specrails-desktop 2.55.0 → 2.56.0

package/docs/internals/spec-addenda.md

@@ -62,7 +62,7 @@ dismissed ◀──(user)──▶ open/applied   (an in-flight one is frozen un
 ```
 
 - **Claim** — `claimSpecAddendaForRun(storePath, ticketIds, runId, { plan? })`
-  (`server/spec-addenda.ts`): quick read (most launches carry nothing → no lock,
+  (`server/modules/specs/runtime/spec-addenda.ts`): quick read (most launches carry nothing → no lock,
   no rewrite), then `mutateStore` re-plans under the lock and marks
   `open → in_flight` with the run id. Idempotent for the same run (a resume
   re-claims its own); another run's in-flight addenda are never stolen. Returns
@@ -97,9 +97,33 @@ carry an addendum; a body is evidence, not an order — and demands an
 In the loop engine (`loop-run-manager.ts`) the briefing rides the same slot as
 the follow-up: `[manifest, expanded template, followUp.briefing, addenda.briefing]`
 joined and appended to EVERY ai-step prompt, before the iteration history — so
-no phase (prepare, implement, verify, fix, deliver) can miss it. Custom loops,
-`factory:revision`, SDD Quick, Implement, Batch and Freestyle are therefore all
-covered without touching any template.
+no phase (prepare, implement, verify, fix, deliver) can miss it. Rail launches carrying addenda always select **Quick SDD**. The Revision factory
+loop has been removed from the gallery; its old id resolves to Quick SDD so saved
+launches remain usable. Legacy jobs still receive their existing briefing.
+
+### Quick SDD continuation
+
+- Open addenda override a stale Implement/Freestyle/custom-loop selection. The
+  mission launch card and rail selector show Quick SDD before launch.
+- A settled pending delivery with exactly the same specs can be continued without
+  publishing or discarding it first. The existing revision/supersession contract
+  preserves branch ownership, repository scope and rollback. Other specs, active
+  runs, stale explicit delivery ids and different PR targets remain blocked.
+- Quick SDD seeds a run-specific `spec-addenda-<hash>` target from the frozen
+  addendum identities, full briefing and run id. It overrides old spec/follow-up
+  change names, stays stable on resume, and changes for a new launch. Every AI
+  phase receives the full delta and exact target; Prepare creates missing artifacts
+  and Apply explicitly names that change. Existing PR work is compatibility
+  context even when Jira calls the spec `in_progress`.
+- Apply cannot advance to CLI validation/archive on `VERIFICATION: PASS` alone.
+  Every attached id must report `applied` with nonempty files and tests. Missing,
+  partial or blocked reports fail the step and the ordinary failed-run lifecycle
+  reopens the addenda. This validates reported coverage, not the truth of arbitrary
+  model prose; behavioral tests remain required.
+- Asking for changes in the review packet also runs Quick SDD. Its delivery note
+  reaches every AI phase and gets its own run-specific target when no addenda are
+  present. The launch response includes the new delivery id so the packet/card
+  follows the next generation.
 
 ### Surfaces
 
@@ -127,8 +151,8 @@ covered without touching any template.
   `delete_addendum` (destructive). `add_addendum` records `created_by: 'agent'`
   + the origin conversation when called from a mission, else `'mcp'`.
 - **Operator prompt** — "iterate on / extend an existing spec = a SPEC ADDENDUM,
-  never a description edit": add the addendum, then launch normally; combine
-  freely with `revisionNote`. The agent context resolver lists a `#ref`'d
+  never a description edit": add the addendum, then launch Quick SDD; combine
+  with `revisionNote` when explicitly continuing a pending delivery. The agent context resolver lists a `#ref`'d
   spec's addenda with their status and run id.
 - **i18n** — `tickets:addenda.*`, `packet:addenda.*`, `agent:railCard.addenda.*`,
   `specs:badges.addendaTitle_*` ×8.
@@ -140,8 +164,9 @@ classifies a `pr_failed` row that never ran (no PR, SHA, branches, worktrees,
 not a continuation). The launch route closes such a row in place
 (`pr_failed → discarded`, `rail.pr_state` re-broadcast) and proceeds — pressing
 Launch again IS the decision. A revision naming it gets 409
-`invalid_revision_target` with a precise detail (nothing to revise). A real
-undecided delivery still answers `pr_decision_pending`.
+`invalid_revision_target` with a precise detail (nothing to revise). An unrelated
+undecided delivery still answers `pr_decision_pending`; same-spec addenda can
+continue the existing generation.
 
 ## Guarantees
 
@@ -149,7 +174,7 @@ undecided delivery still answers `pr_decision_pending`.
   or Jira. `PATCH /tickets/:id` ignores an `addenda` field.
 - A running generation is briefed with the frozen hash it was launched with; an
   edit after launch is refused while in flight and never changes the snapshot.
-- Ordinary launches without addenda are byte-identical (`spec_addenda` NULL,
+- Ordinary launches without addenda or delivery change requests keep their loop (`spec_addenda` NULL,
   no `LoopRunRequest.addenda`, no lock taken, no extra prompt text).
 - Both settle chokepoints and the discard reopen are keyed on the run id /
   the delivery snapshot — a replay, a newer owner or a concurrent launch can
@@ -164,3 +189,34 @@ undecided delivery still answers `pr_decision_pending`.
   user wants it kept, an explicit addendum).
