specrails-desktop 2.64.2 → 2.65.0

package/server/dist/mcp/tools/support.js

@@ -30,7 +30,7 @@ function supportTools() {
             name: 'specrails_support',
             title: 'Support & troubleshooting',
             description: 'Support and troubleshooting for Specrails installation and usage problems. Use this when the user needs help setting up Specrails, adding/provisioning a project, fixing missing agents/skills/commands from the global specrails-core framework, provider CLI/MCP/agent-chat issues, rails/jobs/specs, or GitHub/PR/cost/plugin questions. ' +
-                'Actions: triage (read-only support playbook + diagnostics), core_update_status/check/apply (global specrails-core framework update). ' +
+                'Actions: triage (read-only support playbook + diagnostics), core_update_status/check/apply (global specrails-core framework update; follows the app update channel latest|stable), api_meta (API/app/Core/contract versions and update channel). ' +
                 'This tool never creates specs; repair actions require the normal permission tier and explicit user confirmation.',
             tier: (a) => (String(a.action) === 'core_update_apply' ? 'ai-spawn' : 'read'),
             hintTier: 'read',
@@ -41,6 +41,7 @@ function supportTools() {
                     'core_update_status',
                     'core_update_check',
                     'core_update_apply',
+                    'api_meta',
                 ])
                     .describe('Support operation to perform'),
                 question: zod_1.z
@@ -69,6 +70,8 @@ function supportTools() {
                 switch (action) {
                     case 'core_update_status':
                         return (0, types_1.apiCall)(ctx, 'GET', '/core-update/status');
+                    case 'api_meta':
+                        return (0, types_1.apiCall)(ctx, 'GET', '/meta');
                     case 'core_update_check':
                         return (0, types_1.apiCall)(ctx, 'POST', '/core-update/check', {});
                     case 'core_update_apply': {
@@ -239,7 +242,7 @@ function nextSteps(topic) {
                 'For specrails-core installation questions, evaluate only global core status and prerequisites. Do not treat project setup checkpoints as evidence of a core problem.',
                 'If global core status is current/healthy and the user has not provided an actual job error, say the core installation looks healthy and ask for the concrete failing job/error before recommending repair.',
                 'If a job explicitly reports missing agents, missing skills, unresolved slash commands, or missing /specrails:* commands, explain that those definitions come from the app-global specrails-core framework.',
-                'If an update is available, offer core_update_check followed by core_update_apply with confirmation. If no update is available but the job still fails with missing core definitions, give the manual fallback: run `npx specrails-core@latest update` from the project root, then retry, or collect the job diagnostic for a framework-loading bug.',
+                'If an update is available, offer core_update_check followed by core_update_apply with confirmation. If no update is available but the job still fails with missing core definitions, do not suggest a CLI command (Core 6 has no standalone `update`): collect the job diagnostic (specrails_jobs diagnostic) and report it as a framework-loading bug. A human can re-check and apply Core updates from Settings → Updates in the app.',
                 'Never recommend specrails_setup(install) or a project reinstall solely because setup/checkpoints show pending or 0 agents/commands.',
             ];
         case 'rails_jobs':
@@ -315,7 +318,7 @@ function repairActions(topic) {
     if (topic === 'framework_install') {
         return [
             'specrails_support(core_update_check) then specrails_support(core_update_apply) - apply requires operate/ai-spawn and only makes sense when a newer global specrails-core framework is available.',
-            'Manual fallback when no update is available but a real job still cannot load core definitions: run `npx specrails-core@latest update` from the project root, then retry or collect a job diagnostic.',
+            'When no update is available but a real job still cannot load core definitions: collect a job diagnostic (specrails_jobs diagnostic) and report a framework-loading bug. Humans use Settings → Updates in the app; Core 6 has no standalone `update` command.',
         ];
     }
     if (topic !== 'project_setup' && topic !== 'installation')

