specrails-desktop 2.63.2 → 2.64.1

package/client/dist/index.html

@@ -204,7 +204,7 @@
         .specrails-splash__mark .pill { opacity: 1; }
       }
     </style>
-    <script type="module" crossorigin src="/assets/index-CECj3joE.js"></script>
+    <script type="module" crossorigin src="/assets/index-Ce4yZtKf.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-CNC7AqOf.js">
     <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-BbYvbtY8.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-DDD8FYaU.js">
@@ -236,23 +236,23 @@
     <link rel="modulepreload" crossorigin href="/assets/narration-DbHnz0qV.js">
     <link rel="modulepreload" crossorigin href="/assets/nav--u7iPYlS.js">
     <link rel="modulepreload" crossorigin href="/assets/packet-B0H15elv.js">
-    <link rel="modulepreload" crossorigin href="/assets/settings-nryN6wuS.js">
+    <link rel="modulepreload" crossorigin href="/assets/settings-Pyw8uYtL.js">
     <link rel="modulepreload" crossorigin href="/assets/setup-CKGUxKr-.js">
     <link rel="modulepreload" crossorigin href="/assets/specs-DfIdoU5L.js">
     <link rel="modulepreload" crossorigin href="/assets/subscriptionUsage-CdlE5Mg1.js">
     <link rel="modulepreload" crossorigin href="/assets/terminal-BAzpHtpY.js">
     <link rel="modulepreload" crossorigin href="/assets/tickets-D41ZMQpf.js">
     <link rel="modulepreload" crossorigin href="/assets/createLucideIcon-DtODIU64.js">
-    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-CcsE5986.js">
-    <link rel="modulepreload" crossorigin href="/assets/Trans-ZiXIfj50.js">
-    <link rel="modulepreload" crossorigin href="/assets/useDesktop-C0mRIlHT.js">
+    <link rel="modulepreload" crossorigin href="/assets/useSharedWebSocket-Bj4LMp7b.js">
+    <link rel="modulepreload" crossorigin href="/assets/Trans-BbFxRFtR.js">
+    <link rel="modulepreload" crossorigin href="/assets/useDesktop-BjLT0_EE.js">
     <link rel="modulepreload" crossorigin href="/assets/provider-capabilities-lePfeT_Y.js">
     <link rel="modulepreload" crossorigin href="/assets/save-LmPSfsvZ.js">
-    <link rel="modulepreload" crossorigin href="/assets/spending-eWiZGhC_.js">
+    <link rel="modulepreload" crossorigin href="/assets/spending-CQnrWiR3.js">
     <link rel="modulepreload" crossorigin href="/assets/chevron-up-6EFqEHBj.js">
     <link rel="modulepreload" crossorigin href="/assets/sparkles-CCfUdFGY.js">
     <link rel="modulepreload" crossorigin href="/assets/x-Bu7X_eR2.js">
-    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-BHIUPVmC.js">
+    <link rel="modulepreload" crossorigin href="/assets/MinimizedChatsContext-DHfigjHS.js">
     <link rel="modulepreload" crossorigin href="/assets/ban-wqfdzoXt.js">
     <link rel="modulepreload" crossorigin href="/assets/file-text-C0blZHLh.js">
     <link rel="modulepreload" crossorigin href="/assets/circle-x-D2ttKotB.js">
@@ -268,21 +268,21 @@
     <link rel="modulepreload" crossorigin href="/assets/search-BDVp3fkH.js">
     <link rel="modulepreload" crossorigin href="/assets/trash-D8zYUmTg.js">
     <link rel="modulepreload" crossorigin href="/assets/triangle-alert-Cxpn8bqr.js">
-    <link rel="modulepreload" crossorigin href="/assets/jira-api-C_D_RDhl.js">
+    <link rel="modulepreload" crossorigin href="/assets/jira-api-Cabj-H0J.js">
     <link rel="modulepreload" crossorigin href="/assets/zap-bugHyWzQ.js">
     <link rel="modulepreload" crossorigin href="/assets/clsx-CjueKrWZ.js">
     <link rel="modulepreload" crossorigin href="/assets/utils-BC4DHlz2.js">
     <link rel="modulepreload" crossorigin href="/assets/dialog-DtdR05v1.js">
     <link rel="modulepreload" crossorigin href="/assets/lib-DWJfei6y.js">
-    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-62h40I4t.js">
-    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-CdN5lTyD.js">
+    <link rel="modulepreload" crossorigin href="/assets/getTimezoneOffsetInMilliseconds-vJ7qUoqN.js">
+    <link rel="modulepreload" crossorigin href="/assets/formatDistanceToNow-NjPHBLfB.js">
     <link rel="modulepreload" crossorigin href="/assets/button-4FS1ZDTp.js">
-    <link rel="modulepreload" crossorigin href="/assets/project-repositories-Be0CWklo.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-DeCoUsRN.js">
-    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-DiPngt2g.js">
+    <link rel="modulepreload" crossorigin href="/assets/project-repositories-Cnnuj9Ia.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryScopeSelector-2eSqR9WK.js">
+    <link rel="modulepreload" crossorigin href="/assets/TicketDetailModalContext-Dkwo2cDs.js">
     <link rel="modulepreload" crossorigin href="/assets/core-B3mKBIh5.js">
-    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-DAIxIYsl.js">
-    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-B1a6GChu.js">
+    <link rel="modulepreload" crossorigin href="/assets/RepositoryDeliveries-B4ybHOyB.js">
+    <link rel="modulepreload" crossorigin href="/assets/useRuntimeRuns-C97qEqMg.js">
     <link rel="modulepreload" crossorigin href="/assets/event-Bt7f3wXe.js">
     <link rel="stylesheet" crossorigin href="/assets/index-BgbCbIua.css">
   </head>