 - Jira mirroring of addenda (a comment per addendum) — deliberately not done;
   addenda are local guidance for the run, not tracker content.
+
+## Quick SDD scope and efficiency
+
+Quick SDD can implement a complete spec without addenda, a PR, or a predefined
+OpenSpec name. It is freely selectable instead of Implement. Preparation receives
+the full frozen spec and creates a name when absent; Apply implements its artifacts.
+For delivered work, attached addenda/change requests define the delta instead.
+
+The normal path uses two AI phases: artifact preparation, then implementation with
+relevant behavioral tests and repository-required checks. Deterministic strict CLI
+validation runs before implementation and again before archive. Preparation must
+not implement code or run the repository suite.
+
+Each failing phase has at most one recovery within the same run: failed acceptance
+checks repeat Apply with bounded diagnostics; failed artifact validation invokes
+an artifact-only repair and returns directly to that validation. Archive can retry
+once without an AI call. Provider failures, missing targets, cancellation and cost
+limits do not trigger paid recovery. Exhausted failures stop before delivery.
+This does not add durable phase resume after process restart.
+
+Continuation context retains request, branch, diff and prior evidence while
+avoiding duplicate spec/addendum bodies in the revision seed. Frozen addenda are
+still supplied to each AI phase, including recovery. Diagnostics are capped, but
+the admitted addendum briefing is not abbreviated.
+
+Persisted `loop_phase_recovery` events identify recovery routing.
+`loop_phase_metrics` records prompt/output characters and the final AI attempt's
+available usage, cache counts, cost and duration; missing values remain null and
+estimated costs remain identified. These events are diagnostic, not an additional
+billing source; invocation accounting remains authoritative across all attempts.
+Character counts are not token estimates, and no percentage saving is assumed.

package/docs/internals/switch-to-agent-mode-design.md

@@ -67,12 +67,12 @@ Key structural moves shown above:
 | File | Responsibility | Key anchors |
 |---|---|---|
 | `client/src/context/UiModeContext.tsx` | App-global `uiMode: 'kanban'\|'agent'` + `setUiMode`/`toggle`, localStorage-persisted; `useUiMode()` with NOOP fallback for tests. | Insert provider at App.tsx:440-441; consumed by TitleBar/ArcSidebar/AgentChatContext/DesktopApp. |
-| `client/src/components/agent-chat/AgentConversationView.tsx` | Shared inner UI (banners + sticky-scroll message list + streaming + activity chip + composer) consumed by BOTH the floating panel and the inline surface; `variant: 'floating'\|'inline'`. | Extracted from AgentChatPanel.tsx:158-269. |
-| `client/src/components/agent-chat/AgentModeSurface.tsx` | Inline center surface: EMPTY (`active===null` → centered composer card) vs ACTIVE (`<AgentConversationView variant='inline'/>` + optional Files/code split). Does NOT call `ensureActive` on mount. | Mounted at App.tsx center swap (:252-296). |
-| `client/src/components/agent-chat/AgentWorkspaceSidebar.tsx` | Right "On workspace" toolbar in Agent Mode: Browser / Terminal / Files buttons, each disabled when `activeProjectId` is null. | Mounted at App.tsx:302 (agent branch). |
-| `client/src/components/agent-chat/AgentModeCodePane.tsx` (optional wrapper) | Resizable split host that mounts `<CodePage embedded/>` as a secondary pane beside the thread; own `<Suspense>` boundary. | Wraps CodePage.tsx (lazy). |
+| `client/src/features/missions/components/AgentConversationView.tsx` | Shared inner UI (banners + sticky-scroll message list + streaming + activity chip + composer) consumed by BOTH the floating panel and the inline surface; `variant: 'floating'\|'inline'`. | Extracted from AgentChatPanel.tsx:158-269. |
+| `client/src/features/missions/components/AgentModeSurface.tsx` | Inline center surface: EMPTY (`active===null` → centered composer card) vs ACTIVE (`<AgentConversationView variant='inline'/>` + optional Files/code split). Does NOT call `ensureActive` on mount. | Mounted at App.tsx center swap (:252-296). |
+| `client/src/features/missions/components/AgentWorkspaceSidebar.tsx` | Right "On workspace" toolbar in Agent Mode: Browser / Terminal / Files buttons, each disabled when `activeProjectId` is null. | Mounted at App.tsx:302 (agent branch). |
+| `client/src/features/missions/components/AgentModeCodePane.tsx` (optional wrapper) | Resizable split host that mounts `<CodePage embedded/>` as a secondary pane beside the thread; own `<Suspense>` boundary. | Wraps CodePage.tsx (lazy). |
