specrails-desktop 2.63.1 → 2.63.2

package/docs/ci-cd.md

@@ -38,7 +38,7 @@ Release admission uses the current run/attempt of the named CI workflow and the
 
 ## Native validation without publication
 
-Manually running `Desktop Release` defaults to `validation_only=true`. Select a trusted branch in this repository: admission requires successful push CI for that exact branch and SHA, and refuses evidence from another branch, a pull request or a fork. Selecting an existing matching release tag instead requires its main push CI. Validation builds retain their artifacts in GitHub Actions; macOS signing/notarization remains mandatory and the existing Windows installer signing policy is unchanged. The entire GitHub Release/Hostinger deployment job is skipped. A passing validation build does not publish a release or move an update channel.
+Manually running `Desktop Release` defaults to `validation_only=true`. Select a trusted branch in this repository: admission requires successful push CI for that exact branch and SHA, and refuses evidence from another branch, a pull request or a fork. Selecting an existing matching release tag instead requires its main push CI. Validation builds retain their artifacts in GitHub Actions; macOS signing/notarization remains mandatory and the existing Windows installer signing policy is unchanged. The entire GitHub Release publication job is skipped. A passing validation build does not publish a release or move an update channel.
 
 Both validation and release builds use `assemble-chromium.mjs --release`. On macOS, the certificate and Apple API key are imported before Chromium assembly. The assembler must sign and notarize Chromium before writing a normal `chromium.tar.gz`; missing credentials or failed verification fail the build. Windows uses the same archive format without changing the browser's Authenticode signature. The archive keeps framework symlinks intact through Tauri resource copying. Staging and packaged macOS smoke tests require Chromium signature and notarization verification as well as actual browser execution.
 
@@ -48,14 +48,13 @@ The macOS job retains `artifacts/chromium-signing/` as the `chromium-signing-mac
 
 ## Credentials and external requirements
 
-### Recover an already published Desktop download channel
+### Download channel
 
-If native builds and GitHub publication succeed but Hostinger installer uploads fail, run **Recover Desktop download channel** on `main` with the existing stable version (for example `2.54.0`). It requires successful main CI and successful native builds for that exact release commit, then streams all three published installers and verifies their sizes and GitHub SHA-256 digests. It atomically replaces only `latest/manifest.json` over verified FTPS, pointing downloads to the existing version-specific GitHub assets. It refuses version downgrades, verifies the public manifest after publication, and does not rebuild, delete installers, or alter the signed Tauri updater. Normal releases continue to use the regular distribution workflow.
+GitHub Releases is the only Desktop download channel. Each release carries the canonical installers, the Tauri updater assets and `manifest.json` (version, sha256 and size per platform, with GitHub asset URLs). The Tauri updater reads `releases/latest/download/latest.json`; specrails.dev reads the latest release through the GitHub API. Nothing is uploaded to Hostinger, so a release has no second publication step to recover.
 
 - `RELEASE_PAT` must be authorized for release-please's pull requests and releases. It also permits tag pushes to trigger publication workflows; events created with the repository's ordinary `GITHUB_TOKEN` generally do not trigger another workflow.
 - Publication uses one of two credentials. When the `NPM_TOKEN` secret is set, it must authenticate an account with publishing permission for `specrails-desktop` (npm now requires such tokens to be granular with *bypass 2FA*, and they expire within 90 days); the workflow checks authentication and gives an explicit error before publishing. When the secret is empty, the job publishes through npm **trusted publishing**: it installs npm 11, removes the empty token line that `setup-node` writes, and lets npm exchange the job's OIDC identity (`id-token: write`) for a short-lived publish grant. That path only works once the package's *Trusted publisher* on npmjs.com names this repository (`fjpulidop/specrails-desktop`) and workflow file (`npm-publish.yml`, no environment); registry configuration is never changed from here. Provenance does **not** grant publishing permission in either mode. An npm `E404` during publication is npm's answer to an unauthorized publish and does not identify which token or permission failed; an `E403` mentioning two-factor authentication means the stored token lacks *bypass 2FA*. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
 - Existing Apple signing/notarization and Tauri updater signing secrets remain required. Installer build steps retain their platform-specific checks.
-- Hostinger credentials must support **explicit FTPS**, a valid TLS certificate, uploads and `RNFR`/`RNTO` in the release directory. There is no plaintext FTP fallback. A failed transfer or rename fails the workflow before old files are removed. [FTP action protocol and security options](https://github.com/SamKirkland/FTP-Deploy-Action/blob/v4.3.6/action.yml).
 
