specrails-desktop 2.54.0 → 2.55.0

package/client/dist/index.html

@@ -204,7 +204,7 @@
         .specrails-splash__mark .pill { opacity: 1; }
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-Cn-T8bgL.js"></script>
+    <script type="module" crossorigin src="/assets/index-BfAZg5DG.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CNC7AqOf.js">
     <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-zu2_FqZY.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-DiWzBDP9.js">

package/docs/ci-cd.md

@@ -41,6 +41,10 @@ The macOS job retains `artifacts/chromium-signing/` as the `chromium-signing-mac
 
 ## Credentials and external requirements
 
+### Recover an already published Desktop download channel
+
+If native builds and GitHub publication succeed but Hostinger installer uploads fail, run **Recover Desktop download channel** on `main` with the existing stable version (for example `2.54.0`). It requires successful main CI and successful native builds for that exact release commit, then streams all three published installers and verifies their sizes and GitHub SHA-256 digests. It atomically replaces only `latest/manifest.json` over verified FTPS, pointing downloads to the existing version-specific GitHub assets. It refuses version downgrades, verifies the public manifest after publication, and does not rebuild, delete installers, or alter the signed Tauri updater. Normal releases continue to use the regular distribution workflow.
+
 - `RELEASE_PAT` must be authorized for release-please's pull requests and releases. It also permits tag pushes to trigger publication workflows; events created with the repository's ordinary `GITHUB_TOKEN` generally do not trigger another workflow.
 - Publication uses one of two credentials. When the `NPM_TOKEN` secret is set, it must authenticate an account with publishing permission for `specrails-desktop` (npm now requires such tokens to be granular with *bypass 2FA*, and they expire within 90 days); the workflow checks authentication and gives an explicit error before publishing. When the secret is empty, the job publishes through npm **trusted publishing**: it installs npm 11, removes the empty token line that `setup-node` writes, and lets npm exchange the job's OIDC identity (`id-token: write`) for a short-lived publish grant. That path only works once the package's *Trusted publisher* on npmjs.com names this repository (`fjpulidop/specrails-desktop`) and workflow file (`npm-publish.yml`, no environment); registry configuration is never changed from here. Provenance does **not** grant publishing permission in either mode. An npm `E404` during publication is npm's answer to an unauthorized publish and does not identify which token or permission failed; an `E403` mentioning two-factor authentication means the stored token lacks *bypass 2FA*. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
 - Existing Apple signing/notarization and Tauri updater signing secrets remain required. Installer build steps retain their platform-specific checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.54.0",
+  "version": "2.55.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/agent-chat-manager.js

@@ -194,6 +194,9 @@ class AgentChatManager {
             })),
         };
     }
+    notifyConversationCreated(conversationId) {
+        this._broadcast({ type: 'agent_conversation_created', conversationId, timestamp: new Date().toISOString() });
+    }
     _startLifecycle(conversationId) {
         const startedAt = new Date().toISOString();
         this._turnStartedAt.set(conversationId, startedAt);
@@ -400,13 +403,20 @@ class AgentChatManager {
         const currentMessageId = options.queueId ? (0, agent_input_store_1.getAgentInput)(this._db, conversationId, options.queueId)?.messageId : null;
         const historyBlock = (0, agent_context_resolver_1.buildAgentHistoryBlock)((0, agent_input_store_1.decorateAgentInputMessages)(this._db, (0, agent_store_1.listAgentMessages)(this._db, conversationId))
             .filter((message) => message.id !== currentMessageId && message.delivery_status !== 'cancelled' && message.delivery_status !== 'interrupted'));
-        if (options.queueId) {
-            if (!(0, agent_input_store_1.deliverAgentInput)(this._db, conversationId, options.queueId, 'sent'))
-                return;
-        }
-        else {
-            (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'user', content: userText, attachmentIds, contextRefs: options.contextRefs });
-        }
+        const message = options.queueId
+            ? (0, agent_input_store_1.deliverAgentInput)(this._db, conversationId, options.queueId, 'sent')
+            : (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'user', content: userText, attachmentIds, contextRefs: options.contextRefs });
+        if (!message)
+            return;
+        // Queued turns were announced by the drain loop. Direct turns must also
+        // reach every open client, including Desktop when Companion sent the input.
+        if (!currentMessageId)
+            this._broadcast({
+                type: 'agent_input_started', conversationId, queueId: options.queueId ?? null,
+                messageId: message.id, text: message.content, timestamp: message.created_at,
+                contextRefs: options.contextRefs ?? [], attachmentIds: attachmentIds ?? [],
+                deliveryReceipt: 'sent',
+            });
         this._autoTitle(conversationId, conversation.title);
         // Providers WITHOUT a --system-prompt flag (codex, gemini) drop opts.systemPrompt
         // for chat turns, so the attachment prompt-injection note would never reach them —

