specrails-desktop 2.59.2 → 2.60.0

package/server/dist/path-resolver.js

@@ -12,6 +12,7 @@ exports.parseLoginShellOutput = parseLoginShellOutput;
 exports.augmentPathFromLoginShell = augmentPathFromLoginShell;
 exports.parseLoginShellEnv = parseLoginShellEnv;
 exports.augmentEnvFromLoginShell = augmentEnvFromLoginShell;
+exports.readEnvFromLoginShellSync = readEnvFromLoginShellSync;
 exports.augmentEnvFromLoginShellSync = augmentEnvFromLoginShellSync;
 exports.augmentAuthEnvFromLoginShell = augmentAuthEnvFromLoginShell;
 exports.getPathDiagnostic = getPathDiagnostic;
@@ -372,6 +373,17 @@ function parseLoginShellOutput(stdout) {
         return null;
     return stdout.slice(start, end);
 }
+/** GUI launches may omit SHELL even when the account uses zsh/bash. */
+function resolveLoginShell(env = process.env) {
+    if (env.SHELL)
+        return env.SHELL;
+    try {
+        return os_1.default.userInfo().shell || '/bin/sh';
+    }
+    catch {
+        return '/bin/sh';
+    }
+}
 /**
  * Spawn the user's login shell once and merge any additional PATH segments
  * it exposes (Volta/nvm/fnm/asdf shims) into `process.env.PATH`. Async,
@@ -398,7 +410,7 @@ async function augmentPathFromLoginShell(opts = {}) {
     }
     const spawnFn = opts.spawnFn ?? child_process_1.spawn;
     const timeoutMs = opts.timeoutMs ?? LOGIN_SHELL_TIMEOUT_MS;
-    const shell = process.env.SHELL || '/bin/sh';
+    const shell = resolveLoginShell();
     const command = `printf "${PATH_BEGIN}%s${PATH_END}" "$PATH"`;
     const status = await new Promise((resolve) => {
         let child;
@@ -474,7 +486,6 @@ exports.AUTH_ENV_VARS = [
     'GOOGLE_APPLICATION_CREDENTIALS',
 ];
 const LOGIN_SHELL_ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const loginShellEnvProbeCache = new Set();
 function normalizeLoginShellEnvNames(names) {
     const out = [];
     for (const raw of names) {
@@ -528,7 +539,7 @@ async function augmentEnvFromLoginShell(names, opts = {}) {
         return;
     const spawnFn = opts.spawnFn ?? child_process_1.spawn;
     const timeoutMs = opts.timeoutMs ?? LOGIN_SHELL_TIMEOUT_MS;
-    const shell = process.env.SHELL || '/bin/sh';
+    const shell = resolveLoginShell();
     const command = buildLoginShellEnvCommand(wanted);
     await new Promise((resolve) => {
         let child;
@@ -569,42 +580,53 @@ async function augmentEnvFromLoginShell(names, opts = {}) {
         });
     });
 }
-/** Synchronous, cached variant for spawn-time env assembly. It probes each
- * missing name at most once per process to keep loops from paying the login
- * shell timeout on every step. */
-function augmentEnvFromLoginShellSync(names, opts = {}) {
+/** Read missing configured names without mutating the caller's or global env.
+ * Callers own any cache so project credentials cannot leak across scopes. */
+function readEnvFromLoginShellSync(names, opts = {}) {
     if (process.platform === 'win32')
-        return;
+        return {};
     if (process.env.NODE_ENV === 'test' || process.env.VITEST === 'true')
-        return;
-    const wanted = normalizeLoginShellEnvNames(names).filter((name) => !process.env[name] && !loginShellEnvProbeCache.has(name));
+        return {};
+    const env = opts.env ?? process.env;
+    const wanted = normalizeLoginShellEnvNames(names).filter((name) => !env[name]);
     if (wanted.length === 0)
-        return;
-    for (const name of wanted)
-        loginShellEnvProbeCache.add(name);
+        return {};
     const spawnSyncFn = opts.spawnSyncFn ?? child_process_1.spawnSync;
     const timeoutMs = opts.timeoutMs ?? LOGIN_SHELL_TIMEOUT_MS;
-    const shell = process.env.SHELL || '/bin/sh';
+    const shell = resolveLoginShell(env);
     const command = buildLoginShellEnvCommand(wanted);
     let res;
     try {
         res = spawnSyncFn(shell, ['-l', '-i', '-c', command], {
+            env,
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
+            maxBuffer: 1024 * 1024,
         });
     }
     catch {
-        return;
+        return {};
     }
-    if (res.error)
-        return;
+    if (res.error || res.status !== 0)
+        return {};
     const stdout = typeof res.stdout === 'string' ? res.stdout : res.stdout?.toString('utf8') ?? '';
     const recovered = parseLoginShellEnv(stdout);
+    const out = {};
     for (const key of wanted) {
         const val = recovered[key];
-        if (val && !process.env[key])
-            process.env[key] = val;
+        if (val)
+            out[key] = val;
+    }
+    return out;
+}
+/** Compatibility backfill for callers that intentionally augment process.env.
