specrails-desktop 2.63.1 → 2.64.0

package/client/dist/index.html

@@ -204,7 +204,7 @@
         .specrails-splash__mark .pill { opacity: 1; }
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-CECj3joE.js"></script>
+    <script type="module" crossorigin src="/assets/index-IdGpV21X.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CNC7AqOf.js">
     <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-BbYvbtY8.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-DDD8FYaU.js">
@@ -236,23 +236,23 @@
     <link rel="modulepreload" crossorigin href="/assets/narration-DbHnz0qV.js">
     <link rel="modulepreload" crossorigin href="/assets/nav--u7iPYlS.js">
     <link rel="modulepreload" crossorigin href="/assets/packet-B0H15elv.js">
-    <link rel="modulepreload" crossorigin href="/assets/settings-nryN6wuS.js">
+    <link rel="modulepreload" crossorigin href="/assets/settings-Pyw8uYtL.js">
     <link rel="modulepreload" crossorigin href="/assets/setup-CKGUxKr-.js">
     <link rel="modulepreload" crossorigin href="/assets/specs-DfIdoU5L.js">
     <link rel="modulepreload" crossorigin href="/assets/subscriptionUsage-CdlE5Mg1.js">
     <link rel="modulepreload" crossorigin href="/assets/terminal-BAzpHtpY.js">
     <link rel="modulepreload" crossorigin href="/assets/tickets-D41ZMQpf.js">
     <link rel="modulepreload" crossorigin href="/assets/createLucideIcon-DtODIU64.js">
-    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-CcsE5986.js">
-    <link rel="modulepreload" crossorigin href="/assets/Trans-ZiXIfj50.js">
-    <link rel="modulepreload" crossorigin href="/assets/useDesktop-C0mRIlHT.js">
+    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-Bj4LMp7b.js">
+    <link rel="modulepreload" crossorigin href="/assets/Trans-BbFxRFtR.js">
+    <link rel="modulepreload" crossorigin href="/assets/useDesktop-BjLT0_EE.js">
     <link rel="modulepreload" crossorigin href="/assets/provider-capabilities-lePfeT_Y.js">
     <link rel="modulepreload" crossorigin href="/assets/save-LmPSfsvZ.js">
-    <link rel="modulepreload" crossorigin href="/assets/spending-eWiZGhC_.js">
+    <link rel="modulepreload" crossorigin href="/assets/spending-CQnrWiR3.js">
     <link rel="modulepreload" crossorigin href="/assets/chevron-up-6EFqEHBj.js">
     <link rel="modulepreload" crossorigin href="/assets/sparkles-CCfUdFGY.js">
     <link rel="modulepreload" crossorigin href="/assets/x-Bu7X_eR2.js">
-    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-BHIUPVmC.js">
+    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-DHfigjHS.js">
     <link rel="modulepreload" crossorigin href="/assets/ban-wqfdzoXt.js">
     <link rel="modulepreload" crossorigin href="/assets/file-text-C0blZHLh.js">
     <link rel="modulepreload" crossorigin href="/assets/circle-x-D2ttKotB.js">
@@ -268,21 +268,21 @@
     <link rel="modulepreload" crossorigin href="/assets/search-BDVp3fkH.js">
     <link rel="modulepreload" crossorigin href="/assets/trash-D8zYUmTg.js">
     <link rel="modulepreload" crossorigin href="/assets/triangle-alert-Cxpn8bqr.js">
-    <link rel="modulepreload" crossorigin href="/assets/jira-api-C_D_RDhl.js">
+    <link rel="modulepreload" crossorigin href="/assets/jira-api-Cabj-H0J.js">
     <link rel="modulepreload" crossorigin href="/assets/zap-bugHyWzQ.js">
     <link rel="modulepreload" crossorigin href="/assets/clsx-CjueKrWZ.js">
     <link rel="modulepreload" crossorigin href="/assets/utils-BC4DHlz2.js">
     <link rel="modulepreload" crossorigin href="/assets/dialog-DtdR05v1.js">
     <link rel="modulepreload" crossorigin href="/assets/lib-DWJfei6y.js">
-    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-62h40I4t.js">
-    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-CdN5lTyD.js">
+    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-vJ7qUoqN.js">
+    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-NjPHBLfB.js">
     <link rel="modulepreload" crossorigin href="/assets/button-4FS1ZDTp.js">
-    <link rel="modulepreload" crossorigin href="/assets/project-repositories-Be0CWklo.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-DeCoUsRN.js">
-    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-DiPngt2g.js">
+    <link rel="modulepreload" crossorigin href="/assets/project-repositories-Cnnuj9Ia.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-2eSqR9WK.js">
+    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-Dkwo2cDs.js">
     <link rel="modulepreload" crossorigin href="/assets/core-B3mKBIh5.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-DAIxIYsl.js">
-    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-B1a6GChu.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-B4ybHOyB.js">
+    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-C97qEqMg.js">
     <link rel="modulepreload" crossorigin href="/assets/event-Bt7f3wXe.js">
     <link rel="stylesheet" crossorigin href="/assets/index-BgbCbIua.css">
   </head>