package/docs/internals/api-reference.md

@@ -127,6 +127,32 @@ Loopback-only admin surface for the Mobile Gateway (the gateway itself is a sepa
 | `GET` | `/devices` | List paired devices |
 | `DELETE` | `/devices/:id` | Revoke a paired device |
 | `POST` | `/cert/rotate` | Rotate the gateway TLS identity (unpairs every device) |
+| `GET` | `/previews` | Live Companion app previews (`{ previews: [{ projectId, projectName, sessionId, deviceId, deviceName, url, title, createdAt }] }`) |
+| `DELETE` | `/previews/:projectId/:sessionId` | End a device-owned preview from Desktop (`{ ok }`; Desktop sessions are never affected) |
+
+Revoking a device also ends its previews. The app-level WS event `mobile.previews_changed` (no `projectId`) tells Settings ▸ Mobile to refetch the list.
+
+#### Companion app preview (gateway `/v1`)
+
+A paired Companion views a project's locally served web app through a device-owned server-side browser session. The routes require the mission grant (all-projects device) and the `appPreview` capability (`GET /v1/capabilities` → `features.appPreview`, true when browser capture is enabled).
+
+| Method | Path | Notes |
+|--------|------|-------|
+| `GET` | `/v1/projects/:pid/missions/:cid/preview-targets` | `{ targets: [{ processId, urls }] }`: local URLs announced in the logs of the mission's running background processes |
+| `POST` | `/v1/projects/:pid/preview-sessions` | Body `{ missionId, processId, url, viewport? }`; `url` must be announced by that process. `201 { sessionId, channel, url }` |
+| `POST` | `/v1/projects/:pid/preview-sessions/:sid/attach` | Re-attach after a reconnect: `{ sessionId, channel }` (a new DataChannel replaces the old one) |
+| `POST` | `/v1/projects/:pid/preview-sessions/:sid/navigate` | Body `{ action: goto\|back\|forward\|reload, url? }`; `goto` accepts only paths on announced origins |
+| `DELETE` | `/v1/projects/:pid/preview-sessions/:sid` | End the device's own preview |
+
+Errors carry `{ error, code }`. Codes: `preview_unavailable` (404), `preview_target_gone` (404), `preview_session_closed` (404), `preview_url_not_announced` (400), `preview_limit` (429), `preview_requires_webrtc` (409), `preview_failed` (502). Sessions owned by Desktop or by another device are reported as `preview_session_closed`.
+
+**Channel.** `channel` is the label of an ordered, reliable DataChannel (`preview:<sessionId>`) that Desktop opens on the device's existing WebRTC peer without renegotiation:
+
+- **Desktop → Companion, text:** JSON control: `ready` (`{ id, url, title, viewport }`), `nav`, `popup`, `closed` (`{ reason }`) and `nav_rejected`.
+- **Desktop → Companion, binary:** JPEG screencast frames in fragments of at most 16 000 bytes. Each fragment starts with an 8-byte big-endian header `u32 frameSeq | u16 index | u16 count`. Render a frame only when all of its fragments have arrived. A newer `frameSeq` discards an incomplete older frame.
+- **Companion → Desktop:** JSON `{ type: 'input', event }` (mouse / wheel / key / resize, validated) and `{ type: 'navigate', action, url? }`, rate-limited to 6 000 messages per minute.
+
+**Origin policy.** A device session may load a loopback origin only while a running background process of the project announces it. Every other request passes the regular server-side SSRF guard. Device sessions have their own budget: one per device (opening a new one replaces it) and two per project. They never count against Desktop's four sessions.
 
 ### specrails-tech proxy
 

package/docs/internals/core-runtime-updates.md

@@ -13,7 +13,7 @@ framework is rejected rather than silently replacing an update.
 
 ## Persistence and publication
 
-The release bundle pins Core 6.6.3 in `desktop-release.yml` and
+The release bundle pins Core 6.6.4 in `desktop-release.yml` and
 `scripts/assemble-bundled-core.lock.json`. Core 6 is the Desktop-only engine: it
 publishes integration contract 5.1 (no standalone `update`) and ships only the
 implement and retry workflows (Batch was folded into implement; Desktop no
@@ -27,8 +27,8 @@ dependency leaks into its tarball (today `@langchain/langgraph-sdk` ships
 module still loads while every staged path stays inside the MSI budget
 (`MAX_STAGED_RELATIVE_PATH`, 120 characters).
 