+ * Failed probes remain retryable; successful names are already present. */
+function augmentEnvFromLoginShellSync(names, opts = {}) {
+    const recovered = readEnvFromLoginShellSync(names, opts);
+    for (const [key, value] of Object.entries(recovered)) {
+        if (value && !process.env[key])
+            process.env[key] = value;
     }
 }
 /** Startup backfill for the built-in provider auth variables. */
@@ -647,5 +669,4 @@ function __resetPathResolverForTest() {
     diagnostic = { pathSegments: [], pathSources: [], loginShellStatus: 'skipped' };
     warnedLoginShell = false;
     bundledRuntimesActive = false;
-    loginShellEnvProbeCache.clear();
 }

package/server/dist/project-env.js

@@ -4,21 +4,37 @@ exports.resolveWorktreeEnvPassthrough = resolveWorktreeEnvPassthrough;
 exports.applyWorktreeEnvPassthrough = applyWorktreeEnvPassthrough;
 const db_1 = require("./db");
 const path_resolver_1 = require("./path-resolver");
+// Values stay in the owning project's memory, never process.env or SQLite.
+// Both successful and missing lookups expire so profiles can recover/rotate.
+const LOGIN_SHELL_CACHE_MS = 30_000;
+const shellValues = new WeakMap();
+function recoverProjectEnv(db, names) {
+    const missing = names.filter(name => !process.env[name]);
+    if (!missing.length) {
+        shellValues.delete(db);
+        return {};
+    }
+    const identity = JSON.stringify([names, missing, process.env.SHELL, process.env.HOME, process.env.ZDOTDIR]);
+    const cached = shellValues.get(db);
+    if (cached?.identity === identity && Date.now() < cached.expiresAt)
+        return cached.env;
+    const env = (0, path_resolver_1.readEnvFromLoginShellSync)(missing);
+    shellValues.set(db, { identity, expiresAt: Date.now() + LOGIN_SHELL_CACHE_MS, env });
+    return env;
+}
 /** Resolve the per-project env passthrough overlay for a spawn.
  *
  * The project setting stores names only. Values are read from `sourceEnv` at
  * spawn time so credentials can rotate without touching SQLite. When the
- * source is `process.env`, missing configured names get one bounded login-shell
- * recovery attempt first; unresolved names are still ignored instead of
- * blocking the run.
+ * source is `process.env`, missing configured names get bounded login-shell
+ * recovery with a short, project-owned cache. Unresolved names remain absent.
  */
 function resolveWorktreeEnvPassthrough(db, sourceEnv = process.env) {
     const out = {};
     const names = (0, db_1.getProjectSettings)(db).worktreeEnvPassthrough;
-    if (sourceEnv === process.env)
-        (0, path_resolver_1.augmentEnvFromLoginShellSync)(names);
+    const recovered = sourceEnv === process.env ? recoverProjectEnv(db, names) : {};
     for (const name of names) {
-        const value = sourceEnv[name];
+        const value = sourceEnv[name] || recovered[name] || sourceEnv[name];
         if (value !== undefined)
             out[name] = value;
     }

package/server/dist/providers/gemini-agent-ack.js

@@ -1,18 +1,20 @@
 "use strict";
-// Gemini headless subagent pre-acknowledgment.
+// Gemini headless subagent pre-acknowledgment (custom agents only).