 No secret, registry authorization, signing certificate, hosting permission or branch protection is configured by these source changes. Dependency installation is separated from npm publishing credentials. Candidate Core packages and publication tarballs use `--ignore-scripts` at the relevant installation/publication boundaries. [npm installation lifecycle options](https://docs.npmjs.com/cli/v11/commands/npm-ci/).
 

package/docs/getting-started.md

@@ -16,7 +16,7 @@ Two options:
 
 ### Option 1 — Desktop app (recommended)
 
-Download a signed build for your OS from `https://specrails.dev/downloads/specrails-desktop/latest/`:
+Download a signed build for your OS from the [latest GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases/latest) (the **Download** button on [specrails.dev](https://specrails.dev) links the same files):
 
 - **macOS** — `specrails-desktop-<version>-aarch64.dmg` (Apple Silicon, notarised)
 - **Windows** — `specrails-desktop-<version>-x64-setup.exe` (NSIS; `-arm64-setup.exe` on ARM64)

package/docs/internals/core-runtime-updates.md

@@ -13,7 +13,7 @@ framework is rejected rather than silently replacing an update.
 
 ## Persistence and publication
 
-The release bundle pins Core 6.6.2 in `desktop-release.yml` and
+The release bundle pins Core 6.6.3 in `desktop-release.yml` and
 `scripts/assemble-bundled-core.lock.json`. Core 6 is the Desktop-only engine: it
 publishes integration contract 5.1 (no standalone `update`) and ships only the
 implement and retry workflows (Batch was folded into implement; Desktop no
@@ -27,8 +27,8 @@ dependency leaks into its tarball (today `@langchain/langgraph-sdk` ships
 module still loads while every staged path stays inside the MSI budget
 (`MAX_STAGED_RELATIVE_PATH`, 120 characters).
 
-The paired CI checkout uses the immutable Core 6.6.2 release commit
-`98b5d3c515967aed170dcb8a31a7462390cc420f`. Bundle smoke checks use Node 22.22.3,
+The paired CI checkout uses the immutable Core 6.6.3 release commit
+`a8bc8181a206ea9630ae3b02e6198f8519d35604`. Bundle smoke checks use Node 22.22.3,
 matching Core's minimum supported Node version and the Desktop release runtime.
 
 Desktop updates retain the complete npm installation, including dependencies,

package/docs/internals/source-map.md

@@ -5,7 +5,7 @@ architectural dependency declaration. Search a heading or filename and read only
 the relevant source and tests. Feature prefixes group the legacy server files;
 new bounded modules live under `server/modules/`.
 
-Includes 1047 source/build files. Nearby tests are linked where names
+Includes 1046 source/build files. Nearby tests are linked where names
 match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## cli
@@ -854,7 +854,6 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [obfuscate-chromium.mjs](../../scripts/obfuscate-chromium.mjs)
 - [paired-core-shards.mjs](../../scripts/paired-core-shards.mjs) · [test](../../scripts/paired-core-shards.test.mjs)
 - [patch-node-pty.mjs](../../scripts/patch-node-pty.mjs) · [test](../../scripts/patch-node-pty.test.mjs)
-- [recover-desktop-channel.mjs](../../scripts/recover-desktop-channel.mjs) · [test](../../scripts/recover-desktop-channel.test.mjs)
 - [release-policy.mjs](../../scripts/release-policy.mjs) · [test](../../scripts/release-policy.test.mjs)
 - [run-native-smoke.ps1](../../scripts/run-native-smoke.ps1)
 - [sign-chromium-macos.mjs](../../scripts/sign-chromium-macos.mjs) · [test](../../scripts/sign-chromium-macos.test.mjs)

package/docs/platforms/macos.md

@@ -7,19 +7,19 @@
 
 ## Installation
 
-Signed, notarized builds are published on every release under:
+Signed, notarized builds are published on every release as GitHub Release assets:
 
-> 📥 `https://specrails.dev/downloads/specrails-desktop/latest/`
+> 📥 [https://github.com/fjpulidop/specrails-desktop/releases/latest](https://github.com/fjpulidop/specrails-desktop/releases/latest)
 
 - `specrails-desktop-<version>-aarch64.dmg` — the Apple Silicon installer.
 
-Versioned copies live at `downloads/specrails-desktop/v<version>/` for archival and deep-linking. A machine-readable `manifest.json` in `latest/` describes the current release (version, sha256, size) so you can verify a download:
+Every earlier version stays on its own [GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases). Each release lists the sha256 of every asset and carries a machine-readable `manifest.json` (version, sha256, size) so you can verify a download:
 
 ```bash
 shasum -a 256 specrails-desktop-<version>-aarch64.dmg
 ```
 
-Compare the output against `platforms["darwin-arm64"].sha256` in `https://specrails.dev/downloads/specrails-desktop/latest/manifest.json`.
+Compare the output against `platforms["darwin-arm64"].sha256` in `https://github.com/fjpulidop/specrails-desktop/releases/latest/download/manifest.json`, or against the sha256 shown next to the asset on the release page.
 