package/docs/ci-cd.md

@@ -38,7 +38,7 @@ Release admission uses the current run/attempt of the named CI workflow and the
 
 ## Native validation without publication
 
-Manually running `Desktop Release` defaults to `validation_only=true`. Select a trusted branch in this repository: admission requires successful push CI for that exact branch and SHA, and refuses evidence from another branch, a pull request or a fork. Selecting an existing matching release tag instead requires its main push CI. Validation builds retain their artifacts in GitHub Actions; macOS signing/notarization remains mandatory and the existing Windows installer signing policy is unchanged. The entire GitHub Release/Hostinger deployment job is skipped. A passing validation build does not publish a release or move an update channel.
+Manually running `Desktop Release` defaults to `validation_only=true`. Select a trusted branch in this repository: admission requires successful push CI for that exact branch and SHA, and refuses evidence from another branch, a pull request or a fork. Selecting an existing matching release tag instead requires its main push CI. Validation builds retain their artifacts in GitHub Actions; macOS signing/notarization remains mandatory and the existing Windows installer signing policy is unchanged. The entire GitHub Release publication job is skipped. A passing validation build does not publish a release or move an update channel.
 
 Both validation and release builds use `assemble-chromium.mjs --release`. On macOS, the certificate and Apple API key are imported before Chromium assembly. The assembler must sign and notarize Chromium before writing a normal `chromium.tar.gz`; missing credentials or failed verification fail the build. Windows uses the same archive format without changing the browser's Authenticode signature. The archive keeps framework symlinks intact through Tauri resource copying. Staging and packaged macOS smoke tests require Chromium signature and notarization verification as well as actual browser execution.
 
@@ -48,14 +48,13 @@ The macOS job retains `artifacts/chromium-signing/` as the `chromium-signing-mac
 
 ## Credentials and external requirements
 
-### Recover an already published Desktop download channel
+### Download channel
 
-If native builds and GitHub publication succeed but Hostinger installer uploads fail, run **Recover Desktop download channel** on `main` with the existing stable version (for example `2.54.0`). It requires successful main CI and successful native builds for that exact release commit, then streams all three published installers and verifies their sizes and GitHub SHA-256 digests. It atomically replaces only `latest/manifest.json` over verified FTPS, pointing downloads to the existing version-specific GitHub assets. It refuses version downgrades, verifies the public manifest after publication, and does not rebuild, delete installers, or alter the signed Tauri updater. Normal releases continue to use the regular distribution workflow.
+GitHub Releases is the only Desktop download channel. Each release carries the canonical installers, the Tauri updater assets and `manifest.json` (version, sha256 and size per platform, with GitHub asset URLs). The Tauri updater reads `releases/latest/download/latest.json`; specrails.dev reads the latest release through the GitHub API. Nothing is uploaded to Hostinger, so a release has no second publication step to recover.
 