 //
 // gemini 0.46+ DISCOVERS `<project>/.gemini/agents/*.md` but only ENABLES a
 // project's custom subagents after an interactive "New Agents Discovered →
 // Acknowledge and Enable" prompt. That prompt never fires in headless
 // (`gemini -p`) spawns — which is how the desktop runs every rail — so
-// `invoke_agent sr-architect` returns "Subagent not found" and the implement
-// orchestrator silently falls back to a generic agent (the specialised
-// architect/developer/reviewer personas never run in isolation).
+// `invoke_agent custom-<name>` returns "Subagent not found" and the role that
+// delegates to it silently falls back to inline work. The baseline roles
+// (architect/developer/reviewer) are defined by the specrails-core runtime and
+// are not `.gemini/agents` files, so only the project's `custom-*` agents need
+// this acknowledgment.
 //
 // specrails-core writes the acknowledgment file at install time; this is the
 // defence-in-depth copy the desktop runs right before a gemini rail spawn, so a
-// project installed with an older core (or whose agents changed since install)
-// is still trusted headless. The file gemini reads is
+// project whose custom agents changed since install is still trusted headless.
+// The file gemini reads is
 // `~/.gemini/acknowledgments/agents.json`, shaped
 //   { [projectRoot]: { [agentName]: <sha256-hex of the agent .md file> } }
 // where the hash is sha256 of the FULL agent markdown file (verified empirically
@@ -29,10 +31,11 @@ function ackFilePath() {
     return (0, path_1.join)((0, os_1.homedir)(), '.gemini', 'acknowledgments', 'agents.json');
 }
 /**
- * Pre-acknowledge every `<projectPath>/.gemini/agents/*.md` so gemini loads them
- * in headless mode. No-op when the project has no `.gemini/agents` dir or no
- * agent files. The `projectPath` is the key gemini uses (the spawn cwd / repo
- * root), matching what `specrails-core` writes at install.
+ * Pre-acknowledge every `<projectPath>/.gemini/agents/*.md` (the project's
+ * custom agents) so gemini loads them in headless mode. No-op when the project
+ * has no `.gemini/agents` dir or no agent files. The `projectPath` is the key
+ * gemini uses (the spawn cwd / repo root), matching what `specrails-core`
+ * writes at install.
  */
 function acknowledgeGeminiProjectAgents(projectPath) {
     const agentsDir = (0, path_1.join)(projectPath, '.gemini', 'agents');

package/server/dist/setup-manager.js

@@ -186,7 +186,6 @@ exports.CHECKPOINTS = [
     { key: 'agent_selection', name: 'Agent selection' },
     { key: 'codebase_analysis', name: 'Codebase analysis' },
     { key: 'vpc_discovery', name: 'VPC discovery' },
-    { key: 'agent_generation', name: 'Agent generation' },
     { key: 'persona_synthesis', name: 'Persona synthesis' },
     { key: 'command_generation', name: 'Command generation' },
 ];
@@ -204,10 +203,7 @@ function checkFilesystem(projectPath, provider = 'claude') {
         (0, fs_1.existsSync)((0, path_1.join)(projectPath, '.specrails-version'));
     const hasSetupTemplates = (0, fs_1.existsSync)((0, path_1.join)(projectPath, '.specrails', 'setup-templates')) ||
         (0, fs_1.existsSync)((0, path_1.join)(projectPath, dir, 'setup-templates'));
-    const hasRules = (0, fs_1.existsSync)((0, path_1.join)(projectPath, dir, 'rules')) &&
-        hasFiles((0, path_1.join)(projectPath, dir, 'rules'), /\.md$/);
     const hasPersonas = artifactState.hasPersonas;
-    const hasAgents = artifactState.hasAgents;
     const hasCommands = artifactState.hasCommands;
     const instructionCandidates = [(0, path_1.join)(projectPath, adapter.instructionsFilename)];
     // Older Core releases sometimes placed a top-level instructions filename
@@ -227,22 +223,15 @@ function checkFilesystem(projectPath, provider = 'claude') {
         base_install: hasBaseInstall,
         // Back-compat filesystem signals from older cores are translated to the
         // current integration-contract checkpoint keys.