package/server/dist/mcp/tools/types.js

@@ -10,6 +10,7 @@ exports.requireProject = requireProject;
 exports.setActiveProject = setActiveProject;
 exports.getActiveProject = getActiveProject;
 exports.toolTierAllowed = toolTierAllowed;
+exports.recordMissionMcpAction = recordMissionMcpAction;
 exports.registerTieredTool = registerTieredTool;
 const mcp_tiers_1 = require("../mcp-tiers");
 const internal_api_1 = require("../../internal-api");
@@ -197,6 +198,40 @@ function emitMcpActivity(ctx, spec, args, tier) {
         /* a notification failure must never fail the tool */
     }
 }
+/**
+ * Agent actions audit for first-party mission agents: one `mcp` row per
+ * admitted tool call, in the capability's project, run id = the mission
+ * conversation. Only the tool and its action are stored — never arguments.
+ * Observing only: a missing project or a failing sink never affects the call.
+ */
+function recordMissionMcpAction(ctx, toolName, args) {
+    try {
+        const projectId = ctx.requestProjectId;
+        const conversationId = ctx.originConversationId;
+        if (!projectId || !conversationId)
+            return;
+        const recorder = ctx.registry.getContext(projectId)?.agentAudit?.recorder;
+        if (!recorder)
+            return;
+        const action = typeof args.action === 'string' && /^[a-z0-9_.-]{1,64}$/i.test(args.action) ? args.action : null;
+        recorder.record({
+            runId: conversationId,
+            role: 'mission',
+            kind: 'mcp',
+            target: action ? `${toolName}:${action}` : toolName,
+            source: 'mcp-wrapper',
+        });
+    }
+    catch { /* audit is observing only */ }
+}
+function admittedByException(spec, ctx, args) {
+    try {
+        return spec.tierException?.(ctx, args) === true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Registers a tool on the McpServer, wrapping the handler with (1) tier
  * enforcement and (2) uniform success/error result shaping. No tool can forget
@@ -236,9 +271,11 @@ function registerTieredTool(server, ctx, spec) {
             : { ...ctx };
         callCtx.signal = extra?.signal;
         const tier = typeof spec.tier === 'function' ? spec.tier(args ?? {}) : spec.tier;
-        if (!toolTierAllowed(callCtx, tier)) {
+        if (!toolTierAllowed(callCtx, tier) && !(callCtx.firstPartyAgent && admittedByException(spec, callCtx, args ?? {}))) {
             return errorResult((0, mcp_tiers_1.tierRefusalMessage)(tier));
         }
+        if (capability)
+            recordMissionMcpAction(callCtx, spec.name, args ?? {});
         const operation = async () => {
             try {
                 const data = await spec.handler(callCtx, args ?? {});

package/server/dist/mobile/mobile-admin-router.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMobileAdminRouter = createMobileAdminRouter;
 const express_1 = require("express");
 const mobile_devices_1 = require("./mobile-devices");
-const desktop_db_1 = require("../desktop-db");
 const DEVICE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;
 function createMobileAdminRouter(deps) {
     const router = (0, express_1.Router)();
@@ -38,25 +37,10 @@ function createMobileAdminRouter(deps) {
         const changed = (0, mobile_devices_1.revokeDevice)(desktopDb, id);
         if (changed) {
             gateway.bridge?.closeForDevice(id);
-            void gateway.closePreviewsForDevice(id).catch(() => { });
             deps.broadcast({ type: 'mobile.device_revoked', deviceId: id, timestamp: new Date().toISOString() });
         }
         res.json({ ok: changed });
     });
-    // —— Companion app previews (Desktop indicator) ——
-    router.get('/previews', (_req, res) => {
-        const previews = gateway.preview?.listDeviceSessions() ?? [];
-        res.json({ previews: previews.map((p) => ({ ...p, projectName: (0, desktop_db_1.getProject)(desktopDb, p.projectId)?.name ?? p.projectId })) });
-    });
-    router.delete('/previews/:projectId/:sessionId', async (req, res) => {
-        const projectId = typeof req.params.projectId === 'string' ? req.params.projectId : '';
-        const sessionId = typeof req.params.sessionId === 'string' ? req.params.sessionId : '';
-        if (!/^[A-Za-z0-9_-]{1,160}$/.test(projectId) || !/^[A-Za-z0-9_-]{1,160}$/.test(sessionId)) {
-            res.status(400).json({ error: 'Invalid parameter' });
-            return;
-        }
-        res.json({ ok: (await gateway.preview?.endFromDesktop(projectId, sessionId)) ?? false });
-    });
     router.post('/cert/rotate', async (_req, res) => {
         const status = await gateway.rotateCert();
         res.json(status);