 To install: open the `.dmg` and drag **Specrails** into `Applications/`.
 

package/docs/platforms/windows.md

@@ -11,9 +11,9 @@
 
 ## Installation
 
-Installers are published on every release under:
+Installers are published on every release as GitHub Release assets:
 
-> 📥 `https://specrails.dev/downloads/specrails-desktop/latest/`
+> 📥 [https://github.com/fjpulidop/specrails-desktop/releases/latest](https://github.com/fjpulidop/specrails-desktop/releases/latest)
 
 Pick the installer that matches your CPU architecture:
 
@@ -22,9 +22,9 @@ Pick the installer that matches your CPU architecture:
 | x64 | `specrails-desktop-<version>-x64-setup.exe` |
 | ARM64 | `specrails-desktop-<version>-arm64-setup.exe` |
 
-Windows ships only the NSIS installer. For unattended or managed deployment, run it silently with `/S` (optionally `/D=<install dir>` as the last argument). Releases up to 2.62 also published an `.msi`; see [Updates](#updates) for how those installations migrate. The installer provisions Microsoft Edge WebView2 when it is missing, downloading it through a small embedded bootstrapper (Windows 11 and current Windows 10 already include it). Versioned copies live at `downloads/specrails-desktop/v<version>/` for archival and deep-linking.
+Windows ships only the NSIS installer. For unattended or managed deployment, run it silently with `/S` (optionally `/D=<install dir>` as the last argument). Releases up to 2.62 also published an `.msi`; see [Updates](#updates) for how those installations migrate. The installer provisions Microsoft Edge WebView2 when it is missing, downloading it through a small embedded bootstrapper (Windows 11 and current Windows 10 already include it). Every earlier version stays on its own [GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases).
 
-A machine-readable `manifest.json` in `latest/` describes the current release (version, sha256, size) per platform, including `windows-x64` and `windows-arm64` entries — consumers can read it to build download links without hardcoding a version.
+A machine-readable `manifest.json` asset on each release describes the current release (version, sha256, size) per platform, including `windows-x64` and `windows-arm64` entries — consumers can read it to build download links without hardcoding a version.
 
 ## SmartScreen warning
 
@@ -44,7 +44,7 @@ This warning is expected and will persist until Authenticode code signing is add
 Get-FileHash specrails-desktop-<version>-x64-setup.exe -Algorithm SHA256
 ```
 
-Compare the output against the matching architecture's `sha256` (`platforms["windows-x64"].sha256` or `platforms["windows-arm64"].sha256`) in `https://specrails.dev/downloads/specrails-desktop/latest/manifest.json`.
+Compare the output against the matching architecture's `sha256` (`platforms["windows-x64"].sha256` or `platforms["windows-arm64"].sha256`) in `https://github.com/fjpulidop/specrails-desktop/releases/latest/download/manifest.json`, or against the sha256 shown next to the asset on the release page.
 
 ## What's bundled
 

package/docs/running-pipelines.md

@@ -156,6 +156,18 @@ Visible only when [telemetry](customizing.md#telemetry) was enabled for the job.
 - `summary.md` — human-readable highlights
 - `profile.json`, `plugins.json` — exact snapshots of what ran (when present)
 
+### A run fails with `lease_lost` right after installing dependencies
+
+On Desktop versions that bundle Core 6.6.2 or older, an Implement run on a large repository could fail in the `developer` step shortly after `[environment] yarn install` (or `npm install`) with:
+
+```
+Execution lease expired or was replaced; late effects cannot commit
+```
+
+Core held an execution lease that it renews every few seconds, but it ran the dependency install synchronously. An install longer than about 45 s blocked that renewal, so the lease expired. Core 6.6.3 runs host installs asynchronously and the lease keeps renewing. Update Desktop and launch the spec again.
+
+The interrupted attempt cannot be resumed: its write step was cut off, so the runtime cannot confirm what was applied. Its isolated worktree is preserved, and you can inspect it or delete it.
+
 ## Agent profiles
 
 A **profile** is a named JSON file that bundles the agent chain + per-agent models + routing rules. Different rails can run different profiles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.63.1",
+  "version": "2.63.2",
   "license": "MIT",
   "repository": {
     "type": "git",