specrails-desktop 2.59.0 → 2.59.1

package/client/dist/index.html

@@ -204,7 +204,7 @@
         .specrails-splash__mark .pill { opacity: 1; }
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-JSTZVJfe.js"></script>
+    <script type="module" crossorigin src="/assets/index-Czov72g7.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CNC7AqOf.js">
     <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-zu2_FqZY.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-DiWzBDP9.js">
@@ -213,7 +213,7 @@
     <link rel="modulepreload" crossorigin href="/assets/tauri-shell-DE6LfGPw.js">
     <link rel="modulepreload" crossorigin href="/assets/activity-DiyjsgQV.js">
     <link rel="modulepreload" crossorigin href="/assets/addspec-BOvgmcgk.js">
-    <link rel="modulepreload" crossorigin href="/assets/agent-CGSKxfZk.js">
+    <link rel="modulepreload" crossorigin href="/assets/agent-Z5s_GTP0.js">
     <link rel="modulepreload" crossorigin href="/assets/agentRuntime-Bpx3yWHK.js">
     <link rel="modulepreload" crossorigin href="/assets/agents-CTwbx-fb.js">
     <link rel="modulepreload" crossorigin href="/assets/agentstudio-BWAKeGgB.js">
@@ -239,19 +239,19 @@
     <link rel="modulepreload" crossorigin href="/assets/settings-Dbyd6gmj.js">
     <link rel="modulepreload" crossorigin href="/assets/setup-CKGUxKr-.js">
     <link rel="modulepreload" crossorigin href="/assets/specs-DfIdoU5L.js">
-    <link rel="modulepreload" crossorigin href="/assets/subscriptionUsage-zRcRPHkP.js">
+    <link rel="modulepreload" crossorigin href="/assets/subscriptionUsage-CdlE5Mg1.js">
     <link rel="modulepreload" crossorigin href="/assets/terminal-BAzpHtpY.js">
     <link rel="modulepreload" crossorigin href="/assets/tickets-D41ZMQpf.js">
     <link rel="modulepreload" crossorigin href="/assets/createLucideIcon-Bjbbp_KS.js">
-    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-TzKtPRp9.js">
-    <link rel="modulepreload" crossorigin href="/assets/Trans-DExd3Z00.js">
-    <link rel="modulepreload" crossorigin href="/assets/useDesktop-D07TvesS.js">
+    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-C17TGqT8.js">
+    <link rel="modulepreload" crossorigin href="/assets/Trans-CzhPjnjB.js">
+    <link rel="modulepreload" crossorigin href="/assets/useDesktop-DpxVGfUC.js">
     <link rel="modulepreload" crossorigin href="/assets/provider-capabilities-lePfeT_Y.js">
     <link rel="modulepreload" crossorigin href="/assets/save-OsUqVn99.js">
-    <link rel="modulepreload" crossorigin href="/assets/spending-BdcyVkcd.js">
+    <link rel="modulepreload" crossorigin href="/assets/spending-CYotH-9N.js">
     <link rel="modulepreload" crossorigin href="/assets/sparkles-DrY8hb0X.js">
     <link rel="modulepreload" crossorigin href="/assets/x-CBMI9ejn.js">
-    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-D_8L4EWZ.js">
+    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-DKlPf54Y.js">
     <link rel="modulepreload" crossorigin href="/assets/zap-CUOlvtT1.js">
     <link rel="modulepreload" crossorigin href="/assets/file-text-BcLCfcWZ.js">
     <link rel="modulepreload" crossorigin href="/assets/circle-x-CMYsN4ZH.js">
@@ -266,22 +266,22 @@
     <link rel="modulepreload" crossorigin href="/assets/search-Cq_gE3Ik.js">
     <link rel="modulepreload" crossorigin href="/assets/trash-2-BOU3WdZZ.js">
     <link rel="modulepreload" crossorigin href="/assets/triangle-alert-H9T4jAmh.js">
-    <link rel="modulepreload" crossorigin href="/assets/jira-api-DlXaRwA3.js">
+    <link rel="modulepreload" crossorigin href="/assets/jira-api-CbJvbRYx.js">
     <link rel="modulepreload" crossorigin href="/assets/clsx-CjueKrWZ.js">
     <link rel="modulepreload" crossorigin href="/assets/utils-BC4DHlz2.js">
     <link rel="modulepreload" crossorigin href="/assets/dialog-CMgps2MY.js">
     <link rel="modulepreload" crossorigin href="/assets/lib-CGdyxIWg.js">
-    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-NyC7gZJX.js">
-    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-aw7H5ORC.js">
+    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-DxUFGcVq.js">
+    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-DlQaXc7c.js">
     <link rel="modulepreload" crossorigin href="/assets/button-D1xExSTF.js">
-    <link rel="modulepreload" crossorigin href="/assets/project-repositories-DXhb9FP4.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-DKzvIGSZ.js">
-    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-UAeNm7BB.js">
+    <link rel="modulepreload" crossorigin href="/assets/project-repositories-BkBD3rxx.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-BeM-2gIZ.js">
+    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-CkVXuHxU.js">
     <link rel="modulepreload" crossorigin href="/assets/core-B3mKBIh5.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-CbQmW7Qx.js">
-    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-pGLmtAC6.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-CJVpOUpZ.js">
+    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-CfGRbhr9.js">
     <link rel="modulepreload" crossorigin href="/assets/event-Bt7f3wXe.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-CahchzS5.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-Bfunvi6w.css">
   </head>
   <body>
     <div id="specrails-splash" aria-hidden="false" role="status" aria-label="Loading Specrails">