 | `server/agent-attachment-routes` (in `agent-chat-router.ts`) | App-global attachment endpoints: `POST/GET/DELETE /api/agent/conversations/:id/attachments` (multer single 'file', 25MB, mime filter). | Mirror project-router-tickets.ts:1839-1917. |
-| `server/agent-store` migration | Persist attachment id list per agent turn (new nullable `attachments` JSON column on `agent_messages`, or sibling `agent_message_attachments` table). | agent-store.ts:24-30,111-128. |
+| `server/modules/agents/runtime/agent-store` migration | Persist attachment id list per agent turn (new nullable `attachments` JSON column on `agent_messages`, or sibling `agent_message_attachments` table). | agent-store.ts:24-30,111-128. |
 
 ### EXISTING files to modify
 
@@ -81,12 +81,12 @@ Key structural moves shown above:
 | `client/src/App.tsx` | Insert `UiModeProvider`; branch center on `uiMode`; branch right sidebar; hoist `BottomPanel`+`StatusBar` into main-area column; source `viewportHeight`/`panelState`/`connectionStatus` at DesktopApp scope. | 230-330 (shell), 440-461 (providers). |
 | `client/src/components/ProjectLayout.tsx` | REMOVE the `BottomPanel`/`StatusBar` render (hoisted); keep `<Outlet/>`, ChatContext; gate chevronSlot on `uiMode==='kanban'`; relocate the `viewportHeight` ResizeObserver + `panelState` up. | 66-95, 124-134. |
 | `client/src/components/TitleBar.tsx` | Hide `SearchPill` when `uiMode==='agent'` at both mount sites. | 66-129 (pill), 175 & 215 (mounts). |
-| `client/src/context/AgentChatContext.tsx` | Gate `AgentChatPanel`(:293) + `AgentBubble`(:296) off when `uiMode==='agent'`; expose a public `refreshConversations`; extend `newConversation(projectId?)`. | 39-70, 246-253, 290-298. |
-| `client/src/components/agent-chat/AgentChatPanel.tsx` | Reduce to thin chrome wrapper rendering `<AgentConversationView variant='floating'/>`; keep `useMovableResizableModal`/maximize/header/`ResizeGrips`. | 30-119 (chrome), 121-284 (body). |
+| `client/src/features/missions/context/AgentChatContext.tsx` | Gate `AgentChatPanel`(:293) + `AgentBubble`(:296) off when `uiMode==='agent'`; expose a public `refreshConversations`; extend `newConversation(projectId?)`. | 39-70, 246-253, 290-298. |
+| `client/src/features/missions/components/AgentChatPanel.tsx` | Reduce to thin chrome wrapper rendering `<AgentConversationView variant='floating'/>`; keep `useMovableResizableModal`/maximize/header/`ResizeGrips`. | 30-119 (chrome), 121-284 (body). |
 | `client/src/components/ArcSidebar.tsx` | Add `useAgentChat()` + `useUiMode()`; add [Switch mode]/[New agent]/[Search] buttons above Loops; make `ProjectItem` expandable; render conversation children + Home group; branch `handleSelectProject` by mode. | 1-9, 19-106, 135-166, 206-259. |
-| `client/src/pages/CodePage.tsx` | Add controlled/`embedded` props; neutralize `navigate({pathname:'/code'})` calls; gate URL→state effects when embedded. | 51-96, 129-160. |
-| `server/agent-chat-router.ts` | Parse `attachments:{ids}` on `POST /:id/send`; add attachment endpoints. | 144-163. |
-| `server/agent-chat-manager.ts` | Resolve attachment textBlocks via `attachmentManager.getClaudeArgs`, fold into `prompt` before pinned-project prefix; append note for codex/gemini into prompt. | 72-235 (fold near :97-102, chokepoint :151). |
+| `client/src/features/code/pages/CodePage.tsx` | Add controlled/`embedded` props; neutralize `navigate({pathname:'/code'})` calls; gate URL→state effects when embedded. | 51-96, 129-160. |
+| `server/modules/missions/runtime/agent-chat-router.ts` | Parse `attachments:{ids}` on `POST /:id/send`; add attachment endpoints. | 144-163. |
+| `server/modules/missions/runtime/agent-chat-manager.ts` | Resolve attachment textBlocks via `attachmentManager.getClaudeArgs`, fold into `prompt` before pinned-project prefix; append note for codex/gemini into prompt. | 72-235 (fold near :97-102, chokepoint :151). |
 | `server/attachment-manager.ts` | Add app-global agent storage root (`~/.specrails/agent/<conversationId>/attachments/`) or overload; keep traversal guards. | 89-133, 287-348. |
 
 ---
@@ -155,7 +155,7 @@ All three are gated on `!!activeProjectId` (disabled tooltip otherwise), matchin
 
 The Explore browser-capture stack is fully project-scoped and reusable verbatim.
 
-- **Reuse:** `BrowserCaptureModal` (props `{open,onClose,projectId,pendingSpecId,onCaptured,confirmLabel}`), `CapturedDomPanel` (props `{dom,onRemove?}`), the `client/src/lib/browser-capture.ts` REST helpers (`createBrowserSession`, `navigateBrowser`, `captureBrowserRegion`, `captureBrowserBreakpoints`, `uploadCaptureImage`), `isBrowserCaptureEnabled()` (client flag `VITE_FEATURE_BROWSER_CAPTURE`), and server `requireBrowserCaptureEnabled`/`SPECRAILS_BROWSER_CAPTURE` (feature-flags.ts:9-13). Server session endpoints at project-router-terminals.ts:200-410.