package/server/dist/agent-chat-router.js

@@ -199,6 +199,7 @@ function createAgentChatRouter(deps) {
             // Off-catalog values fall back to null (= no provider-specific override).
             reasoningEffort: validEffort(provider, effectiveModel, body.reasoningEffort) ?? null,
         });
+        manager.notifyConversationCreated(conversation.id);
         res.status(201).json({ conversation });
     });
     router.get('/conversations/:id', (req, res) => {

package/server/dist/mobile/mobile-code.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relativeCodePath = relativeCodePath;
+exports.createMobileCodeRouter = createMobileCodeRouter;
+const express_1 = require("express");
+const mobile_redact_1 = require("./mobile-redact");
+const id = /^[A-Za-z0-9_-]{1,160}$/;
+function relativeCodePath(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 4096
+        && !/^[\\/]|^[A-Za-z]:|[\x00-\x1f\\]/.test(value)
+        && !value.split('/').some(part => part === '..' || part === '.' || part === '');
+}
+const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+/** Project ACL/auth run on the parent router. Desktop remains authoritative for
+ * repository membership, realpath confinement, deny-list and gitignore rules.
+ * Only this explicit source DTO preserves source text verbatim: applying the
+ * generic absolute-path scrubber to code would silently corrupt its contents.
+ */
+function createMobileCodeRouter(upstream) {
+    const router = (0, express_1.Router)();
+    for (const operation of ['tree', 'find', 'file']) {
+        router.get(`/projects/:pid/repositories/:rid/code/${operation}`, async (req, res) => {
+            const pid = req.params.pid, rid = req.params.rid;
+            if (!id.test(pid) || !id.test(rid)) {
+                res.status(400).json({ error: 'Invalid parameter' });
+                return;
+            }
+            const query = new URLSearchParams();
+            if (operation === 'tree') {
+                query.set('filter', 'all');
+                query.set('limit', '200');
+                if (req.query.cursor !== undefined) {
+                    if (typeof req.query.cursor !== 'string' || req.query.cursor.length > 4096) {
+                        res.status(400).json({ error: 'Invalid cursor' });
+                        return;
+                    }
+                    query.set('cursor', req.query.cursor);
+                }
+            }
+            else if (operation === 'find') {
+                if (typeof req.query.q !== 'string' || !req.query.q.trim() || req.query.q.length > 256) {
+                    res.status(400).json({ error: 'Invalid query' });
+                    return;
+                }
+                query.set('q', req.query.q);
+                query.set('limit', '50');
+            }
+            else {
+                if (!relativeCodePath(req.query.path)) {
+                    res.status(400).json({ error: 'Invalid relative path' });
+                    return;
+                }
+                query.set('path', req.query.path);
+                for (const key of ['startLine', 'startColumn']) {
+                    const value = req.query[key] ?? '1';
+                    if (typeof value !== 'string' || !/^[1-9]\d{0,8}$/.test(value)) {
+                        res.status(400).json({ error: 'Invalid range' });
+                        return;
+                    }
+                    query.set(key, value);
+                }
+                query.set('endLine', String(Number(query.get('startLine')) + 199));
+                if (req.query.expectedHash !== undefined) {
+                    if (typeof req.query.expectedHash !== 'string' || !/^[a-f0-9]{64}$/i.test(req.query.expectedHash)) {
+                        res.status(400).json({ error: 'Invalid hash' });
+                        return;
+                    }
+                    query.set('expectedHash', req.query.expectedHash);
+                }
+            }
+            try {
+                const response = await upstream('GET', `/api/projects/${encodeURIComponent(pid)}/repositories/${encodeURIComponent(rid)}/code/${operation}?${query}`);
+                if (response.status < 200 || response.status >= 300) {
+                    res.status(response.status).json((0, mobile_redact_1.redact)(response.json));
+                    return;
+                }
+                const data = record(response.json);
+                if (operation === 'file') {
+                    if (!relativeCodePath(data.path) || data.path !== req.query.path || typeof data.content !== 'string') {
+                        res.status(502).json({ error: 'Invalid source response' });
+                        return;
+                    }
+                    res.json({ relativePath: data.path, content: data.content, language: data.language,
+                        fileHash: data.fileHash, startLine: data.startLine, startColumn: data.startColumn,
+                        endLine: data.endLine, totalLines: data.totalLines, nextLine: data.nextLine, nextColumn: data.nextColumn });
+                }
+                else {
+                    const rows = data[operation === 'tree' ? 'entries' : 'matches'];
+                    res.json({ entries: (Array.isArray(rows) ? rows : []).map(record).filter(row => relativeCodePath(row.path)).map(row => ({
+                            relativePath: row.path, kind: row.kind === 'dir' ? 'dir' : 'file', sizeBytes: row.sizeBytes,
+                        })), nextCursor: operation === 'tree' ? data.nextCursor : null, truncated: data.truncated === true });
+                }
+            }
+            catch {
+                res.status(502).json({ error: 'Code explorer unavailable' });
+            }
+        });
+    }
+    return router;
+}