package/docs/internals/api-reference.md

@@ -446,6 +446,7 @@ A non-developer-friendly file tree + Monaco viewer with plain-language AI summar
 | `PUT` | `/:railIndex/name` | Set the rail's display name. Body `{ name }` (string or `null` to clear back to the default label); 400 if longer than 60 characters |
 | `POST` | `/:railIndex/launch` | Launch the rail. Body `{ mode?, loopId?, profileName?, aiEngine?, model?, reasoning_effort?, originConversationId?, originSurface?, interactive? }`. `mode` is `implement` / `freestyle` / `loop` (the removed Batch mode's `batch-implement` / `batch` are accepted as input aliases and normalized to `implement`); a factory `loopId` maps to its canonical rail mode (`factory:batch` resolves to `factory:implement`). `model` and `reasoning_effort` are validated against the effective adapter/model (Kimi effort is K3-only). Kimi + a loop containing a Decider returns a capability error before the first step. Claude alone advertises persistent in-job stdin; `interactive` remains wire-compatible. Returns `202 { jobId, railIndex, mode }`; a missing provider CLI fails before a job starts. |
 | `POST` | `/:railIndex/stop` | Stop the rail's running job (cancels every job the rail registered) |
+| `POST` | `/:railIndex/relaunch` | Relaunch a settled source. Body `{ sourceId: deliveryId or 'run:<runId>', originConversationId?, originSurface? }`. Uses its recorded specs and admitted options, restores empty assignments after preflight and atomically replaces an undelivered failed generation. Returns the same `202` launch response. Reused/removed rails, active/stale sources, missing specs/workflow and delivered work needing recovery return actionable errors. Request-side workflow overrides are ignored. |
 
 ---
 

package/docs/internals/core-runtime-updates.md

@@ -13,13 +13,17 @@ framework is rejected rather than silently replacing an update.
 
 ## Persistence and publication
 
-The release bundle pins Core 6.1.0 in `desktop-release.yml` and
+The release bundle pins Core 6.2.1 in `desktop-release.yml` and
 `scripts/assemble-bundled-core.lock.json`. Core 6 is the Desktop-only engine: it
-publishes integration contract 5.0 (no standalone `update`) and ships only the
+publishes integration contract 5.1 (no standalone `update`) and ships only the
 implement and retry workflows (Batch was folded into implement; Desktop no
 longer requires `batch-implement` but stays compatible with Cores that still ship it). Update both pins together and check compatibility against
 the staged published package; retained runs still use their original runtime.
 
+The paired CI checkout uses the immutable Core 6.2.1 release commit
+`ae52a5ff0ff9dce024008adf16115e7f04d1ef35`. Bundle smoke checks use Node 22.22.3,
+matching Core's minimum supported Node version and the Desktop release runtime.
+
 Desktop updates retain the complete npm installation, including dependencies,
 under `~/.specrails/core/<version>/`. The registry home override applies to this
 directory. Only the managed package corresponding to the active framework is
@@ -61,6 +65,9 @@ rollback restored already updated copies. **Finish updating** retries with the
 retained package and works offline. Successful completion is emitted only after
 all workspace refreshes and the final recovery-state write succeed.
 
+Core 6 registry updates and same-version runtime repairs are offered using the
+same supported-major policy as runtime selection.
+
 ## Version reporting
 
 Global status distinguishes the selected runtime and its source, the active

package/docs/internals/desktop-owned-workflows.md

@@ -54,6 +54,29 @@ real committed full verification and the reviewed/approved candidate before
 publishing the recoverable write set. The final host check certifies the archived
 candidate. Reviewer assertions remain AI evidence and cannot create verification.
 
+Implement checks the host candidate hash after each correction. When verification
+failed and the correction leaves that candidate unchanged, it ends unsuccessfully
+with the corrector's explanation instead of rerunning the same failed checks.
+Corrections after a passing verification may still refresh review evidence without
+source changes. Failed completion reasons are surfaced in Desktop's job error.
+
+The corrector receives the exact verification command, cwd, original exit code,
+failure summary, full-evidence identifier and current candidate's review output
+directly. The recipe explicitly clears review feedback when verification fails
+or its candidate no longer matches, including before the first reviewer visit.
+It reproduces the failure, distinguishes implementation defects from test
+compatibility assumptions and external blockers, and may make a minimal test
+compatibility repair inside the admitted workspace while preserving the tested
+behavior and every required safety guard. An unchanged filename alone cannot
+justify an unrelated-failure diagnosis. Focused checks retain their original exit
+codes; repaired assertions need negative cases. Saved/customized definitions keep
+their frozen prompts; future unedited recipes use these updated defaults.
+
+The paired Core also supplies the official verify skill and real status/apply
+context before a read-only reviewer turn, including custom `assess` roles. Missing
+planning context still blocks invocation; host preparation does not approve the
+candidate or replace the review's inspection and structured findings.
+
 Admission freezes the graph, agents, Core package and repository checks. Resume
 uses this snapshot. Generic forks copy an active change into a separate change,
 carry scope-owned contracts forward, rebind `run.changeId`, and clear verification.