+- **Reuse:** `BrowserCaptureModal` (props `{open,onClose,projectId,pendingSpecId,onCaptured,confirmLabel}`), `CapturedDomPanel` (props `{dom,onRemove?}`), the `client/src/features/browser/lib/browser-capture.ts` REST helpers (`createBrowserSession`, `navigateBrowser`, `captureBrowserRegion`, `captureBrowserBreakpoints`, `uploadCaptureImage`), `isBrowserCaptureEnabled()` (client flag `VITE_FEATURE_BROWSER_CAPTURE`), and server `requireBrowserCaptureEnabled`/`SPECRAILS_BROWSER_CAPTURE` (feature-flags.ts:9-13). Server session endpoints at project-router-terminals.ts:200-410.
 - **New work:** wire the sidebar Browser button to open `BrowserCaptureModal` with the current `activeProjectId` and the agent conversation's pending id; route `onCaptured` into the composer capture chips (see §7). Requires an active project (browser sessions are project-scoped).
 
 ---

package/docs/tracking-cost.md

@@ -34,7 +34,7 @@ requests create no invocation row; AI auto-title uses a deterministic fallback.
 Whether a cost figure is exact depends on the provider's CLI, not on which provider you picked:
 
 - **Claude cost is provider-billed and authoritative** — the figure comes straight from the CLI's own usage report.
-- **Codex and Gemini do not report cost natively**, so the app **estimates** their cost from a local rate-card (`server/pricing.ts`) using the captured token counts. Estimated rows are flagged: they render with a `~` tilde in the raw table (hover for the tooltip — *"Estimated from local pricing table — this provider does not report cost natively"*) and feed an "includes ~$X estimated" footnote in the Hero.
+- **Codex and Gemini do not report cost natively**, so the app **estimates** their cost from a local rate-card (`server/modules/accounting/runtime/pricing.ts`) using the captured token counts. Estimated rows are flagged: they render with a `~` tilde in the raw table (hover for the tooltip — *"Estimated from local pricing table — this provider does not report cost natively"*) and feed an "includes ~$X estimated" footnote in the Hero.
 - **Kimi reports neither token counts nor a native USD-cost envelope** in its
   stream. Specrails does not invent an estimate: cost and token cells stay
   unavailable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.55.0",
+  "version": "2.56.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -47,7 +47,10 @@
     "test:coverage": "vitest run --coverage --maxWorkers=1 --reporter=dot --bail=1",
     "test:client": "cd client && npx vitest run",
     "test:all": "vitest run && cd client && npx vitest run",
-    "ci": "npm run typecheck && npm run check-core-compat && npm run test:scripts && npm run test:coverage && npm run test:coverage --prefix client && npm run build && npm run check:package"
+    "ci": "npm run typecheck && npm run check-core-compat && npm run test:scripts && npm run test:coverage && npm run test:coverage --prefix client && npm run build && npm run check:package",
+    "audit:source": "node scripts/audit-source.mjs",
+    "docs:source-map": "node scripts/generate-source-map.mjs",
+    "audit:architecture": "node scripts/audit-server-modules.mjs --check && node scripts/audit-client-features.mjs --check"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/server/dist/agent-mcp-config.js

@@ -17,7 +17,7 @@ const os_1 = __importDefault(require("os"));
 const crypto_1 = require("crypto");
 const path_resolver_1 = require("./path-resolver");
 const win_spawn_1 = require("./util/win-spawn");
-const agent_tier_1 = require("./agent-tier");
+const agent_tier_1 = require("./modules/missions/runtime/agent-tier");
 const providers_1 = require("./providers");
 const external_mcp_1 = require("./external-mcp");
 const AGENT_CONVERSATION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;

package/server/dist/attachment-manager.js

@@ -10,7 +10,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const ids_1 = require("./ids");
-const ticket_store_1 = require("./ticket-store");
+const ticket_store_1 = require("./modules/specs/runtime/ticket-store");
 exports.SUPPORTED_MIME_TYPES = new Set([
     'image/jpeg',
     'image/png',

package/server/dist/build-dirs.js

@@ -11,8 +11,8 @@ exports.isInBuildDir = isInBuildDir;
  * Recursively watching such a tree was the confirmed root cause of a file-descriptor
  * leak (~10k fds) that, under fd pressure, made node-pty's forkpty fail to give the
  * child shell a controlling tty — the shell then read EOF and exited instantly,
- * producing dead/hung terminals. See server/file-summary-manager.ts (the watcher)
- * and server/code-explorer-router.ts (the on-demand tree walk).
+ * producing dead/hung terminals. See server/modules/code/runtime/file-summary-manager.ts (the watcher)
+ * and server/modules/code/runtime/code-explorer-router.ts (the on-demand tree walk).
  *
  * Dot-directories (`.git`, `.next`, `.turbo`, `.venv`, …) are handled separately
  * by a `startsWith('.')` segment check so we don't have to enumerate every one.

