specrails-desktop 2.53.0 → 2.54.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.53.0",
+  "version": "2.54.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/mobile/mobile-missions.js

@@ -4,6 +4,7 @@ exports.MISSION_ACCESS_REASON = exports.MOBILE_PROTOCOL_VERSION = void 0;
 exports.mobileCapabilities = mobileCapabilities;
 exports.missionSnapshot = missionSnapshot;
 exports.createMobileMissionsRouter = createMobileMissionsRouter;
+const feature_flags_1 = require("../feature-flags");
 const node_string_decoder_1 = require("node:string_decoder");
 const express_1 = require("express");
 const agent_store_1 = require("../agent-store");
@@ -17,7 +18,7 @@ exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
 function mobileCapabilities(db, deviceId) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true },
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {
@@ -56,7 +57,7 @@ function missionSnapshot(value) {
             try {
                 const parsed = record(JSON.parse(raw));
                 if (parsed.kind === 'pr_decision')
-                    card = { ...pick(parsed, ['kind', 'railIndex', 'ticketIds', 'decision', 'implementationOutcome', 'deliveryOutcome', 'prNumber']), repositoryDeliveries: (Array.isArray(parsed.repositoryDeliveries) ? parsed.repositoryDeliveries : []).slice(0, 30).map(value => pick(value, ['repositoryId', 'repositoryName', 'decision'])) };
+                    card = { ...pick(parsed, ['kind', 'railIndex', 'ticketIds', 'decision', 'implementationOutcome', 'deliveryOutcome', 'prNumber', 'railName', 'phase', 'statusDetail', 'baseBranch']), runIds: (Array.isArray(parsed.runIds) ? parsed.runIds : []).filter(id => typeof id === 'string' && ID.test(id)).slice(0, 30), runtime: pick(parsed.runtime, ['status', 'currentStep', 'pendingApproval']), repositoryDeliveries: (Array.isArray(parsed.repositoryDeliveries) ? parsed.repositoryDeliveries : []).slice(0, 30).map(value => pick(value, ['repositoryId', 'repositoryName', 'decision'])) };
             }
             catch { /* Non-card system rows do not expose internal provider payloads. */ }
         }
@@ -65,7 +66,7 @@ function missionSnapshot(value) {
             break;
         }
         const content = record(message).role === 'system' ? '' : take(raw, 40_000);
-        bounded.unshift({ ...pick(message, ['id', 'role', 'created_at', 'delivery_status', 'delivery_receipt']), content, ...(card ? { card } : {}) });
+        bounded.unshift({ ...pick(message, ['id', 'role', 'created_at', 'delivery_status', 'delivery_receipt']), content, intents: (Array.isArray(record(message).intents) ? record(message).intents : []).slice(0, 30).map(value => pick(value, ['kind', 'proposalIndex', 'status', 'railIndex', 'runIds'])), ...(card ? { card } : {}) });
     }
     return { conversation: conversationView(data.conversation), messages: bounded, truncated,
         pendingMessages, pendingTruncated: pending.length > 50,
@@ -90,7 +91,12 @@ function createMobileMissionsRouter({ db, upstream }) {
             res.status(400).json({ error: 'A valid provider is required' });
             return;
         }
-        void send(res, 'GET', `/api/agent/models?provider=${encodeURIComponent(provider)}`);
+        const model = segment(req.query.model);
+        if (model.length > 200) {
+            res.status(400).json({ error: 'Invalid model' });
+            return;
+        }
+        void send(res, 'GET', `/api/agent/models?provider=${encodeURIComponent(provider)}${model ? `&model=${encodeURIComponent(model)}` : ''}`);
     });
     router.get('/projects/:pid/repositories', (req, res) => {
         const pid = segment(req.params.pid);
@@ -175,6 +181,22 @@ function createMobileMissionsRouter({ db, upstream }) {
         }
         void send(res, 'POST', `${id.base}/send`, { text: b.text, queueId: b.queueId, deliveryMode: b.deliveryMode ?? 'queue' }, data => pick(data, ['accepted', 'queued', 'duplicate', 'removed', 'deliveryMode']));
     });
+    router.patch('/projects/:pid/missions/:cid/messages/:mid/intent', (req, res) => {
+        const id = identity(req, res);
+        if (!id)
+            return;
+        const mid = segment(req.params.mid), b = record(req.body);
+        if (!ID.test(mid) || b.kind !== 'rail-launch' || !Number.isSafeInteger(b.proposalIndex) || Number(b.proposalIndex) < 0 || Number(b.proposalIndex) > 100) {
+            res.status(400).json({ error: 'Invalid proposal' });
+            return;
+        }
+        const message = db.prepare('SELECT conversation_id FROM agent_messages WHERE id = ?').get(mid);
+        if (!message || message.conversation_id !== segment(req.params.cid)) {
+            res.status(404).json({ error: 'Message not found in this mission' });
+            return;
+        }
+        void send(res, 'PATCH', `${id.base}/messages/${encodeURIComponent(mid)}/intent`, pick(b, ['kind', 'proposalIndex', 'status', 'railIndex', 'runIds', 'prDeliveryId']), data => ({ message: pick(record(data).message, ['id', 'intents']) }));
+    });
     router.post('/projects/:pid/missions/:cid/abort', (req, res) => { const id = identity(req, res); if (id)
         void send(res, 'POST', `${id.base}/abort`, {}); });
     for (const action of ['edit', 'steer', 'remove']) {