package/docs/internals/mission-rail-cards.md

@@ -34,6 +34,20 @@ Mission mode (Agent Mode) replaces the routed dashboard, so `RailsBoard`, `Specs
 
 ## Protocol contract
 
+Relaunch identifies the card's delivery or shared run with
+`POST /rails/:railIndex/relaunch { sourceId, originConversationId?, originSurface? }`.
+It uses the source's saved specs and launch options, even after terminal cleanup
+emptied the rail. New attempts freeze these options in migration 71; historical
+ones reconstruct only recorded loop/runtime/manifest fields. A missing workflow
+requires a configured fresh launch. A rail reused for different specs is left
+untouched; stale cards and delivered work that needs recovery are rejected.
+Independent per-ticket siblings do not invalidate each other; newer overlapping
+spec ownership does. A successful unit reporting no changes is not delivered work.
+Undelivered failed generations are atomically superseded in fresh worktrees,
+with allocation rollback and the original failed checkout retained. A synchronous
+click guard prevents duplicate submissions; accepted relaunches stay disabled
+until the new card appears, and rejected admission details remain inline.
+
 ```rail-launch
 {
   "version": 1,
@@ -85,6 +99,7 @@ WS messages: `agent_pr_decision` (existing, now carries the new fields), `agent_
 
 - `client/src/features/missions/components/AgentMessage.tsx` — extraction step after spec-draft (flag `FEATURE_MISSION_RAIL_CARDS`); renders `AgentRailLaunchCard` per proposal, `AgentRailLaunchPending`, `AgentRailLaunchUnreadable`.
 - `AgentRailLaunchCard.tsx` — live reconciliation (`/rails` availability, `/tickets`, `/profiles`, `useProviderDetection`, model/effort catalogs, loops), New rail, Play flow (`POST /rails` → `PUT /tickets` → `POST /launch` with `originConversationId` + `originSurface:'agent-chat'` → `notifyGitChanged` → intent PATCH), inline 400/409, launched/dismissed stubs, `FOCUS_PR_CARD_EVENT`.
+- Repository context (`/repositories`) is required before Play. The card shows launch targets and each spec's saved scope, including primary-only historical specs. **Edit → Save repositories** persists only `repositoryIds` through the pinned project's existing ticket PATCH; Cancel leaves it untouched. Saved scope and spec-list changes reconcile required targets while retaining extra launch targets and dropping workspace entries for removed repositories. Optional launch targets do not edit specs. Omitted required targets and missing/offline/context-only implementation targets block Play visibly. **Refresh** reloads assignments; failed loads expose **Retry loading**. The resolved launch scope and filtered workspace selection are frozen in the launched intent, and server admission remains authoritative.
 - `client/src/features/rails/lib/rail-launch-intents.ts` — session overlay (`recordLocalIntent`, `intentFor`); `useRailLaunchProposals.ts` — undecided proposals for the dock; `AgentPrPinnedDock.tsx` — proposals pinned above PR cards.
 - `AgentPrDecisionCard.tsx` — run phase header (`deriveMissionRunStatus`, live `useRuntimeRuns` first), run-only rendering for `hasDelivery === false`, `RunFailureBlock`, Resume / Approve / Recover / Relaunch, focus-bus scroll + flash.
 - `agent-pr-pinning.ts` `isPrEnvelopePinned`; `agent-run-failure.ts` (`parseRunFailureRow`, `systemBriefingRunId`, `FOCUS_PR_CARD_EVENT`, `MISSION_OPEN_RUN_EVENT`, `requestMissionOpenRun`); `AgentRunFailureMarker.tsx`.

package/docs/internals/operations-runbook.md

@@ -217,6 +217,12 @@ thresholds and publish separate reports. Native macOS, Windows Core assembly and
 runtime portability jobs remain required. The final `test` job preserves the check
 name used by branch protection and rejects any failed, skipped or cancelled lane.
 
+The paired Core lane uses an immutable commit in `.github/workflows/ci.yml`.
+When Desktop tests require new Core behavior, push that Core commit first and
+update the pin in the same Desktop change. Validate the real bridge suites with
+`SPECRAILS_CORE_SOURCE_DIR` selecting the built Core checkout; a missing checkout
+skips these optional local tests and does not prove paired compatibility.
+
 Push CI still runs on every branch: native release validation requires a trusted
 push run for the exact branch and commit. PR and merge-queue runs remain enabled.
 Concurrency cancels superseded runs within the same event/ref. No path filters

package/docs/internals/safe-pr-review-flow.md

@@ -113,7 +113,12 @@ Both temporary checkouts use non-force cleanup, including after a Git runner exc
 ## Launch and recovery wiring (`server/modules/delivery/runtime/rail-isolated-launch.ts`)
 
 - `prMode` is captured once. Admission is rechecked inside the per-repository allocation lock;
-  two requests cannot both create a generation or reuse the ticket-keyed worktree.
+  two requests cannot both create a generation or claim the same continuation branch.
+- Fresh launches allocate `<worktreesRoot>/<runId>/ticket-<id>` and a new collision-free
+  branch from the selected base. Failed attempts retain their dirty mounts and branches
+  for explicit recovery; pressing Launch never silently adopts their edits. Same-run
+  recovery uses the frozen mount. Recorded delivery/PR continuations find the exact
+  mounted branch and verify its recorded commit before execution.