-        agent_selection: hasInstallConfig || hasAgentConfig || hasBacklogConfig || hasAgents || hasCommands,
+        agent_selection: hasInstallConfig || hasAgentConfig || hasBacklogConfig || hasCommands,
         codebase_analysis: hasBaseInstall && (hasInstructions || hasSetupTemplates),
         vpc_discovery: hasPersonas,
         persona_synthesis: hasPersonas,
-        agent_generation: hasAgents,
-        command_generation: hasCommands || (hasAgents && hasRules),
+        // Role agents are runtime-defined by specrails-core; only the workflow
+        // commands (and provider skills) prove a complete installation.
+        command_generation: hasCommands,
     };
 }
-function hasFiles(dir, pattern) {
-    try {
-        return (0, fs_1.readdirSync)(dir).some((f) => pattern.test(f));
-    }
-    catch {
-        return false;
-    }
-}
 // ─── Enrich.md content resolver (shared by start + resume enrich paths) ─────
 /**
  * Reads the enrich command's body from the project's specrails dir, falling
@@ -286,9 +275,6 @@ function detectCheckpointFromText(text) {
     if (/phase\s*3|configuration|agent\s*selection|backlog\s*provider/i.test(text)) {
         hits.push({ key: 'agent_selection', detail: 'Configuring agents...' });
     }
-    if (/generating\s*all\s*files|writing.*agent|sr-architect|sr-developer|sr-reviewer/i.test(text)) {
-        hits.push({ key: 'agent_generation', detail: 'Generating agents...' });
-    }
     if (/command\s*selection|installing.*commands|\.claude\/commands\/(sr|specrails)/i.test(text)) {
         hits.push({ key: 'command_generation', detail: 'Configuring commands...' });
     }
@@ -301,7 +287,7 @@ function detectCheckpointFromText(text) {
         hits.push({ key: 'config_written' });
     }
     if (/installing\s*specrails|phase\s*2\s*&\s*3|placing\s*agents/i.test(text)) {
-        hits.push({ key: 'agent_generation', detail: 'Installing specrails artefacts...' });
+        hits.push({ key: 'command_generation', detail: 'Installing specrails artefacts...' });
     }
     if (/writing\s*manifest|wrote\s+.*specrails-manifest/i.test(text)) {
         hits.push({ key: 'command_generation' });
@@ -315,16 +301,8 @@ function detectCheckpointFromText(text) {
     if (text.includes('/agents/personas/') && text.includes('.md')) {
         hits.push({ key: 'persona_synthesis', detail: 'Writing personas...' });
     }
-    // Claude path: .claude/agents/sr-<name>.md
-    if (/\/agents\/sr-[^/]+\.md/.test(text)) {
-        hits.push({ key: 'agent_generation', detail: 'Writing agents...' });
-    }
-    // Provider-native rail skills. Kimi's upstream discovery contract scans only
-    // direct children of `.kimi-code/skills`, so its roles are top-level
-    // `.kimi-code/skills/sr-*/SKILL.md` entries. Codex may also use `rails/`.
-    if (/\.(?:codex|kimi-code)\/skills\/(?:rails\/)?sr-[^/]+\/SKILL\.md/.test(text)) {
-        hits.push({ key: 'agent_generation', detail: 'Writing agent skills...' });
-    }
+    // Role agents (`sr-*`) are no longer installed files: Core defines them in
+    // its runtime, so role paths carry no checkpoint signal.
     if ((text.includes('/commands/sr/') || text.includes('/commands/specrails/')) && text.includes('.md')) {
         hits.push({ key: 'command_generation', detail: 'Writing commands...' });
     }
@@ -423,10 +401,11 @@ function computeSummary(projectPath, tier, provider = 'claude') {
         if (provider === 'codex' || provider === 'kimi') {
             // Codex/Kimi layout: every artefact ships as a SKILL under the provider's
             // `skills/` root.
-            // - agents  = rail personas (`skills/rails/sr-*/SKILL.md`) + orchestrator
-            //             skills at the root with an `sr-` prefix. Kimi roles MUST be
-            //             direct children (`skills/sr-*/SKILL.md`) because upstream
-            //             Kimi discovery is intentionally one level deep.
+            // - agents  = custom roles only: codex `skills/rails/custom-*/SKILL.md`,
+            //             kimi direct children `skills/custom-*/SKILL.md` (upstream
+            //             Kimi discovery is intentionally one level deep). Baseline
+            //             `sr-*` roles are runtime-defined and never counted; stale
+            //             `sr-*` skills from older Cores are ignored.