package/server/dist/mobile/mobile-missions.js

@@ -18,7 +18,7 @@ exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
 function mobileCapabilities(db, deviceId) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {

package/server/dist/mobile/mobile-router.js

@@ -8,6 +8,7 @@ const mobile_redact_1 = require("./mobile-redact");
 const mobile_auth_1 = require("./mobile-auth");
 const mobile_devices_1 = require("./mobile-devices");
 const mobile_missions_1 = require("./mobile-missions");
+const mobile_code_1 = require("./mobile-code");
 // The gateway's authenticated REST surface: the `/v1/*` allow-list. Each route
 // forwards, in-process, via a REAL loopback HTTP request to
 // http://127.0.0.1:<desktopPort> with the master token injected server-side as
@@ -448,12 +449,14 @@ function createMobileRouter(deps) {
             narrowed.acceptanceCriteria = b.acceptanceCriteria.filter((x) => typeof x === 'string');
         void forward(res, 'POST', `/api/projects/${encodeURIComponent(pid)}/tickets/from-draft`, '', narrowed);
     });
-    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: async (method, path, body) => {
-            const response = await fetch(internalBase + path, { method, signal: AbortSignal.timeout(30_000),
-                headers: { 'x-desktop-token': (0, auth_1.loadOrGenerateToken)(), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
-                ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
-            return { status: response.status, json: await response.json() };
-        } }));
+    const mobileUpstream = async (method, path, body) => {
+        const response = await fetch(internalBase + path, { method, signal: AbortSignal.timeout(30_000),
+            headers: { 'x-desktop-token': (0, auth_1.loadOrGenerateToken)(), ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}) },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+        return { status: response.status, json: await response.json() };
+    };
+    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: mobileUpstream }));
+    v1.use((0, mobile_code_1.createMobileCodeRouter)(mobileUpstream));
     router.use('/v1', v1);
     // Any unmatched gateway path → 404 JSON (NEVER falls through to a SPA handler;
     // the gateway serves JSON/WS only, no static client).
@@ -465,6 +468,9 @@ function createMobileRouter(deps) {
 /** The allow-list, exported for the CI drift test (asserts each entry resolves
  *  against a real internal route, and that no traversal param is accepted). */
 exports.MOBILE_ALLOWLIST = [
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/tree' },
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/find' },
+    { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/file' },
     { method: 'GET', path: '/v1/capabilities' },
     { method: 'GET', path: '/v1/mission-models' },
     { method: 'PATCH', path: '/v1/projects/:pid/missions/:cid/messages/:mid/intent' },