 - A continuation supersedes its prior generation and creates the new `building` row in one DB
   transaction. Allocation failure closes the new row and restores the prior generation atomically,
   recording the failed replacement id so every client can safely undo its tombstone for that pair.
@@ -121,6 +126,16 @@ Both temporary checkouts use non-force cleanup, including after a Git runner exc
   verification distinguish changed, resumed, and no-change results.
 - Per-unit settlement returns structured execution + delivery results. `onLoopRunFinished` receives
   the engine outcome only; commit/status/ref/provenance/push failures cannot rewrite it.
+- Before staging, settlement blocks active OpenSpec change directories introduced relative to
+  the frozen integration/base commit, including the run's own unarchived change. Base changes
+  and archives are allowed. It reports the paths as a blocked `commit_failed` delivery and
+  preserves the checkout; Core never archives unrelated changes on Desktop's behalf.
+- Revision semantics require actual delivered branch/commit evidence. Open addenda on an
+  undelivered failed generation replace it atomically with a fresh full-spec launch, without
+  a revision briefing or branch adoption. Equivalent delta retries use readable, stable,
+  Core-compatible names derived from durable lineage/addendum bodies rather than run IDs.
+  All frozen addenda must be claimed before any agent starts; claim failure reopens earlier
+  sibling claims and rolls allocation back through the existing ownership-aware path.
 - Clean, committed worktrees may be released only after a final live preflight proves tracked and
   untracked status (apart from durably recorded Specrails overlay paths), plus exact worktree HEAD
   and branch ref. Gitignored paths are release-safe only when covered by the IMMUTABLE settlement
@@ -219,9 +234,12 @@ at launch:
   from the first root containing them when checkout lacks them. Windows: junction →
   dereferencing-copy fallback.
 - **Never on the PR**: the resume-safe manifest records authenticated overlay leaves against
-  any configured root; settlement persists immutable fingerprints. Commit delivery deliberately
+  any configured root across supported provider namespaces, so switching provider retains
+  prior authenticated exclusions; settlement persists immutable fingerprints. Commit delivery deliberately
   runs plain `git add -A`, audits the index, resets forbidden literal top-level paths, re-audits,
-  and makes those exclusions authoritative with `git commit --only`. The writable manifest alone
+  and makes those exclusions authoritative with `git commit --only`. Unexcluded staged symlinks
+  with absolute destinations outside the checkout block commit rather than leaking machine paths.
+  The writable manifest alone
   never grants cleanup authority. Cleanup atomically renames each authenticated root into a unique
   sibling quarantine, revalidates it after the move, discloses raced content there, and never
   deletes or restores quarantined paths automatically over a possibly recreated source. A modified
@@ -371,9 +389,10 @@ diff collection), fully unit-tested.
   nothing (`<type>/<ref>`). Every generated name passes `isValidBranchName`.
 - **Batch branch** (N>1 assembled delivery) — `<type>/<primary-ref>-batch-<n>-tickets`.
 - **Collisions** — bounded suffixing `-2`, `-3`… (20 attempts). At worktree allocation
-  (`rail-isolated-launch`) a branch that a PRIOR rail run allocated for the SAME ticket (per the
-  `rail_worktrees` ledger) is **resumed**, not suffixed — preserving the stop/relaunch resume
-  semantics; exhaustion falls back to the legacy `sr/<slug>/ticket-<id>`. The **integration
+  (`rail-isolated-launch`) a fresh run collision-suffixes even a prior branch for the same ticket;
+  only exact recorded delivery/PR continuations reuse a branch. Same-run recovery retains its
+  frozen checkout. Exhaustion falls back to the legacy `sr/<slug>/ticket-<id>` with fresh-branch
+  validation. The **integration
   branch is never used** (reserved in the resolver + asserted in tests). `createWorktree` stays
   generic: an optional preferred `branch` input with the legacy fallback when absent.
 - **PR title** — `[<ref>]<type> - <change>` (e.g. `[SKILLS-101]feat - darkmode added`); the
@@ -781,4 +800,3 @@ typed, frozen delta that travels with the DELIVERY, never with the spec.
   scope-creep detection, PR head-drift revalidation policy, partial-commit
   recovery UX (the preparation-failure Discard fix above covers the stuck-rail
   half of the incident).
-

package/docs/internals/source-map.md

@@ -5,7 +5,7 @@ architectural dependency declaration. Search a heading or filename and read only
 the relevant source and tests. Feature prefixes group the legacy server files;
 new bounded modules live under `server/modules/`.
 
-Includes 1012 source/build files. Nearby tests are linked where names
+Includes 1014 source/build files. Nearby tests are linked where names
 match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## cli
@@ -717,6 +717,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## client/src/features/subscription-usage/components
 
+- [EnterpriseSpendMeter.tsx](../../client/src/features/subscription-usage/components/EnterpriseSpendMeter.tsx)
 - [SubscriptionUsageFooter.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsageFooter.tsx)