 - `RELEASE_PAT` must be authorized for release-please's pull requests and releases. It also permits tag pushes to trigger publication workflows; events created with the repository's ordinary `GITHUB_TOKEN` generally do not trigger another workflow.
 - Publication uses one of two credentials. When the `NPM_TOKEN` secret is set, it must authenticate an account with publishing permission for `specrails-desktop` (npm now requires such tokens to be granular with *bypass 2FA*, and they expire within 90 days); the workflow checks authentication and gives an explicit error before publishing. When the secret is empty, the job publishes through npm **trusted publishing**: it installs npm 11, removes the empty token line that `setup-node` writes, and lets npm exchange the job's OIDC identity (`id-token: write`) for a short-lived publish grant. That path only works once the package's *Trusted publisher* on npmjs.com names this repository (`fjpulidop/specrails-desktop`) and workflow file (`npm-publish.yml`, no environment); registry configuration is never changed from here. Provenance does **not** grant publishing permission in either mode. An npm `E404` during publication is npm's answer to an unauthorized publish and does not identify which token or permission failed; an `E403` mentioning two-factor authentication means the stored token lacks *bypass 2FA*. [npm publishing and provenance](https://docs.github.com/en/actions/tutorials/publish-packages/publish-nodejs-packages).
 - Existing Apple signing/notarization and Tauri updater signing secrets remain required. Installer build steps retain their platform-specific checks.
-- Hostinger credentials must support **explicit FTPS**, a valid TLS certificate, uploads and `RNFR`/`RNTO` in the release directory. There is no plaintext FTP fallback. A failed transfer or rename fails the workflow before old files are removed. [FTP action protocol and security options](https://github.com/SamKirkland/FTP-Deploy-Action/blob/v4.3.6/action.yml).
 
 No secret, registry authorization, signing certificate, hosting permission or branch protection is configured by these source changes. Dependency installation is separated from npm publishing credentials. Candidate Core packages and publication tarballs use `--ignore-scripts` at the relevant installation/publication boundaries. [npm installation lifecycle options](https://docs.npmjs.com/cli/v11/commands/npm-ci/).
 

package/docs/getting-started.md

@@ -16,7 +16,7 @@ Two options:
 
 ### Option 1 — Desktop app (recommended)
 
-Download a signed build for your OS from `https://specrails.dev/downloads/specrails-desktop/latest/`:
+Download a signed build for your OS from the [latest GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases/latest) (the **Download** button on [specrails.dev](https://specrails.dev) links the same files):
 
 - **macOS** — `specrails-desktop-<version>-aarch64.dmg` (Apple Silicon, notarised)
 - **Windows** — `specrails-desktop-<version>-x64-setup.exe` (NSIS; `-arm64-setup.exe` on ARM64)