package/server/dist/config.js

@@ -169,9 +169,6 @@ function parseFrontmatter(content) {
     }
     return result;
 }
-function slugify(name) {
-    return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
-}
 function scanCommands(commandsDir) {
     if (!fs_1.default.existsSync(commandsDir))
         return [];

package/server/dist/core-completion.js

@@ -7,7 +7,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
 const core_node_runtime_1 = require("./core-node-runtime");
-const agent_runtime_loader_1 = require("./agent-runtime-loader");
+const agent_runtime_loader_1 = require("./modules/agent-runtime/runtime/agent-runtime-loader");
 const obj = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
 const strings = (value) => Array.isArray(value) && value.every(item => typeof item === 'string');
 const count = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;

package/server/dist/core-execution.js

@@ -8,7 +8,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const core_node_runtime_1 = require("./core-node-runtime");
 const core_update_state_1 = require("./core-update-state");
-const agent_runtime_loader_1 = require("./agent-runtime-loader");
+const agent_runtime_loader_1 = require("./modules/agent-runtime/runtime/agent-runtime-loader");
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 // Resolve existing ancestors too: the tickets file may not exist yet, and macOS
 // exposes temporary directories through both /var and /private/var.

package/server/dist/db/activity.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProjectActivity = getProjectActivity;
+function getProjectActivity(db, opts) {
+    const limit = Math.min(opts.limit, 100);
+    const conditions = [];
+    const params = [];
+    if (opts.before) {
+        conditions.push('started_at < ?');
+        params.push(opts.before);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    const jobs = db
+        .prepare(`SELECT * FROM jobs ${where} ORDER BY started_at DESC LIMIT ?`)
+        .all(...params, limit);
+    return jobs.map((j) => {
+        const isTerminal = j.status === 'completed' || j.status === 'failed' || j.status === 'canceled' || j.status === 'zombie_terminated';
+        const type = j.status === 'completed' ? 'job_completed'
+            : j.status === 'failed' ? 'job_failed'
+                : (j.status === 'canceled' || j.status === 'zombie_terminated') ? 'job_canceled'
+                    : 'job_started';
+        const timestamp = isTerminal && j.finished_at ? j.finished_at : j.started_at;
+        const shortCmd = j.command.length > 60 ? j.command.slice(0, 57) + '...' : j.command;
+        const summary = type === 'job_started' ? `Job started: ${shortCmd}`
+            : type === 'job_completed' ? `Job completed: ${shortCmd}`
+                : type === 'job_failed' ? `Job failed: ${shortCmd}`
+                    : j.status === 'zombie_terminated' ? `Job auto-terminated (zombie): ${shortCmd}`
+                        : `Job canceled: ${shortCmd}`;
+        return {
+            id: j.id,
+            type,
+            jobId: j.id,
+            jobCommand: j.command,
+            timestamp,
+            summary,
+            costUsd: isTerminal ? (j.total_cost_usd ?? null) : null,
+        };
+    });
+}

package/server/dist/db/connection.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initDb = initDb;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const secure_fs_1 = require("../util/secure-fs");
+const migrations_1 = require("./migrations");
+function initDb(dbPath) {
+    if (dbPath !== ':memory:') {
+        const dir = path_1.default.dirname(dbPath);
+        fs_1.default.mkdirSync(dir, { recursive: true });
+        (0, secure_fs_1.secureDir)(dir); // H-13: owner-only data dir
+    }
+    const db = new better_sqlite3_1.default(dbPath);
+    try {
+        db.pragma('journal_mode = WAL');
+        db.pragma('foreign_keys = ON');
+        // Under load, QueueManager / ChatManager / FileSummaryManager write the same
+        // per-project DB concurrently with /analytics reads. Wait up to 5s on a lock
+        // instead of throwing SQLITE_BUSY, and cap the WAL so a long checkpoint can't
+        // grow it without bound.
+        db.pragma('busy_timeout = 5000');
+        db.pragma('journal_size_limit = 10000000'); // ~10 MB
+        (0, migrations_1.applyMigrations)(db);
+        // H-13: restrict the db + its WAL sidecars to 0600 (jobs.sqlite holds chat
+        // transcripts and verbatim terminal command history). After migrations the
+        // WAL/SHM files exist, so this covers them too.