 - [SubscriptionUsagePanel.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsagePanel.tsx)
 - [SubscriptionUsageSection.tsx](../../client/src/features/subscription-usage/components/SubscriptionUsageSection.tsx)
@@ -1219,6 +1220,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [rail-pr-recovery-git.ts](../../server/modules/delivery/runtime/rail-pr-recovery-git.ts) · [test](../../server/modules/delivery/runtime/rail-pr-recovery-git.test.ts)
 - [rail-pr-store.ts](../../server/modules/delivery/runtime/rail-pr-store.ts) · [test](../../server/modules/delivery/runtime/rail-pr-store.test.ts)
 - [rail-pr-ticket-effects.ts](../../server/modules/delivery/runtime/rail-pr-ticket-effects.ts) · [test](../../server/modules/delivery/runtime/rail-pr-ticket-effects.test.ts)
+- [rail-relaunch.ts](../../server/modules/delivery/runtime/rail-relaunch.ts) · [test](../../server/modules/delivery/runtime/rail-relaunch.test.ts)
 - [rail-worktree-release.ts](../../server/modules/delivery/runtime/rail-worktree-release.ts) · [test](../../server/modules/delivery/runtime/rail-worktree-release.test.ts)
 - [rail-worktrees-store.ts](../../server/modules/delivery/runtime/rail-worktrees-store.ts) · [test](../../server/modules/delivery/runtime/rail-worktrees-store.test.ts)
 - [rails-router.ts](../../server/modules/delivery/runtime/rails-router.ts) · [test](../../server/modules/delivery/runtime/rails-router.test.ts)

package/docs/internals/visual-design-audit.md

@@ -16,6 +16,11 @@ The canon below is the **majority-existing code**, promoted to law. Reference im
 - **Priority canon** (the ProposeSpecModal set — the only fully tokenized one): critical=`destructive`, high=`accent-warning`, medium=`accent-info`, low=`muted`.
 - **Left sidebar title = accent-primary, right sidebars = accent-secondary** (existing rule; document, keep).
 
+The left sidebar footer groups desktop tools behind a Settings gear and right
+chevron disclosure, closed initially. Expanded tools appear vertically in this
+order: Companion (when available), Analytics, Docs. The Settings icon and label
+open the app settings modal; a separate chevron button toggles the group.
+
 ## 1.2 Icon scale (lucide, `w-N h-N` pair idiom — never `size={}` props)
 | Context | Size | Margin |
 |---|---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.59.0",
+  "version": "2.59.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/core-update-manager.js

@@ -73,7 +73,7 @@ class CoreUpdateManager {
             this.latestVersion != null &&
                 currentVersion != null &&
                 ((0, semver_lite_1.isNewer)(this.latestVersion, currentVersion) || selected.error !== null && this.latestVersion === currentVersion) &&
-                Number(this.latestVersion.split('.')[0]) <= 5;
+                (0, core_package_1.isSupportedCoreVersion)(this.latestVersion);
         return {
             available: this.isAvailable(),
             currentVersion,

package/server/dist/db/migrations.js

@@ -1608,6 +1608,15 @@ const MIGRATIONS = [
     (db) => {
         db.exec(`UPDATE rails SET mode='implement' WHERE mode IN ('batch-implement','batch')`);
     },
+    // Migration 71: source-bound rail relaunch. NULL preserves historical rows;
+    // new attempts freeze their admitted launch options before agent execution.
+    (db) => {
+        for (const table of ['rail_pr_deliveries', 'loop_runs']) {
+            const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+            if (!columns.some(column => column.name === 'launch_config_json'))
+                db.exec(`ALTER TABLE ${table} ADD COLUMN launch_config_json TEXT`);
+        }
+    },
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need

package/server/dist/modules/agent-runtime/runtime/agent-runtime-bridge.js

@@ -7,6 +7,7 @@ exports.readFrozenRuntimeHost = readFrozenRuntimeHost;
 exports.runAgentRuntimeInvocation = runAgentRuntimeInvocation;
 exports.assertRetainedForkSupport = assertRetainedForkSupport;
 exports.runAgentRuntimeControl = runAgentRuntimeControl;
+const agent_runtime_verification_suggestions_1 = require("./agent-runtime-verification-suggestions");
 const agent_runtime_history_1 = require("./agent-runtime-history");
 const agent_runtime_repositories_1 = require("./agent-runtime-repositories");
 const node_util_1 = require("node:util");
@@ -67,6 +68,91 @@ function scopedHostChecks(checks, repositories = []) {
         return [{ ...check, cwd }];
     });
 }
+/** Discover only checks belonging to the admitted worktrees. Explicit host
+ * checks win; inferred commands are frozen per run, never saved to project settings. */
+function completeHostChecks(config, repositories) {
+    for (const repository of repositories) {
+        if (config.verification.some(check => check.repositoryId === repository.id) || !repository.path)
+            continue;
+        const workspacePaths = (repository.scope?.length ? repository.scope.map(scope => (0, node_path_1.resolve)(repository.path, scope)) : [repository.path]).filter(workspace => (0, node_fs_1.existsSync)(workspace));
+        const root = (0, node_fs_1.realpathSync)(repository.path);
+        for (const workspace of workspacePaths) {
+            const inside = (0, node_path_1.relative)(root, (0, node_fs_1.realpathSync)(workspace));
+            if ((0, node_path_1.isAbsolute)(inside) || inside === '..' || inside.startsWith('..' + node_path_1.sep))