package/docs/internals/api-reference.md

@@ -127,6 +127,32 @@ Loopback-only admin surface for the Mobile Gateway (the gateway itself is a sepa
 | `GET` | `/devices` | List paired devices |
 | `DELETE` | `/devices/:id` | Revoke a paired device |
 | `POST` | `/cert/rotate` | Rotate the gateway TLS identity (unpairs every device) |
+| `GET` | `/previews` | Live Companion app previews (`{ previews: [{ projectId, projectName, sessionId, deviceId, deviceName, url, title, createdAt }] }`) |
+| `DELETE` | `/previews/:projectId/:sessionId` | End a device-owned preview from Desktop (`{ ok }`; Desktop sessions are never affected) |
+
+Revoking a device also ends its previews. The app-level WS event `mobile.previews_changed` (no `projectId`) tells Settings ▸ Mobile to refetch the list.
+
+#### Companion app preview (gateway `/v1`)
+
+A paired Companion views a project's locally served web app through a device-owned server-side browser session. The routes require the mission grant (all-projects device) and the `appPreview` capability (`GET /v1/capabilities` → `features.appPreview`, true when browser capture is enabled).
+
+| Method | Path | Notes |
+|--------|------|-------|
+| `GET` | `/v1/projects/:pid/missions/:cid/preview-targets` | `{ targets: [{ processId, urls }] }`: local URLs announced in the logs of the mission's running background processes |
+| `POST` | `/v1/projects/:pid/preview-sessions` | Body `{ missionId, processId, url, viewport? }`; `url` must be announced by that process. `201 { sessionId, channel, url }` |
+| `POST` | `/v1/projects/:pid/preview-sessions/:sid/attach` | Re-attach after a reconnect: `{ sessionId, channel }` (a new DataChannel replaces the old one) |
+| `POST` | `/v1/projects/:pid/preview-sessions/:sid/navigate` | Body `{ action: goto\|back\|forward\|reload, url? }`; `goto` accepts only paths on announced origins |
+| `DELETE` | `/v1/projects/:pid/preview-sessions/:sid` | End the device's own preview |
+
+Errors carry `{ error, code }`. Codes: `preview_unavailable` (404), `preview_target_gone` (404), `preview_session_closed` (404), `preview_url_not_announced` (400), `preview_limit` (429), `preview_requires_webrtc` (409), `preview_failed` (502). Sessions owned by Desktop or by another device are reported as `preview_session_closed`.
+
+**Channel.** `channel` is the label of an ordered, reliable DataChannel (`preview:<sessionId>`) that Desktop opens on the device's existing WebRTC peer without renegotiation:
+
+- **Desktop → Companion, text:** JSON control: `ready` (`{ id, url, title, viewport }`), `nav`, `popup`, `closed` (`{ reason }`) and `nav_rejected`.
+- **Desktop → Companion, binary:** JPEG screencast frames in fragments of at most 16 000 bytes. Each fragment starts with an 8-byte big-endian header `u32 frameSeq | u16 index | u16 count`. Render a frame only when all of its fragments have arrived. A newer `frameSeq` discards an incomplete older frame.
+- **Companion → Desktop:** JSON `{ type: 'input', event }` (mouse / wheel / key / resize, validated) and `{ type: 'navigate', action, url? }`, rate-limited to 6 000 messages per minute.
+
+**Origin policy.** A device session may load a loopback origin only while a running background process of the project announces it. Every other request passes the regular server-side SSRF guard. Device sessions have their own budget: one per device (opening a new one replaces it) and two per project. They never count against Desktop's four sessions.
 
 ### specrails-tech proxy
 

package/docs/internals/core-runtime-updates.md

@@ -13,7 +13,7 @@ framework is rejected rather than silently replacing an update.
 
 ## Persistence and publication
 
-The release bundle pins Core 6.6.2 in `desktop-release.yml` and
+The release bundle pins Core 6.6.3 in `desktop-release.yml` and
 `scripts/assemble-bundled-core.lock.json`. Core 6 is the Desktop-only engine: it
 publishes integration contract 5.1 (no standalone `update`) and ships only the
 implement and retry workflows (Batch was folded into implement; Desktop no
@@ -27,8 +27,8 @@ dependency leaks into its tarball (today `@langchain/langgraph-sdk` ships
 module still loads while every staged path stays inside the MSI budget
 (`MAX_STAGED_RELATIVE_PATH`, 120 characters).
 
-The paired CI checkout uses the immutable Core 6.6.2 release commit
-`98b5d3c515967aed170dcb8a31a7462390cc420f`. Bundle smoke checks use Node 22.22.3,
+The paired CI checkout uses the immutable Core 6.6.3 release commit
+`a8bc8181a206ea9630ae3b02e6198f8519d35604`. Bundle smoke checks use Node 22.22.3,
 matching Core's minimum supported Node version and the Desktop release runtime.
 
 Desktop updates retain the complete npm installation, including dependencies,

package/docs/internals/source-map.md

@@ -5,7 +5,7 @@ architectural dependency declaration. Search a heading or filename and read only
 the relevant source and tests. Feature prefixes group the legacy server files;
 new bounded modules live under `server/modules/`.
 