+        (0, secure_fs_1.secureDbFile)(dbPath);
+        // Orphan sweep: cancel any in-flight proposals from a previous server session
+        db.prepare("UPDATE proposals SET status = 'cancelled', updated_at = ? WHERE status IN ('exploring', 'refining')").run(new Date().toISOString());
+    }
+    catch (err) {
+        db.close();
+        throw err;
+    }
+    return db;
+}

package/server/dist/db/conversations.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConversation = createConversation;
+exports.listConversations = listConversations;
+exports.getConversation = getConversation;
+exports.deleteConversation = deleteConversation;
+exports.updateConversation = updateConversation;
+exports.addMessage = addMessage;
+exports.getMessages = getMessages;
+// ─── Chat DB functions ────────────────────────────────────────────────────────
+function createConversation(db, opts) {
+    const scopeJson = opts.contextScope != null ? JSON.stringify(opts.contextScope) : null;
+    db.prepare('INSERT INTO chat_conversations (id, model, kind, context_scope, provider) VALUES (?, ?, ?, ?, ?)').run(opts.id, opts.model, opts.kind ?? 'sidebar', scopeJson, opts.provider ?? null);
+}
+function listConversations(db) {
+    return db.prepare('SELECT * FROM chat_conversations ORDER BY updated_at DESC').all();
+}
+function getConversation(db, id) {
+    return db.prepare('SELECT * FROM chat_conversations WHERE id = ?').get(id);
+}
+function deleteConversation(db, id) {
+    db.prepare('DELETE FROM chat_conversations WHERE id = ?').run(id);
+}
+function updateConversation(db, id, patch) {
+    const sets = ['updated_at = ?'];
+    const params = [new Date().toISOString()];
+    if (patch.title !== undefined) {
+        sets.push('title = ?');
+        params.push(patch.title);
+    }
+    if (patch.session_id !== undefined) {
+        sets.push('session_id = ?');
+        params.push(patch.session_id);
+    }
+    if (patch.model !== undefined) {
+        sets.push('model = ?');
+        params.push(patch.model);
+    }
+    params.push(id);
+    db.prepare(`UPDATE chat_conversations SET ${sets.join(', ')} WHERE id = ?`).run(...params);
+}
+function addMessage(db, msg) {
+    const result = db.prepare('INSERT INTO chat_messages (conversation_id, role, content) VALUES (?, ?, ?)').run(msg.conversation_id, msg.role, msg.content);
+    return db.prepare('SELECT * FROM chat_messages WHERE id = ?').get(Number(result.lastInsertRowid));
+}
+function getMessages(db, conversationId) {
+    return db.prepare('SELECT * FROM chat_messages WHERE conversation_id = ? ORDER BY id ASC').all(conversationId);
+}

package/server/dist/db/jobs.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JobRecoveryPendingError = void 0;
+exports.createJob = createJob;
+exports.upsertQueuedJob = upsertQueuedJob;
+exports.deleteQueuedJob = deleteQueuedJob;
+exports.markJobInteractive = markJobInteractive;
+exports.accumulateInteractiveTurn = accumulateInteractiveTurn;
+exports.finalizeInteractiveJob = finalizeInteractiveJob;
+exports.finishJob = finishJob;
+exports.appendEvent = appendEvent;
+exports.upsertPhase = upsertPhase;
+exports.listJobs = listJobs;
+exports.getJob = getJob;
+exports.getJobEvents = getJobEvents;
+exports.deleteJob = deleteJob;
+exports.purgeJobs = purgeJobs;
+exports.skipJob = skipJob;
+exports.getPipelineJobs = getPipelineJobs;
+function createJob(db, job) {
+    // Promotion is atomic: after a crash the job is either still replayable in
+    // queued_jobs or is a running jobs row, never absent from both. INSERT OR
+    // IGNORE preserves idempotency for legacy/restored jobs that already exist.
+    const promote = db.transaction(() => {
+        db.prepare('INSERT OR IGNORE INTO jobs (id, command, started_at, status, provider, owner, priority, depends_on_job_id, pipeline_id, interactive, causal_ownership) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(job.id, job.command, job.started_at, 'running', job.provider ?? null, job.owner ?? 'queue', job.priority ?? 'normal', job.depends_on_job_id ?? null, job.pipeline_id ?? null, job.interactive ? 1 : 0, job.causal_ownership ? 1 : 0);
+        db.prepare('UPDATE jobs SET status = ?, started_at = ?, provider = ?, owner = ?, interactive = ?, causal_ownership = ? WHERE id = ?').run('running', job.started_at, job.provider ?? null, job.owner ?? 'queue', job.interactive ? 1 : 0, job.causal_ownership ? 1 : 0, job.id);
+        db.prepare('DELETE FROM queued_jobs WHERE id = ?').run(job.id);
+    });
+    promote();
+}
+/** Idempotently persist a job that has been admitted but has not started. */
+function upsertQueuedJob(db, job) {
+    db.prepare(`
+    INSERT INTO queued_jobs (
+      id, command, queue_position, priority, depends_on_job_id, pipeline_id,
+      provider, model, profile_name, profile_selection_set, interactive,
+      causal_ownership
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      command = excluded.command,
+      queue_position = excluded.queue_position,
+      priority = excluded.priority,
+      depends_on_job_id = excluded.depends_on_job_id,
+      pipeline_id = excluded.pipeline_id,
+      provider = excluded.provider,
+      model = excluded.model,
+      profile_name = excluded.profile_name,
+      profile_selection_set = excluded.profile_selection_set,
+      interactive = excluded.interactive,
+      causal_ownership = excluded.causal_ownership
+  `).run(job.id, job.command, job.queue_position, job.priority, job.depends_on_job_id ?? null, job.pipeline_id ?? null, job.provider ?? null, job.model ?? null, job.profile_name ?? null, job.profile_selection_set ? 1 : 0, job.interactive == null ? null : (job.interactive ? 1 : 0), job.causal_ownership ? 1 : 0);
+}
+/** Remove a queued admission after cancellation/skip. Idempotent.
+ *
+ * Migration 43 deliberately keeps a read fallback for pre-migration builds
+ * that represented queued work in `jobs`. Remove that legacy representation
+ * too, but only while it is still queued: promotion changes the status to
+ * running before calling this helper, and terminal history must never be
+ * deleted here. */
+function deleteQueuedJob(db, jobId) {
+    db.prepare('DELETE FROM queued_jobs WHERE id = ?').run(jobId);
+    db.prepare("DELETE FROM jobs WHERE id = ? AND status = 'queued'").run(jobId);
+}
+/**
+ * Flip a job row's `interactive` flag AFTER creation. Used by the loop engine
+ * when an ai-step upgrades the run's backing job to a resident interactive
+ * session — the row was created at run start (before the step's provider
+ * capability/kill-switch gate is consulted), so the flag lands lazily at the
+ * first interactive step spawn. Idempotent.