package/server/dist/mobile/mobile-router.js

@@ -187,6 +187,23 @@ function createMobileRouter(deps) {
             return;
         void forward(res, 'DELETE', `/api/projects/${encodeURIComponent(pid)}/tickets/${encodeURIComponent(tid)}`, '');
     });
+    v1.post('/projects/:pid/rails', (req, res) => {
+        const pid = seg(req.params.pid);
+        if (!validate(res, [pid, PID_RE]))
+            return;
+        const name = req.body?.name;
+        if (name != null && (typeof name !== 'string' || name.length > 60)) {
+            res.status(400).json({ error: 'Invalid rail name' });
+            return;
+        }
+        void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/rails`, '', { name: name ?? null });
+    });
+    v1.get('/projects/:pid/profiles', (req, res) => {
+        const pid = seg(req.params.pid), provider = seg(req.query.provider);
+        if (!validate(res, [pid, PID_RE], [provider, PID_RE]))
+            return;
+        void forward(res, 'GET', `/api/projects/${encodeURIComponent(pid)}/profiles`, `?provider=${encodeURIComponent(provider)}`);
+    });
     v1.put('/projects/:pid/rails/:i/tickets', (req, res) => {
         const pid = seg(req.params.pid), i = seg(req.params.i);
         if (!validate(res, [pid, PID_RE], [i, NUM_RE]))
@@ -219,6 +236,33 @@ function createMobileRouter(deps) {
             // provider. This gateway only narrows to the cross-provider enum.
             narrowed.reasoning_effort = b.reasoning_effort;
         }
+        if (b.targetPrNumber !== undefined) {
+            if (!Number.isSafeInteger(b.targetPrNumber) || Number(b.targetPrNumber) < 1) {
+                res.status(400).json({ error: 'Invalid PR number' });
+                return;
+            }
+            narrowed.targetPrNumber = b.targetPrNumber;
+        }
+        if (b.baseBranch !== undefined) {
+            if (typeof b.baseBranch !== 'string' || !b.baseBranch.trim() || b.baseBranch.length > 200) {
+                res.status(400).json({ error: 'Invalid base branch' });
+                return;
+            }
+            narrowed.baseBranch = b.baseBranch;
+        }
+        if (b.originConversationId !== undefined) {
+            if (typeof b.originConversationId !== 'string' || !PID_RE.test(b.originConversationId)) {
+                res.status(400).json({ error: 'Invalid mission' });
+                return;
+            }
+            const conversation = deps.db.prepare('SELECT pinned_project_id FROM agent_conversations WHERE id = ?').get(b.originConversationId);
+            if (!conversation || conversation.pinned_project_id !== pid || (0, mobile_devices_1.getAllowedProjects)(deps.db, req.mobileDevice.id) !== null) {
+                res.status(403).json({ error: 'Mission is not accessible' });
+                return;
+            }
+            narrowed.originConversationId = b.originConversationId;
+            narrowed.originSurface = 'agent-chat';
+        }
         if (typeof b.interactive === 'boolean')
             narrowed.interactive = b.interactive;
         if (b.repositoryIds !== undefined) {
@@ -423,6 +467,7 @@ function createMobileRouter(deps) {
 exports.MOBILE_ALLOWLIST = [
     { method: 'GET', path: '/v1/capabilities' },
     { method: 'GET', path: '/v1/mission-models' },
+    { method: 'PATCH', path: '/v1/projects/:pid/missions/:cid/messages/:mid/intent' },
     { method: 'GET', path: '/v1/projects/:pid/repositories' },
     { method: 'GET', path: '/v1/projects/:pid/missions' },
     { method: 'POST', path: '/v1/projects/:pid/missions' },
@@ -445,6 +490,9 @@ exports.MOBILE_ALLOWLIST = [
     { method: 'GET', path: '/v1/projects/:pid/loop-runs/:id' },
     { method: 'GET', path: '/v1/projects/:pid/queue' },
     { method: 'GET', path: '/v1/projects/:pid/rails' },
+    { method: 'POST', path: '/v1/projects/:pid/rails' },
+    { method: 'GET', path: '/v1/projects/:pid/profiles' },
+    { method: 'PUT', path: '/v1/projects/:pid/rails/:i/name' },
     { method: 'GET', path: '/v1/projects/:pid/activity' },
     { method: 'GET', path: '/v1/projects/:pid/stats' },
     { method: 'GET', path: '/v1/projects/:pid/state' },