-Includes 1047 source/build files. Nearby tests are linked where names
+Includes 1050 source/build files. Nearby tests are linked where names
 match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## cli
@@ -854,7 +854,6 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [obfuscate-chromium.mjs](../../scripts/obfuscate-chromium.mjs)
 - [paired-core-shards.mjs](../../scripts/paired-core-shards.mjs) · [test](../../scripts/paired-core-shards.test.mjs)
 - [patch-node-pty.mjs](../../scripts/patch-node-pty.mjs) · [test](../../scripts/patch-node-pty.test.mjs)
-- [recover-desktop-channel.mjs](../../scripts/recover-desktop-channel.mjs) · [test](../../scripts/recover-desktop-channel.test.mjs)
 - [release-policy.mjs](../../scripts/release-policy.mjs) · [test](../../scripts/release-policy.test.mjs)
 - [run-native-smoke.ps1](../../scripts/run-native-smoke.ps1)
 - [sign-chromium-macos.mjs](../../scripts/sign-chromium-macos.mjs) · [test](../../scripts/sign-chromium-macos.test.mjs)
@@ -1058,6 +1057,8 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [mobile-event-bus.ts](../../server/mobile/mobile-event-bus.ts)
 - [mobile-gateway.ts](../../server/mobile/mobile-gateway.ts) · [test](../../server/mobile/mobile-gateway.test.ts)
 - [mobile-missions.ts](../../server/mobile/mobile-missions.ts) · [test](../../server/mobile/mobile-missions.test.ts)
+- [mobile-preview-channel.ts](../../server/mobile/mobile-preview-channel.ts) · [test](../../server/mobile/mobile-preview-channel.test.ts)
+- [mobile-preview.ts](../../server/mobile/mobile-preview.ts) · [test](../../server/mobile/mobile-preview.test.ts)
 - [mobile-redact.ts](../../server/mobile/mobile-redact.ts) · [test](../../server/mobile/mobile-redact.test.ts)
 - [mobile-router.ts](../../server/mobile/mobile-router.ts) · [test](../../server/mobile/mobile-router.test.ts)
 - [mobile-signal-reconnect.ts](../../server/mobile/mobile-signal-reconnect.ts) · [test](../../server/mobile/mobile-signal-reconnect.test.ts)
@@ -1149,6 +1150,10 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [profile-manager.ts](../../server/modules/agents/runtime/profile-manager.ts) · [test](../../server/modules/agents/runtime/profile-manager.test.ts)
 - [profiles-router.ts](../../server/modules/agents/runtime/profiles-router.ts) · [test](../../server/modules/agents/runtime/profiles-router.test.ts)
 
+## server/modules/browser/domain
+
+- [preview-origins.ts](../../server/modules/browser/domain/preview-origins.ts) · [test](../../server/modules/browser/domain/preview-origins.test.ts)
+
 ## server/modules/browser/runtime
 
 - [browser-capture-manager.ts](../../server/modules/browser/runtime/browser-capture-manager.ts) · [test](../../server/modules/browser/runtime/browser-capture-manager.test.ts)
@@ -1157,6 +1162,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [browser-network.ts](../../server/modules/browser/runtime/browser-network.ts) · [test](../../server/modules/browser/runtime/browser-network.test.ts)
 - [browser-playwright.ts](../../server/modules/browser/runtime/browser-playwright.ts) · [test](../../server/modules/browser/runtime/browser-playwright.test.ts)
 - [browser-viewport.ts](../../server/modules/browser/runtime/browser-viewport.ts) · [test](../../server/modules/browser/runtime/browser-viewport.test.ts)
+- [preview-targets.ts](../../server/modules/browser/runtime/preview-targets.ts) · [test](../../server/modules/browser/runtime/preview-targets.test.ts)
 
 ## server/modules/builder/runtime
 
@@ -1407,7 +1413,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 ## server/modules/terminals/runtime
 
 - [background-process-control.ts](../../server/modules/terminals/runtime/background-process-control.ts) · [test](../../server/modules/terminals/runtime/background-process-control.test.ts)
-- [background-process-service.ts](../../server/modules/terminals/runtime/background-process-service.ts)
+- [background-process-service.ts](../../server/modules/terminals/runtime/background-process-service.ts) · [test](../../server/modules/terminals/runtime/background-process-service.test.ts)
 - [background-process-store.ts](../../server/modules/terminals/runtime/background-process-store.ts) · [test](../../server/modules/terminals/runtime/background-process-store.test.ts)
 - [background-windows-bootstrap.ts](../../server/modules/terminals/runtime/background-windows-bootstrap.ts) · [test](../../server/modules/terminals/runtime/background-windows-bootstrap.test.ts)
 - [terminal-manager.ts](../../server/modules/terminals/runtime/terminal-manager.ts) · [test](../../server/modules/terminals/runtime/terminal-manager.test.ts)

package/docs/platforms/macos.md

@@ -7,19 +7,19 @@
 
 ## Installation
 
-Signed, notarized builds are published on every release under:
+Signed, notarized builds are published on every release as GitHub Release assets:
 
-> 📥 `https://specrails.dev/downloads/specrails-desktop/latest/`
+> 📥 [https://github.com/fjpulidop/specrails-desktop/releases/latest](https://github.com/fjpulidop/specrails-desktop/releases/latest)
 
 - `specrails-desktop-<version>-aarch64.dmg` — the Apple Silicon installer.
 