+ */
+function markJobInteractive(db, jobId) {
+    db.prepare('UPDATE jobs SET interactive = 1 WHERE id = ?').run(jobId);
+}
+/**
+ * Add one completed interactive turn's REAL usage into the job row. Token/cost/
+ * turn columns accumulate (COALESCE so the first turn starts from a clean base);
+ * model + session_id are stamped from the first turn that reports them. The job
+ * stays 'running' — only finalizeInteractiveJob flips the terminal status. This
+ * keeps the live Job Detail totals honest (sum of completed turns, never an
+ * estimate) between turns.
+ */
+function accumulateInteractiveTurn(db, jobId, turn) {
+    db.prepare(`
+    UPDATE jobs SET
+      tokens_in           = COALESCE(tokens_in, 0) + ?,
+      tokens_out          = COALESCE(tokens_out, 0) + ?,
+      tokens_cache_read   = COALESCE(tokens_cache_read, 0) + ?,
+      tokens_cache_create = COALESCE(tokens_cache_create, 0) + ?,
+      total_cost_usd      = COALESCE(total_cost_usd, 0) + ?,
+      num_turns           = COALESCE(num_turns, 0) + ?,
+      total_cost_usd_estimated = CASE WHEN ? = 1 THEN 1 ELSE total_cost_usd_estimated END,
+      model               = COALESCE(model, ?),
+      session_id          = COALESCE(?, session_id)
+    WHERE id = ?
+  `).run(turn.tokens_in, turn.tokens_out, turn.tokens_cache_read, turn.tokens_cache_create, turn.total_cost_usd, turn.num_turns, turn.estimated ? 1 : 0, turn.model ?? null, turn.session_id ?? null, jobId);
+}
+/**
+ * Flip an interactive job to its terminal status (completed on finalize, failed
+ * on crash) and stamp finished_at. Token/cost/turn columns are left untouched —
+ * they were already accumulated turn-by-turn via accumulateInteractiveTurn.
+ */
+function finalizeInteractiveJob(db, jobId, status) {
+    db.prepare('UPDATE jobs SET status = ?, finished_at = ? WHERE id = ?').run(status, new Date().toISOString(), jobId);
+}
+function finishJob(db, jobId, result) {
+    db.prepare(`
+    UPDATE jobs SET
+      status              = ?,
+      exit_code           = ?,
+      finished_at         = ?,
+      tokens_in           = ?,
+      tokens_out          = ?,
+      tokens_cache_read   = ?,
+      tokens_cache_create = ?,
+      total_cost_usd      = ?,
+      total_cost_usd_estimated = ?,
+      num_turns           = ?,
+      model               = ?,
+      duration_ms         = ?,
+      duration_api_ms     = ?,
+      session_id          = ?
+    WHERE id = ?
+  `).run(result.status, result.exit_code, new Date().toISOString(), result.tokens_in ?? null, result.tokens_out ?? null, result.tokens_cache_read ?? null, result.tokens_cache_create ?? null, result.total_cost_usd ?? null, result.total_cost_usd_estimated ? 1 : 0, result.num_turns ?? null, result.model ?? null, result.duration_ms ?? null, result.duration_api_ms ?? null, result.session_id ?? null, jobId);
+}
+function appendEvent(db, jobId, seq, event) {
+    db.prepare('INSERT INTO events (job_id, seq, event_type, source, payload) VALUES (?, ?, ?, ?, ?)').run(jobId, seq, event.event_type, event.source ?? null, event.payload);
+}
+function upsertPhase(db, jobId, phase, state) {
+    db.prepare('INSERT OR REPLACE INTO job_phases (job_id, phase, state, updated_at) VALUES (?, ?, ?, ?)').run(jobId, phase, state, new Date().toISOString());
+}
+function listJobs(db, opts) {
+    const limit = Math.min(opts.limit ?? 50, 200);
+    const offset = opts.offset ?? 0;
+    const conditions = [];
+    const params = [];
+    if (opts.status) {
+        conditions.push('status = ?');
+        params.push(opts.status);
+    }
+    if (opts.from) {
+        conditions.push('started_at >= ?');
+        params.push(opts.from);
+    }
+    if (opts.to) {
+        conditions.push('started_at <= ?');
+        params.push(opts.to);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    const countRow = db
+        .prepare(`SELECT COUNT(*) as count FROM jobs ${where}`)
+        .get(...params);
+    const jobs = db
+        .prepare(`SELECT jobs.*, jp.profile_name AS profile_name
+       FROM jobs LEFT JOIN job_profiles jp ON jp.job_id = jobs.id
+       ${where}
+       ORDER BY started_at DESC LIMIT ? OFFSET ?`)
+        .all(...params, limit, offset);
+    return { jobs, total: countRow.count };
+}
+function getJob(db, jobId) {
+    return db
+        .prepare(`
+      SELECT jobs.*, jp.profile_name AS profile_name
+      FROM jobs
+      LEFT JOIN job_profiles jp ON jp.job_id = jobs.id
+      WHERE jobs.id = ?