             // - opsxCommands     = `skills/openspec-*/SKILL.md`
             // - specrailsCommands = everything else under `skills/` (ported claude
             //   slash commands like propose-spec, explore-spec, retry, doctor,
@@ -444,7 +423,7 @@ function computeSummary(projectPath, tier, provider = 'claude') {
                             const personasDir = (0, path_1.join)(railsDir, entry);
                             personas = (0, fs_1.readdirSync)(personasDir).filter((persona) => (0, fs_1.existsSync)((0, path_1.join)(personasDir, persona, 'SKILL.md'))).length;
                         }
-                        else if ((0, fs_1.existsSync)((0, path_1.join)(railsDir, entry, 'SKILL.md'))) {
+                        else if (/^custom-/.test(entry) && (0, fs_1.existsSync)((0, path_1.join)(railsDir, entry, 'SKILL.md'))) {
                             agents++;
                         }
                     }
@@ -456,6 +435,8 @@ function computeSummary(projectPath, tier, provider = 'claude') {
                     if (!(0, fs_1.existsSync)((0, path_1.join)(skillsDir, entry, 'SKILL.md')))
                         continue;
                     if (/^sr-/.test(entry))
+                        continue;
+                    else if (/^custom-/.test(entry))
                         agents++;
                     else if (/^openspec-/.test(entry))
                         opsxCommands++;
@@ -473,7 +454,8 @@ function computeSummary(projectPath, tier, provider = 'claude') {
             }
         }
         else {
-            // Claude / Gemini layout: agents at `<dir>/agents/sr-*.md`, slash commands
+            // Claude / Gemini layout: custom roles at `<dir>/agents/custom-*.md`
+            // (baseline roles are runtime-defined, stale `sr-*` files are ignored), slash commands
             // at `<dir>/commands/{specrails,opsx}/*.<ext>`. Gemini installs into
             // `.gemini/` and its commands are TOML (`.gemini/commands/specrails/*.toml`);
             // claude installs into `.claude/` with Markdown commands. Without the
@@ -484,7 +466,7 @@ function computeSummary(projectPath, tier, provider = 'claude') {
             const agentsDir = (0, path_1.join)(projectPath, dir, 'agents');
             if ((0, fs_1.existsSync)(agentsDir)) {
                 const files = (0, fs_1.readdirSync)(agentsDir);
-                agents = files.filter((f) => /^sr-.*\.md$/.test(f)).length;
+                agents = files.filter((f) => /^custom-.*\.md$/.test(f)).length;
                 const personasDir = (0, path_1.join)(agentsDir, 'personas');
                 if ((0, fs_1.existsSync)(personasDir)) {
                     personas = (0, fs_1.readdirSync)(personasDir).filter((f) => f.endsWith('.md')).length;
@@ -515,6 +497,8 @@ function computeSummary(projectPath, tier, provider = 'claude') {
 }
 /**
  * Resolve completion against the selected provider's real filesystem layout.
+ * Completion is decided by the workflow commands Core places; role agents are
+ * runtime-defined and never required.
  * A legacy `.claude` fallback remains intentional only for Codex/Gemini:
  * older Core releases scaffolded Claude artefacts for those selections.
  * Kimi never had such a released legacy Core target; accepting a mixed
@@ -529,14 +513,13 @@ function setupArtifactState(projectPath, tier, provider) {
         : nativeSummary;
     const nativeHasCommands = nativeSummary.specrailsCommands + nativeSummary.opsxCommands > 0;
     const legacyHasCommands = legacySummary.specrailsCommands + legacySummary.opsxCommands > 0;
-    const nativeComplete = nativeSummary.agents > 0 && nativeHasCommands;
-    const legacyComplete = legacySummary.agents > 0 && legacyHasCommands;
+    const nativeComplete = nativeHasCommands;
+    const legacyComplete = legacyHasCommands;
     const selected = nativeComplete || !legacyComplete ? nativeSummary : legacySummary;
     return {
         // Preserve the actual selected provider for UI labels even when the
         // artefacts came from the legacy Claude compatibility tree.