+                throw new Error('Verification workspace escapes its admitted repository');
+        }
+        const suggestions = (0, agent_runtime_verification_suggestions_1.suggestVerificationCommands)([{ id: repository.id, path: repository.path, workspacePaths }]);
+        config.verification.push(...suggestions.map(({ reason: _reason, ...check }) => check));
+    }
+}
+/** Configured-only gates cannot obtain missing checks from an agent later. */
+function requiresConfiguredChecks(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const body = value;
+    return Object.values(body.nodes ?? {}).some(node => node.kind === 'verify' && node.params?.commands === 'configured' && !node.params.additionalCommandsFrom && node.params.unverified !== true)
+        || Object.values(body.components ?? {}).some(requiresConfiguredChecks);
+}
+/** Keep TAP failure diagnostics and totals in the readable log. The unfiltered
+ * event stream remains available as runtime evidence. State is invocation-local. */
+function verificationLogFilter() {
+    const streams = new Map();
+    return text => (0, node_util_1.stripVTControlCharacters)(text).split(/(?<=\n)/).flatMap(line => {
+        const match = line.match(/^(\[verification [^\]]+\] )?(.*?)(?:\n)?$/);
+        if (!match)
+            return [line];
+        const key = match[1] ?? '', body = match[2].trim();
+        const state = streams.get(key) ?? { tap: false, failed: false, yaml: false, inputLines: null };
+        streams.set(key, state);
+        if (/AssertionError\b.*\bInput:\s*$/.test(body))
+            state.inputLines = 0;
+        else if (state.inputLines !== null) {
+            // Node prints assert.match's entire source input as quoted concatenation
+            // lines. Bound only that block; stacks, expected values and other streams
+            // remain visible and original events remain intact.
+            if (/^["'`]/.test(body)) {
+                state.inputLines++;
+                if (state.inputLines > 2)
+                    return state.inputLines === 3 ? [key + '[Assertion input shortened; inspect raw evidence]\n'] : [];
+            }
+            else if (!body)
+                return [];
+            else
+                state.inputLines = null;
+        }
+        if (/^[✔✓]\s/.test(body))
+            return [];
+        if (/^[✖✗]\s/.test(body)) {
+            state.failed = true;
+            return [line];
+        }
+        if (/^TAP version |^# Subtest:/.test(body)) {
+            state.tap = true;
+            return [];
+        }
+        if (/^(?:not )?ok \d+\b/.test(body)) {
+            state.tap = true;
+            state.failed = body.startsWith('not ok');
+            state.yaml = false;
+            return state.failed ? [line] : [];
+        }
+        if (!state.tap)
+            return [line];
+        if (body === '---') {
+            state.yaml = true;
+            return state.failed ? [line] : [];
+        }
+        if (body === '...') {
+            state.yaml = false;
+            return state.failed ? [line] : [];
+        }
+        if (state.yaml)
+            return state.failed ? [line] : [];
+        if (/^1\.\.\d+$/.test(body) || !body)
+            return [];
+        return [line];
+    }).map(line => line.length > 2_000 ? line.slice(0, 1_900) + '\n[Long diagnostic line shortened; inspect raw evidence]\n' : line).join('');
+}
 exports.RUNTIME_HOST_ENV_KEYS = [
     'SPECRAILS_REPO_DIR', 'SPECRAILS_GIT_AUTO', 'SPECRAILS_REPO_MAP_PATH',
     'SPECRAILS_EXECUTION_CONTEXT', 'SPECRAILS_EXECUTION_MANIFEST', 'SPECRAILS_REPOSITORIES',
@@ -126,6 +212,8 @@ async function runAgentRuntimeInvocation(options) {
             repositoryIds: admittedContext.repositories.map(repo => repo.id), source: options.loopConfig ? 'loop-role' : source, providerOverride: options.loopConfig ? undefined : options.providerOverride,
         });
         config.verification = scopedHostChecks(config.verification, admittedContext.repositories);
+        if (definitionEngine)
+            completeHostChecks(config, admittedContext.repositories);
         if (!options.loopConfig)
             config.rolePrompts = { ...(await (0, agent_runtime_loader_1.loadCoreAgentRuntime)()).rolePromptDefaults(), ...(0, agent_runtime_settings_1.loadRuntimeRolePrompts)(), ...config.rolePrompts };
         // Core rejects unknown connection keys: drop the desktop-only local-engine
@@ -146,6 +234,13 @@ async function runAgentRuntimeInvocation(options) {
             : options.definitionPath ? JSON.parse((0, node_fs_1.readFileSync)(options.definitionPath, 'utf8')) : undefined : undefined;
         if (definitionEngine && !draft)
             throw new Error('A new Core workflow requires a definition');
+        if (requiresConfiguredChecks(draft)) {
+            const missing = admittedContext.repositories.filter(repository => !config.verification.some(check => check.repositoryId === repository.id));
+            if (missing.length)
+                throw new Error(`verification_checks_missing: No configured or detected verification commands for ${missing.map(repository => repository.name ?? repository.id).join(', ')}. Configure checks in project agent-runtime settings before starting this workflow.`);
+            if (config.verification.length > 100)