-Versioned copies live at `downloads/specrails-desktop/v<version>/` for archival and deep-linking. A machine-readable `manifest.json` in `latest/` describes the current release (version, sha256, size) so you can verify a download:
+Every earlier version stays on its own [GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases). Each release lists the sha256 of every asset and carries a machine-readable `manifest.json` (version, sha256, size) so you can verify a download:
 
 ```bash
 shasum -a 256 specrails-desktop-<version>-aarch64.dmg
 ```
 
-Compare the output against `platforms["darwin-arm64"].sha256` in `https://specrails.dev/downloads/specrails-desktop/latest/manifest.json`.
+Compare the output against `platforms["darwin-arm64"].sha256` in `https://github.com/fjpulidop/specrails-desktop/releases/latest/download/manifest.json`, or against the sha256 shown next to the asset on the release page.
 
 To install: open the `.dmg` and drag **Specrails** into `Applications/`.
 

package/docs/platforms/windows.md

@@ -11,9 +11,9 @@
 
 ## Installation
 
-Installers are published on every release under:
+Installers are published on every release as GitHub Release assets:
 
-> 📥 `https://specrails.dev/downloads/specrails-desktop/latest/`
+> 📥 [https://github.com/fjpulidop/specrails-desktop/releases/latest](https://github.com/fjpulidop/specrails-desktop/releases/latest)
 
 Pick the installer that matches your CPU architecture:
 
@@ -22,9 +22,9 @@ Pick the installer that matches your CPU architecture:
 | x64 | `specrails-desktop-<version>-x64-setup.exe` |
 | ARM64 | `specrails-desktop-<version>-arm64-setup.exe` |
 
-Windows ships only the NSIS installer. For unattended or managed deployment, run it silently with `/S` (optionally `/D=<install dir>` as the last argument). Releases up to 2.62 also published an `.msi`; see [Updates](#updates) for how those installations migrate. The installer provisions Microsoft Edge WebView2 when it is missing, downloading it through a small embedded bootstrapper (Windows 11 and current Windows 10 already include it). Versioned copies live at `downloads/specrails-desktop/v<version>/` for archival and deep-linking.
+Windows ships only the NSIS installer. For unattended or managed deployment, run it silently with `/S` (optionally `/D=<install dir>` as the last argument). Releases up to 2.62 also published an `.msi`; see [Updates](#updates) for how those installations migrate. The installer provisions Microsoft Edge WebView2 when it is missing, downloading it through a small embedded bootstrapper (Windows 11 and current Windows 10 already include it). Every earlier version stays on its own [GitHub Release](https://github.com/fjpulidop/specrails-desktop/releases).
 
-A machine-readable `manifest.json` in `latest/` describes the current release (version, sha256, size) per platform, including `windows-x64` and `windows-arm64` entries — consumers can read it to build download links without hardcoding a version.
+A machine-readable `manifest.json` asset on each release describes the current release (version, sha256, size) per platform, including `windows-x64` and `windows-arm64` entries — consumers can read it to build download links without hardcoding a version.
 