         summary: { ...selected, provider },
-        hasAgents: nativeSummary.agents > 0 || legacySummary.agents > 0,
         hasCommands: nativeHasCommands || legacyHasCommands,
         hasPersonas: nativeSummary.personas > 0 || legacySummary.personas > 0,
         complete: nativeComplete || legacyComplete,
@@ -1026,7 +1009,9 @@ class SetupManager {
         const validation = validateInstalledCore(root);
         const selectedProvider = provider ?? this._projectProviders.get(projectId) ?? 'claude';
         const summary = computeSummary(root, 'quick', selectedProvider);
-        if (!validation.ok || !installedVersion || summary.agents < 3 || summary.specrailsCommands < 1) {
+        // Role agents are runtime-defined: a Core install is complete when its
+        // workflow commands are in place, regardless of custom role count.
+        if (!validation.ok || !installedVersion || summary.specrailsCommands < 1) {
             this._broadcast({ type: 'setup_error', projectId, error: 'Core 5 uses deterministic installation. Run project installation to repair its framework; enrichment is no longer supported.' });
             return true;
         }
@@ -1315,9 +1300,9 @@ class SetupManager {
                     case 'tool-use': {
                         this._broadcast({ type: 'setup_log', projectId, line: `[tool] ${ev.name}`, stream: 'stdout' });
                         // Tool inputs commonly mention the paths being written — feed the
-                        // input preview into the checkpoint detector so writes to
-                        // .claude/agents/sr-*.md or .codex/skills/sr-*/SKILL.md advance
-                        // the checkpoint state immediately.
+                        // input preview into the checkpoint detector so writes to workflow
+                        // commands (`commands/specrails/*.md`) or provider command skills
+                        // advance the checkpoint state immediately.
                         const hits = detectCheckpointFromText(ev.inputPreview);
                         for (const hit of hits) {
                             this._advanceCheckpoint(projectId, hit.key, hit.detail);

package/server/dist/util/checkout-path.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkoutSubdirectory = checkoutSubdirectory;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Where a directory sits inside its Git checkout. Handles worktree .git files
+ * as well as directories; root and non-Git directories both return ''. */
+function checkoutSubdirectory(directory) {
+    let start;
+    try {
+        start = (0, node_fs_1.realpathSync)(directory);
+    }
+    catch {
+        return '';
+    }
+    for (let current = start;; current = (0, node_path_1.dirname)(current)) {
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(current, '.git')))
+            return (0, node_path_1.relative)(current, start).split(node_path_1.sep).join('/');
+        if ((0, node_path_1.dirname)(current) === current)
+            return '';
+    }
+}

package/server/dist/workspace-manager.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureFrameworkAgents = ensureFrameworkAgents;
 exports.ensureFrameworkCommandSubtrees = ensureFrameworkCommandSubtrees;
 exports.workspacePathFor = workspacePathFor;
 exports.ensureWorkspace = ensureWorkspace;
@@ -16,63 +15,6 @@ const framework_manager_1 = require("./framework-manager");
 const framework_migration_1 = require("./framework-migration");
 const artifact_registry_1 = require("./artifact-registry");
 const agent_mcp_config_1 = require("./agent-mcp-config");
-/**
- * Windows repair: ensure the workspace's `<providerDir>/agents` holds the
- * framework's `sr-*` agent definitions, copied from the REAL versioned framework
- * dir (`~/.specrails/framework/<version>/<providerDir>/agents`).
- *
- * Why: on Windows the `framework/current` JUNCTION can be untraversable by Node's
- * `fs` ("UNKNOWN: scandir" / "untrusted mount point"); the bundled core's
- * `assemble` sources the agents THROUGH `current`, so `linkAgentFiles` reads
- * nothing and the workspace ends up with NO `sr-*` agents — the implement
- * pipeline then has no sub-agents to delegate to (architect/developer/reviewer)
- * and silently runs everything inline. The versioned dir is a real, traversable
- * directory, so we read it directly. (The proper fix lives in core's `assemble`;
- * this repairs already-broken installs without waiting for a core republish, and
- * mirrors exactly what the fixed core does on Windows — copy from the version
- * dir.) `assemble` never re-runs on a rail spawn, so a workspace broken at setup
- * stays broken; this runs per rail spawn to self-heal it.
- *
- * NO-OP on POSIX (per-file symlinks already populate the workspace correctly;
- * byte-identical). Additive (never touches user `custom-*.md`) + idempotent.