+                throw new Error('verification_checks_limit: This workflow supports at most 100 verification commands. Reduce the configured checks before starting it.');
+        }
         const selectedOrigins = (0, agent_runtime_effective_config_1.bindWorkflowRoleSelections)(config, draft, options.workflowRoleBindings);
         if (options.loopConfig && draft?.roles?.includes('loop-decider') && !config.roles?.['loop-decider'])
             throw new Error('The loop must define its loop-decider agent');
@@ -241,6 +336,7 @@ async function runAgentRuntimeInvocation(options) {
         let result;
         let graph;
         let stderr = '', summary = '', invalidProtocol = false, timedOut = false;
+        const stepFailures = new Map();
         let timer;
         const child = (0, node_child_process_1.spawn)((0, core_node_runtime_1.resolveCoreNodeRuntime)(), args, {
             cwd: options.cwd, env: (0, win_spawn_1.windowsSpawnEnv)(options.env), shell: false, windowsHide: true,
@@ -260,6 +356,7 @@ async function runAgentRuntimeInvocation(options) {
             callback?.();
         }
         catch { /* Logging cannot replay a workflow. */ } };
+        const readableVerification = verificationLogFilter();
         const lines = (0, node_readline_1.createInterface)({ input: child.stdout });
         lines.on('line', line => {
             if (line.length > 2_000_000) {
@@ -310,8 +407,17 @@ async function runAgentRuntimeInvocation(options) {
             }
             else if (event.type === 'workflow-event') {
                 const payload = event.event;
-                if (payload?.type)
-                    observe(() => options.onLine?.(`[runtime] ${payload.type}${payload.stepId ? ': ' + payload.stepId : ''}${payload.message ? ' — ' + payload.message : ''}\n`));
+                const kind = payload?.type === 'step_succeeded' && payload.outcome === 'fail' ? 'verification_failed' : payload?.type;
+                const detail = payload?.error?.message ?? payload?.message;
+                const stepKey = JSON.stringify([payload?.scopeId ?? null, payload?.nodePath ?? payload?.stepId ?? null]);
+                if (payload?.type === 'step_failed' && typeof detail === 'string' && detail.trim()) {
+                    stepFailures.delete(stepKey);
+                    stepFailures.set(stepKey, detail.trim().slice(0, 4_000));
+                }
+                else if (payload?.type === 'step_succeeded')
+                    stepFailures.delete(stepKey);
+                if (kind)
+                    observe(() => options.onLine?.(`[runtime] ${kind}${payload.stepId ? ': ' + payload.stepId : ''}${detail ? ' — ' + detail : ''}\n`));
             }
             else if (event.type === 'agent-event') {
                 const payload = event.event;
@@ -328,7 +434,9 @@ async function runAgentRuntimeInvocation(options) {
                 }
             }
             else if (event.type === 'verification-output' && typeof event.text === 'string') {
-                observe(() => options.onLine?.((0, node_util_1.stripVTControlCharacters)(String(event.text))));
+                const readable = readableVerification(String(event.text));
+                if (readable)
+                    observe(() => options.onLine?.(readable));
             }
             else if (event.type === 'span') {
                 // Trace spans are telemetry; the raw line is already recorded for diagnostics.
@@ -364,6 +472,7 @@ async function runAgentRuntimeInvocation(options) {
             const validPause = definitionEngine && code === 2 && result?.status === 'paused';
             const failed = (!validPause && (code !== 0 || result?.status !== 'succeeded')) || invalidProtocol || timedOut || Boolean(observerError) || Boolean(acceptanceBlocked);
             const runtimeError = typeof result?.error === 'string' ? result.error : result?.error?.message;
+            const completionError = Array.isArray(result?.completion?.reasons) ? result.completion.reasons.filter(reason => typeof reason === 'string' && reason.trim()).join('; ').slice(0, 4_000) : '';
             const runtimeStatus = invalidProtocol || timedOut || observerError || (result?.status === 'paused' && !validPause) || (result?.status === 'succeeded' && code !== 0) ? 'failed' : acceptanceBlocked ? 'blocked' : ['succeeded', 'paused', 'failed', 'blocked', 'cancelled'].includes(result?.status ?? '') ? result.status : 'failed';
             const errorText = observerError ?? (timedOut ? 'Programmatic workflow timed out; inspect its checkpoint before recovery'
                 : invalidProtocol ? 'Core returned an invalid runtime event stream'
@@ -371,9 +480,9 @@ async function runAgentRuntimeInvocation(options) {
                         : runtimeError ?? (result?.status === 'paused' ? (typeof result.pendingQuestion?.question === 'string' && result.pendingQuestion.question.trim()
                             ? `Workflow awaits an answer in Agent Runtime settings: ${result.pendingQuestion.question.trim().slice(0, 500)}`
                             : 'Workflow awaits approval in Agent Runtime settings')
-                            : failed ? stderr || 'Core exited without a successful programmatic workflow result' : undefined));
+                            : failed ? completionError || [...stepFailures.values()].at(-1) || stderr || 'Core exited without a successful programmatic workflow result' : undefined));