 ## SmartScreen warning
 
@@ -44,7 +44,7 @@ This warning is expected and will persist until Authenticode code signing is add
 Get-FileHash specrails-desktop-<version>-x64-setup.exe -Algorithm SHA256
 ```
 
-Compare the output against the matching architecture's `sha256` (`platforms["windows-x64"].sha256` or `platforms["windows-arm64"].sha256`) in `https://specrails.dev/downloads/specrails-desktop/latest/manifest.json`.
+Compare the output against the matching architecture's `sha256` (`platforms["windows-x64"].sha256` or `platforms["windows-arm64"].sha256`) in `https://github.com/fjpulidop/specrails-desktop/releases/latest/download/manifest.json`, or against the sha256 shown next to the asset on the release page.
 
 ## What's bundled
 

package/docs/running-pipelines.md

@@ -156,6 +156,18 @@ Visible only when [telemetry](customizing.md#telemetry) was enabled for the job.
 - `summary.md` — human-readable highlights
 - `profile.json`, `plugins.json` — exact snapshots of what ran (when present)
 
+### A run fails with `lease_lost` right after installing dependencies
+
+On Desktop versions that bundle Core 6.6.2 or older, an Implement run on a large repository could fail in the `developer` step shortly after `[environment] yarn install` (or `npm install`) with:
+
+```
+Execution lease expired or was replaced; late effects cannot commit
+```
+
+Core held an execution lease that it renews every few seconds, but it ran the dependency install synchronously. An install longer than about 45 s blocked that renewal, so the lease expired. Core 6.6.3 runs host installs asynchronously and the lease keeps renewing. Update Desktop and launch the spec again.
+
+The interrupted attempt cannot be resumed: its write step was cut off, so the runtime cannot confirm what was applied. Its isolated worktree is preserved, and you can inspect it or delete it.
+
 ## Agent profiles
 
 A **profile** is a named JSON file that bundles the agent chain + per-agent models + routing rules. Different rails can run different profiles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-desktop",
-  "version": "2.63.1",
+  "version": "2.64.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/index.js

@@ -623,7 +623,20 @@ function applyPtyWsRateLimiting(ws) {
     // Second HTTPS+WSS listener in THIS process; the main server stays loopback.
     // The control plane is desktop-only: loopback + (via /api below) requireAuth.
     // Mounted before the /api desktop router so its sub-path is unambiguous.
-    const mobileGateway = new mobile_1.MobileGateway({ desktopDb: registry.desktopDb, desktopPort: port, broadcast });
+    const mobileGateway = new mobile_1.MobileGateway({
+        desktopDb: registry.desktopDb,
+        desktopPort: port,
+        broadcast,
+        // Companion app preview: each project's browser + the process-log targets.
+        preview: {
+            enabled: () => BROWSER_CAPTURE_ENABLED,
+            browserFor: (projectId) => registry.getContext(projectId)?.browserCaptureManager ?? null,
+            allBrowsers: () => registry.listProjects()
+                .map((project) => registry.getContext(project.id)?.browserCaptureManager)
+                .filter((manager) => manager != null),
+            targets: registry.previewTargets,
+        },
+    });
     _mobileGateway = mobileGateway;
     app.use('/api/mobile', auth_1.requireLoopback, (0, mobile_1.createMobileAdminRouter)({
         gateway: mobileGateway,

package/server/dist/mobile/mobile-admin-router.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMobileAdminRouter = createMobileAdminRouter;
 const express_1 = require("express");
 const mobile_devices_1 = require("./mobile-devices");
+const desktop_db_1 = require("../desktop-db");
 const DEVICE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;
 function createMobileAdminRouter(deps) {
     const router = (0, express_1.Router)();
@@ -37,10 +38,25 @@ function createMobileAdminRouter(deps) {
         const changed = (0, mobile_devices_1.revokeDevice)(desktopDb, id);
         if (changed) {
             gateway.bridge?.closeForDevice(id);
+            void gateway.closePreviewsForDevice(id).catch(() => { });
             deps.broadcast({ type: 'mobile.device_revoked', deviceId: id, timestamp: new Date().toISOString() });
         }
         res.json({ ok: changed });
     });
+    // —— Companion app previews (Desktop indicator) ——
+    router.get('/previews', (_req, res) => {
+        const previews = gateway.preview?.listDeviceSessions() ?? [];
+        res.json({ previews: previews.map((p) => ({ ...p, projectName: (0, desktop_db_1.getProject)(desktopDb, p.projectId)?.name ?? p.projectId })) });