- * Returns the number of agents copied.
- */
-function ensureFrameworkAgents(workspaceDir, providerDir, home) {
-    (0, core_update_state_1.assertWorkspaceCoreReady)(workspaceDir, home);
-    if (process.platform !== 'win32')
-        return 0;
-    const root = (0, framework_manager_1.frameworkRoot)(home);
-    const version = (0, framework_manager_1.readCurrentFrameworkVersion)(home);
-    if (!version)
-        return 0;
-    const src = path_1.default.join(root, version, providerDir, 'agents');
-    let entries;
-    try {
-        entries = fs_1.default.readdirSync(src);
-    }
-    catch {
-        return 0; // framework agents not materialized for this provider
-    }
-    const dest = path_1.default.join(workspaceDir, providerDir, 'agents');
-    let copied = 0;
-    for (const name of entries) {
-        // Framework agents only; never clobber a user/plugin `custom-*.md`.
-        if (!name.endsWith('.md') || name.startsWith('custom-'))
-            continue;
-        const destFile = path_1.default.join(dest, name);
-        if (fs_1.default.existsSync(destFile))
-            continue;
-        try {
-            fs_1.default.mkdirSync(dest, { recursive: true });
-            fs_1.default.copyFileSync(path_1.default.join(src, name), destFile);
-            copied += 1;
-        }
-        catch {
-            /* best-effort per file — one failure must never abort the rail spawn */
-        }
-    }
-    return copied;
-}
 /** Whole-directory framework links for the legacy provider layouts. */
 const DIR_LINKED_SUBTREES = ['commands', 'skills', 'rules'];
 /**
@@ -80,8 +22,9 @@ const DIR_LINKED_SUBTREES = ['commands', 'skills', 'rules'];
  *
  * - `rules/` and `specrails/` are whole-directory framework links.
  * - `skills/` is a real merged directory. Core links only its framework-owned
- *   `specrails-*` workflow and `sr-*` role children so OpenSpec, custom, and
- *   other user-owned direct-child skills can coexist.
+ *   `specrails-*` workflow children (older Cores also linked `sr-*` role
+ *   skills) so OpenSpec, custom, and other user-owned direct-child skills can
+ *   coexist.
  *
  * The Windows repair must mirror that ownership boundary exactly. Replacing the
  * Kimi `skills/` root would destroy user state; merely seeing entries in that
@@ -172,21 +115,20 @@ function repairMissingCommands(src, dest) {
     }
 }
 /**
- * Windows repair for provider-owned framework links — the sibling of
- * `ensureFrameworkAgents`.
+ * Windows repair for provider-owned framework links.
  *
- * Why a SEPARATE repair: agents are linked per-file, so a broken `current`
- * junction leaves an EMPTY-but-real `agents/` dir that `ensureFrameworkAgents`
- * refills file-by-file. `commands`/`skills`/`rules` are instead a single
- * dir-symlink INTO `current/<provider>/<subtree>`; when the `current` junction is
- * untraversable by the sidecar (the documented Windows failure), that link is
- * unreadable and the workspace has NO `/specrails:*` commands at all — the claude
- * CLI then reports `Unknown command: /specrails:implement`. This replaces an
+ * Why: `commands`/`skills`/`rules` are a single dir-symlink INTO
+ * `current/<provider>/<subtree>`; when the `current` junction is untraversable
+ * by the sidecar (the documented Windows failure), that link is unreadable and
+ * the workspace has NO `/specrails:*` commands at all — the claude CLI then
+ * reports `Unknown command: /specrails:implement`. This replaces an
  * unreadable/missing link with a REAL recursively-copied directory read straight
- * from the versioned framework dir (never through `current`).
+ * from the versioned framework dir (never through `current`). Role agents need
+ * no repair: specrails-core defines them in its runtime, not as workspace files.
+ * `assemble` never re-runs on a rail spawn, so this runs per spawn to self-heal.
  *
  * Kimi needs an additional per-child repair because its `skills/` root is a real
- * merged directory. Only `specrails-*` and `sr-*` children are framework-owned;
+ * merged directory. Only `specrails-*` (and legacy `sr-*`) children are framework-owned;
  * `openspec-*`, `custom-*`, and unknown children are never copied, replaced, or
  * removed.
  *