package/server/dist/mobile/mobile-signal-reconnect.js

@@ -22,6 +22,7 @@ class MobileSignalReconnect {
     _deps;
     _timeoutMs;
     _timer = null;
+    _attempts = new Map();
     _busy = false;
     _epoch = 0;
     _requests = new Set();
@@ -34,9 +35,11 @@ class MobileSignalReconnect {
             return;
         this._timer = setInterval(() => void this.poll(), intervalMs);
         this._timer.unref?.();
+        void this.poll();
     }
     stop() {
         this._epoch++;
+        this._attempts.clear();
         for (const controller of this._requests)
             controller.abort();
         this._requests.clear();
@@ -61,6 +64,14 @@ class MobileSignalReconnect {
                     if (epoch !== this._epoch)
                         return;
                     if (req !== null) {
+                        let requestId = null;
+                        try {
+                            const value = JSON.parse(req);
+                            if (typeof value?.requestId === 'string' && /^[a-zA-Z0-9_-]{8,80}$/.test(value.requestId))
+                                requestId = value.requestId;
+                        }
+                        catch { /* legacy request */ }
+                        this._attempts.set(room, requestId);
                         const offer = await this._deps.makeOffer(room);
                         if (epoch !== this._epoch)
                             return;
@@ -68,7 +79,7 @@ class MobileSignalReconnect {
                             // BUG-AUTH-01: never publish `offer.secret` to the public mailbox.
                             // The reconnecting companion authenticates with its existing device
                             // token; the secret would only help an eavesdropper.
-                            await this._post(room, 'offer', JSON.stringify({ sdp: offer.sdp, hub: offer.hubInstanceId, name: offer.hubName }));
+                            await this._post(room, 'offer', JSON.stringify({ sdp: offer.sdp, hub: offer.hubInstanceId, name: offer.hubName, ...(requestId ? { requestId } : {}) }));
                         }
                     }
                     // A phone's answer waiting? → complete the connection.
@@ -80,8 +91,11 @@ class MobileSignalReconnect {
                     if (ans) {
                         try {
                             const parsed = JSON.parse(ans);
-                            if (typeof parsed.sdp === 'string')
-                                await this._deps.acceptAnswer(room, parsed.sdp);
+                            const expected = this._attempts.get(room);
+                            if (expected && parsed.requestId !== expected)
+                                continue;
+                            if (typeof parsed.sdp === 'string' && await this._deps.acceptAnswer(room, parsed.sdp))
+                                this._attempts.delete(room);
                         }
                         catch {
                             /* malformed answer — ignore */