+    });
+    router.delete('/previews/:projectId/:sessionId', async (req, res) => {
+        const projectId = typeof req.params.projectId === 'string' ? req.params.projectId : '';
+        const sessionId = typeof req.params.sessionId === 'string' ? req.params.sessionId : '';
+        if (!/^[A-Za-z0-9_-]{1,160}$/.test(projectId) || !/^[A-Za-z0-9_-]{1,160}$/.test(sessionId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        res.json({ ok: (await gateway.preview?.endFromDesktop(projectId, sessionId)) ?? false });
+    });
     router.post('/cert/rotate', async (_req, res) => {
         const status = await gateway.rotateCert();
         res.json(status);

package/server/dist/mobile/mobile-gateway.js

@@ -17,6 +17,7 @@ const mobile_webrtc_peer_1 = require("./mobile-webrtc-peer");
 const mobile_signal_reconnect_1 = require("./mobile-signal-reconnect");
 const mobile_webrtc_1 = require("./mobile-webrtc");
 const agent_store_1 = require("../modules/agents/runtime/agent-store");
+const mobile_preview_1 = require("./mobile-preview");
 // Lifecycle owner of the second HTTPS+WSS listener (default :4202), hard-isolated
 // from the main server. Off by default; started on enable or boot-if-enabled.
 const DEFAULT_PORT = 4202;
@@ -47,12 +48,28 @@ class MobileGateway {
     _running = false;
     _boundPort = DEFAULT_PORT;
     _portOverride;
+    _preview;
     constructor(deps) {
         this._db = deps.desktopDb;
         this._desktopPort = deps.desktopPort;
         this._broadcast = deps.broadcast;
         this._bindHost = deps.bindHost ?? '0.0.0.0';
         this._portOverride = deps.port;
+        this._preview = deps.preview
+            ? new mobile_preview_1.MobilePreviewService({
+                ...deps.preview,
+                openChannel: (deviceId, label) => this._webrtc?.openChannel(deviceId, label) ?? null,
+                onChange: () => this._broadcast({ type: 'mobile.previews_changed', timestamp: new Date().toISOString() }),
+            })
+            : null;
+    }
+    get preview() {
+        return this._preview;
+    }
+    /** A revoked device loses its peer mapping and every preview it owns. */
+    async closePreviewsForDevice(deviceId) {
+        this._webrtc?.forgetDevice(deviceId);
+        await this._preview?.closeForDevice(deviceId);
     }
     get bridge() {
         return this._bridge;
@@ -139,6 +156,7 @@ class MobileGateway {
             db: this._db,
             desktopPort: this._desktopPort,
             currentFingerprint: () => this._cert.fingerprint,
+            ...(this._preview ? { preview: this._preview } : {}),
         }));
         const server = https_1.default.createServer({ cert: this._cert.certPem, key: this._cert.keyPem }, app);
         // BUG-MOBILE-02: scope each socket's subscribe to the device's granted

package/server/dist/mobile/mobile-missions.js

@@ -16,9 +16,11 @@ const record = (value) => value && typeof value === 'object' && !Array.isArray(v
 const pick = (value, keys) => Object.fromEntries(Object.entries(record(value)).filter(([key]) => keys.includes(key)));
 exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
-function mobileCapabilities(db, deviceId) {
+function mobileCapabilities(db, deviceId, opts = {}) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
+    // App preview targets come from mission processes, so it inherits the
+    // mission grant and additionally needs Desktop's browser capture.
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)(), appPreview: missions && opts.appPreview === true },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {
@@ -72,7 +74,7 @@ function missionSnapshot(value) {
         pendingMessages, pendingTruncated: pending.length > 50,
         live: { ...pick(live, ['isStreaming', 'startedAt']), streamingText, textTruncated: streamingText.length < liveRaw.length } };
 }
-function createMobileMissionsRouter({ db, upstream }) {
+function createMobileMissionsRouter({ db, upstream, appPreview }) {
     const router = (0, express_1.Router)();
     const segment = (value) => typeof value === 'string' ? value : '';
     const send = async (res, method, path, body, shape) => {
@@ -84,7 +86,7 @@ function createMobileMissionsRouter({ db, upstream }) {
             res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
         }
     };
-    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id)));
+    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id, { appPreview: appPreview?.() ?? false })));
     router.get('/mission-models', (req, res) => {
         const provider = segment(req.query.provider);
         if (!/^[a-z0-9_-]{1,40}$/.test(provider)) {