-The paired CI checkout uses the immutable Core 6.6.3 release commit
-`a8bc8181a206ea9630ae3b02e6198f8519d35604`. Bundle smoke checks use Node 22.22.3,
+The paired CI checkout uses the immutable Core 6.6.4 release commit
+`f4504178c8c39ff648e6df58f043d7c2ea39ef67`. Bundle smoke checks use Node 22.22.3,
 matching Core's minimum supported Node version and the Desktop release runtime.
 
 Desktop updates retain the complete npm installation, including dependencies,

package/docs/internals/source-map.md

@@ -5,7 +5,7 @@ architectural dependency declaration. Search a heading or filename and read only
 the relevant source and tests. Feature prefixes group the legacy server files;
 new bounded modules live under `server/modules/`.
 
-Includes 1046 source/build files. Nearby tests are linked where names
+Includes 1050 source/build files. Nearby tests are linked where names
 match; integration suites may live elsewhere. Use `rg` to find other consumers.
 
 ## cli
@@ -1057,6 +1057,8 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [mobile-event-bus.ts](../../server/mobile/mobile-event-bus.ts)
 - [mobile-gateway.ts](../../server/mobile/mobile-gateway.ts) · [test](../../server/mobile/mobile-gateway.test.ts)
 - [mobile-missions.ts](../../server/mobile/mobile-missions.ts) · [test](../../server/mobile/mobile-missions.test.ts)
+- [mobile-preview-channel.ts](../../server/mobile/mobile-preview-channel.ts) · [test](../../server/mobile/mobile-preview-channel.test.ts)
+- [mobile-preview.ts](../../server/mobile/mobile-preview.ts) · [test](../../server/mobile/mobile-preview.test.ts)
 - [mobile-redact.ts](../../server/mobile/mobile-redact.ts) · [test](../../server/mobile/mobile-redact.test.ts)
 - [mobile-router.ts](../../server/mobile/mobile-router.ts) · [test](../../server/mobile/mobile-router.test.ts)
 - [mobile-signal-reconnect.ts](../../server/mobile/mobile-signal-reconnect.ts) · [test](../../server/mobile/mobile-signal-reconnect.test.ts)
@@ -1148,6 +1150,10 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [profile-manager.ts](../../server/modules/agents/runtime/profile-manager.ts) · [test](../../server/modules/agents/runtime/profile-manager.test.ts)
 - [profiles-router.ts](../../server/modules/agents/runtime/profiles-router.ts) · [test](../../server/modules/agents/runtime/profiles-router.test.ts)
 
+## server/modules/browser/domain
+
+- [preview-origins.ts](../../server/modules/browser/domain/preview-origins.ts) · [test](../../server/modules/browser/domain/preview-origins.test.ts)
+
 ## server/modules/browser/runtime
 
 - [browser-capture-manager.ts](../../server/modules/browser/runtime/browser-capture-manager.ts) · [test](../../server/modules/browser/runtime/browser-capture-manager.test.ts)
@@ -1156,6 +1162,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 - [browser-network.ts](../../server/modules/browser/runtime/browser-network.ts) · [test](../../server/modules/browser/runtime/browser-network.test.ts)
 - [browser-playwright.ts](../../server/modules/browser/runtime/browser-playwright.ts) · [test](../../server/modules/browser/runtime/browser-playwright.test.ts)
 - [browser-viewport.ts](../../server/modules/browser/runtime/browser-viewport.ts) · [test](../../server/modules/browser/runtime/browser-viewport.test.ts)
+- [preview-targets.ts](../../server/modules/browser/runtime/preview-targets.ts) · [test](../../server/modules/browser/runtime/preview-targets.test.ts)
 
 ## server/modules/builder/runtime
 
@@ -1406,7 +1413,7 @@ match; integration suites may live elsewhere. Use `rg` to find other consumers.
 ## server/modules/terminals/runtime
 
 - [background-process-control.ts](../../server/modules/terminals/runtime/background-process-control.ts) · [test](../../server/modules/terminals/runtime/background-process-control.test.ts)
-- [background-process-service.ts](../../server/modules/terminals/runtime/background-process-service.ts)
+- [background-process-service.ts](../../server/modules/terminals/runtime/background-process-service.ts) · [test](../../server/modules/terminals/runtime/background-process-service.test.ts)
 - [background-process-store.ts](../../server/modules/terminals/runtime/background-process-store.ts) · [test](../../server/modules/terminals/runtime/background-process-store.test.ts)
 - [background-windows-bootstrap.ts](../../server/modules/terminals/runtime/background-windows-bootstrap.ts) · [test](../../server/modules/terminals/runtime/background-windows-bootstrap.test.ts)
 - [terminal-manager.ts](../../server/modules/terminals/runtime/terminal-manager.ts) · [test](../../server/modules/terminals/runtime/terminal-manager.test.ts)