             try {
-                (0, agent_runtime_history_1.writeRuntimeHistory)(options.contextPath, invalidProtocol || timedOut || observerError || !result ? { status: 'failed', error: errorText } : { ...result });
+                (0, agent_runtime_history_1.writeRuntimeHistory)(options.contextPath, invalidProtocol || timedOut || observerError || !result ? { status: 'failed', error: errorText } : { ...result, ...(failed && errorText ? { error: errorText } : {}) });
             }
             catch { /* Projection failure cannot replay a completed execution. */ }
             resolve({

package/server/dist/modules/delivery/runtime/multi-repo-execution.js

@@ -231,7 +231,7 @@ async function launchMultiRepositoryRail(input, io = {}) {
             integrationBranches.set(repo.id, target.branch);
         }
     }
-    const previousParentId = input.revision?.ofDeliveryId ?? input.repositoryContinuation?.deliveryId;
+    const previousParentId = input.revision?.ofDeliveryId ?? input.repositoryContinuation?.deliveryId ?? input.retryOfDelivery?.deliveryId;
     const previousParent = previousParentId ? (0, rail_pr_store_1.getPrDelivery)(ctx.db, previousParentId) : undefined;
     const previousManifest = (0, multi_repo_execution_store_1.readExecutionManifest)(previousParent?.execution_manifest);
     const previousChildren = previousParentId ? listRepositoryDeliveries(ctx.db, previousParentId) : [];
@@ -268,12 +268,13 @@ async function launchMultiRepositoryRail(input, io = {}) {
         artifactRepositoryId, selectedRepositoryIds: selected.map((repo) => repo.id), repositories: [],
     };
     const generation = (0, rail_pr_store_1.createPrDeliveryGeneration)(ctx.db, {
+        launchConfig: input.launchConfig,
         id: parentId, railIndex: input.railIndex, loopId: input.loopId, railKey: `${input.railIndex}-${input.loopId}`,
         ticketIds: input.ticketIds, baseBranch: input.baseBranch ?? '', loopName: input.loopName,
         originSurface: input.originSurface ?? 'dashboard', originConversationId: input.originConversationId,
         specSnapshot: (0, rail_isolated_launch_1.buildSpecSnapshot)(ctx, input.ticketIds),
         ...(input.revision ? { revisionNote: input.revision.note, revisionOf: input.revision.ofDeliveryId } : {}),
-    }, input.revision ? { id: input.revision.ofDeliveryId, decision: input.revision.decision } : input.repositoryContinuation ? { id: input.repositoryContinuation.deliveryId, decision: input.repositoryContinuation.decision } : null);
+    }, input.revision ? { id: input.revision.ofDeliveryId, decision: input.revision.decision } : input.repositoryContinuation ? { id: input.repositoryContinuation.deliveryId, decision: input.repositoryContinuation.decision } : input.retryOfDelivery ? { id: input.retryOfDelivery.deliveryId, decision: input.retryOfDelivery.decision } : null);
     for (const child of previousChildren) {
         if (!['merged', 'completed', 'discarded', 'superseded'].includes(child.decision))
             (0, rail_pr_store_1.transitionDecision)(ctx.db, child.id, child.decision, 'superseded');
@@ -315,14 +316,14 @@ async function launchMultiRepositoryRail(input, io = {}) {
             const childSettlement = deferred();
             const previous = previousChildren.find((row) => row.repository_id === repository.id);
             const previousRepository = previousManifest?.repositories.find((row) => row.repositoryId === repository.id);
-            const previousBaseBranch = previous && ['merged', 'completed'].includes(previous.decision)
+            const previousBaseBranch = input.retryOfDelivery ? undefined : previous && ['merged', 'completed'].includes(previous.decision)
                 ? previousRepository?.integrationBranch ?? previous.base_branch
                 : previous?.base_branch;
             const oldSnapshot = previous ? (0, rail_pr_store_1.toPrDeliverySnapshot)(previous) : null;
             const revisionBranches = new Map();
-            if (oldSnapshot && !['merged', 'completed', 'discarded'].includes(oldSnapshot.decision) && !previous?.pr_url) {
+            if (!input.retryOfDelivery && oldSnapshot && !['merged', 'completed', 'discarded'].includes(oldSnapshot.decision) && !previous?.pr_url) {
                 for (const unit of oldSnapshot.branches) {
-                    if (unit.finalSha)
+                    if (unit.succeeded && unit.finalSha && unit.implementationOutcome !== 'failed' && unit.deliveryOutcome !== 'blocked')
                         revisionBranches.set(unit.ticketId, { branch: unit.branch, sha: unit.finalSha });
                 }
             }
@@ -355,6 +356,7 @@ async function launchMultiRepositoryRail(input, io = {}) {
                 ...input, ctx: childCtx, scope: effectiveScope, loopGraph: graph,
                 runtimeStateProject: ctx.project,
                 revision: input.revision && previous ? { ...input.revision, ofDeliveryId: previous.id, decision: previous.decision } : undefined,
+                retryOfDelivery: input.retryOfDelivery && previous ? { deliveryId: previous.id, decision: previous.decision } : undefined,
                 requiredPrContinuation: continuation,
                 explicitPrTarget: continuation?.prNumber ? { prNumber: continuation.prNumber } : input.explicitPrTarget,
                 originConversationId: undefined,