install produces the `.gemini/` artifacts (commands + `sr-*` agents),
    plus a `GEMINI.md` instructions file.
 

package/docs/getting-started.md

@@ -61,7 +61,7 @@ specrails-desktop list   # verify
 The setup wizard runs automatically. Three steps:
 
 1. **Configure** — choose which agents to install (the baseline trio `sr-architect`, `sr-developer`, `sr-reviewer` is always selected; optional agents like Test Writer or Security Reviewer are opt-in). Pick a model preset (Balanced / Budget / Max) and optionally override the model per agent.
-2. **Install** — the app runs the installer (`npx --yes --prefer-online specrails-core@^4.12.0 init --yes --from-config <config>`) non-interactively and streams the output live. The version is pinned to the core release the app ships with — it never silently jumps to a new major.
+2. **Install** — the app runs the installer (`npx --yes --prefer-online specrails-core@^5.1.0 init --yes --from-config <config>`) non-interactively and streams the output live. The version is pinned to the core release the app ships with — it never silently jumps to a new major.
 3. **Done** — a summary tells you how many agents and commands landed. Click **Continue to project**.
 
 That's the whole onboarding. No tier picker, no second wizard. You can manage agents and their per-agent models later from the **Agents** page (Profiles tab).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.42.2",
+  "version": "2.43.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/core-package.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CORE_PACKAGE_SPEC = void 0;
-/** Online fallback selects the supported Core 5 lifecycle. Bundled Core 4 remains
- * readable for installed apps; the runtime resolver selects the newest usable
- * compatible package and never downgrades a newer activated framework. */
-exports.CORE_PACKAGE_SPEC = 'specrails-core@^5.0.0';
+/** Online fallback selects the supported Core 5 lifecycle; 5.1.0 is the floor
+ * because it quotes the command path in its Windows shell runner (OpenSpec init
+ * from an install directory with spaces). The desktop bundles the same version.
+ * Bundled Core 4 remains readable for installed apps; the runtime resolver
+ * selects the newest usable compatible package and never downgrades a newer
+ * activated framework. */
+exports.CORE_PACKAGE_SPEC = 'specrails-core@^5.1.0';