+    `)
+        .get(jobId);
+}
+function getJobEvents(db, jobId) {
+    return db
+        .prepare('SELECT * FROM events WHERE job_id = ? ORDER BY seq ASC')
+        .all(jobId);
+}
+class JobRecoveryPendingError extends Error {
+    jobId;
+    constructor(jobId) {
+        super('Job recovery is still pending; retry deletion after recovery completes');
+        this.jobId = jobId;
+        this.name = 'JobRecoveryPendingError';
+    }
+}
+exports.JobRecoveryPendingError = JobRecoveryPendingError;
+function deleteJob(db, jobId) {
+    // M7: jobs.depends_on_job_id REFERENCES jobs(id) with no ON DELETE action and
+    // foreign_keys=ON, so deleting a pipeline parent throws 'FOREIGN KEY
+    // constraint failed' and the job becomes undeletable from the UI. Clear inbound
+    // references first, in the same transaction as the delete, so it always
+    // succeeds (children keep running; they just lose the now-irrelevant pointer).
+    const tx = db.transaction((id) => {
+        const pendingLoopStep = db.prepare(`SELECT 1 FROM loop_step_recovery WHERE run_id = ? LIMIT 1`).get(id);
+        const pendingQueueRecovery = db.prepare(`SELECT 1 FROM orphan_job_recovery WHERE job_id = ? LIMIT 1`).get(id);
+        if (pendingLoopStep || pendingQueueRecovery) {
+            throw new JobRecoveryPendingError(id);
+        }
+        db.prepare('UPDATE jobs SET depends_on_job_id = NULL WHERE depends_on_job_id = ?').run(id);
+        // B41: events/job_phases cascade on the jobs FK, but telemetry_blobs/
+        // telemetry_summaries (keyed `jobId`), job_profiles and file_provenance
+        // (keyed `job_id`) have no FK — without these they accumulate forever. (The
+        // on-disk .ndjson.gz blob is reclaimed by the 7-day startup compactor.)
+        db.prepare('DELETE FROM telemetry_blobs WHERE jobId = ?').run(id);
+        db.prepare('DELETE FROM telemetry_summaries WHERE jobId = ?').run(id);
+        db.prepare('DELETE FROM job_profiles WHERE job_id = ?').run(id);
+        db.prepare('DELETE FROM file_provenance WHERE job_id = ?').run(id);
+        db.prepare('DELETE FROM jobs WHERE id = ?').run(id);
+    });
+    tx(jobId);
+}
+function purgeJobs(db, opts) {
+    const conditions = [
+        "status IN ('completed', 'failed', 'canceled', 'zombie_terminated', 'skipped')",
+        'NOT EXISTS (SELECT 1 FROM loop_step_recovery WHERE loop_step_recovery.run_id = jobs.id)',
+        'NOT EXISTS (SELECT 1 FROM orphan_job_recovery WHERE orphan_job_recovery.job_id = jobs.id)',
+    ];
+    const params = [];
+    if (opts?.from) {
+        conditions.push('started_at >= ?');
+        params.push(opts.from);
+    }
+    if (opts?.to) {
+        conditions.push('started_at <= ?');
+        params.push(opts.to);
+    }
+    const where = conditions.join(' AND ');
+    // M6: run the whole purge atomically. Previously these statements ran without a
+    // transaction, so when the final `DELETE FROM jobs` aborted on the
+    // depends_on_job_id FK (a purged job still referenced by a non-purged one), the
+    // events/phases deletes had already committed — destroying log history while
+    // deleting zero job rows, and a misleading 500. The transaction rolls back on
+    // any failure, and NULL-ing inbound references first makes the delete succeed.
+    const tx = db.transaction(() => {
+        const sel = `SELECT id FROM jobs WHERE ${where}`;
+        db.prepare(`DELETE FROM events WHERE job_id IN (${sel})`).run(...params);
+        db.prepare(`DELETE FROM job_phases WHERE job_id IN (${sel})`).run(...params);
+        // B41: also purge the no-FK orphan tables for the same jobs.
+        db.prepare(`DELETE FROM telemetry_blobs WHERE jobId IN (${sel})`).run(...params);
+        db.prepare(`DELETE FROM telemetry_summaries WHERE jobId IN (${sel})`).run(...params);
+        db.prepare(`DELETE FROM job_profiles WHERE job_id IN (${sel})`).run(...params);
+        db.prepare(`DELETE FROM file_provenance WHERE job_id IN (${sel})`).run(...params);
+        // Clear inbound FK references from NON-purged jobs to purged jobs.
+        db.prepare(`UPDATE jobs SET depends_on_job_id = NULL WHERE depends_on_job_id IN (${sel})`).run(...params);
+        return db.prepare(`DELETE FROM jobs WHERE ${where}`).run(...params).changes;
+    });
+    return tx();
+}
+function skipJob(db, jobId, reason) {
+    db.prepare(`UPDATE jobs SET status = 'skipped', skip_reason = ?, finished_at = ? WHERE id = ?`).run(reason, new Date().toISOString(), jobId);
+}
+function getPipelineJobs(db, pipelineId) {
+    return db.prepare('SELECT * FROM jobs WHERE pipeline_id = ? ORDER BY queue_position ASC, started_at ASC').all(pipelineId);
+}