package/server/dist/mobile/mobile-gateway.js

@@ -17,7 +17,6 @@ const mobile_webrtc_peer_1 = require("./mobile-webrtc-peer");
 const mobile_signal_reconnect_1 = require("./mobile-signal-reconnect");
 const mobile_webrtc_1 = require("./mobile-webrtc");
 const agent_store_1 = require("../modules/agents/runtime/agent-store");
-const mobile_preview_1 = require("./mobile-preview");
 // Lifecycle owner of the second HTTPS+WSS listener (default :4202), hard-isolated
 // from the main server. Off by default; started on enable or boot-if-enabled.
 const DEFAULT_PORT = 4202;
@@ -48,28 +47,12 @@ class MobileGateway {
     _running = false;
     _boundPort = DEFAULT_PORT;
     _portOverride;
-    _preview;
     constructor(deps) {
         this._db = deps.desktopDb;
         this._desktopPort = deps.desktopPort;
         this._broadcast = deps.broadcast;
         this._bindHost = deps.bindHost ?? '0.0.0.0';
         this._portOverride = deps.port;
-        this._preview = deps.preview
-            ? new mobile_preview_1.MobilePreviewService({
-                ...deps.preview,
-                openChannel: (deviceId, label) => this._webrtc?.openChannel(deviceId, label) ?? null,
-                onChange: () => this._broadcast({ type: 'mobile.previews_changed', timestamp: new Date().toISOString() }),
-            })
-            : null;
-    }
-    get preview() {
-        return this._preview;
-    }
-    /** A revoked device loses its peer mapping and every preview it owns. */
-    async closePreviewsForDevice(deviceId) {
-        this._webrtc?.forgetDevice(deviceId);
-        await this._preview?.closeForDevice(deviceId);
     }
     get bridge() {
         return this._bridge;
@@ -156,7 +139,6 @@ class MobileGateway {
             db: this._db,
             desktopPort: this._desktopPort,
             currentFingerprint: () => this._cert.fingerprint,
-            ...(this._preview ? { preview: this._preview } : {}),
         }));
         const server = https_1.default.createServer({ cert: this._cert.certPem, key: this._cert.keyPem }, app);
         // BUG-MOBILE-02: scope each socket's subscribe to the device's granted

package/server/dist/mobile/mobile-inbox.js

@@ -0,0 +1,240 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPANION_ACTION_TIERS = exports.COMPANION_ACTIONS = void 0;
+exports.companionTargetsFor = companionTargetsFor;
+exports.companionView = companionView;
+exports.createMobileInboxRouter = createMobileInboxRouter;
+const express_1 = require("express");
+const mcp_tiers_1 = require("../mcp/mcp-tiers");
+const mobile_devices_1 = require("./mobile-devices");
+const mobile_redact_1 = require("./mobile-redact");
+/**
+ * The paired companion as a decision remote for the "Needs you" inbox.
+ *
+ * Read: `GET /v1/inbox` is the desktop read-model, narrowed to the device's
+ * project grant, with the SAFE actions each row offers right now.
+ *
+ * Act: a closed set of four actions, each forwarded to the very route the
+ * desktop UI uses, addressed to ONE project and tier-checked with the MCP
+ * permission tiers (so turning a tier off in Settings ▸ MCP also turns the
+ * action off on the phone). Everything else (merge, discard, force-push,
+ * settings, delete) has no route here and the catch-all refuses it.
+ */
+/** Actions a companion may run. Anything else is desktop-only. */
+exports.COMPANION_ACTIONS = ['answer', 'resume', 'retry', 'create-pr'];
+/**
+ * Tier per action. Answering only continues work the person already started
+ * (write); resume and retry spend tokens (ai-spawn); a draft PR pushes a branch
+ * to the remote, an external-system mutation (destructive, as in the MCP tiers).
+ */
+exports.COMPANION_ACTION_TIERS = {
+    answer: 'write',
+    resume: 'ai-spawn',
+    retry: 'ai-spawn',
+    'create-pr': 'destructive',
+};
+const NOT_PRIMARY = new Set(['open-logs', 'edit-spec']);
+/** The first remedy a phone can act on, mirroring the desktop's ranking (open-logs / edit-spec need the desk). */
+function primaryRemedy(item) {
+    const remedies = item.diagnosis?.remedies ?? [];
+    return remedies.find((remedy) => !NOT_PRIMARY.has(remedy)) ?? null;
+}
+/** Which safe actions an item offers, and the identities the phone posts back. Pure. */
+function companionTargetsFor(item) {
+    const none = { ids: [], target: {} };
+    if (item.action === 'raise-cap' || item.action === 'retry-jira')
+        return none;
+    if (item.kind === 'question')
+        return { ids: ['answer'], target: { runId: item.subjectId } };
+    if (item.action === 'resume-run')
+        return { ids: ['resume'], target: { runId: item.subjectId } };
+    if (item.kind === 'review') {
+        return item.decision === 'on_review'
+            ? { ids: ['create-pr'], target: { expectedDecision: 'on_review' } }
+            : none;
+    }
+    if (item.kind === 'failed' || item.kind === 'blocked') {
+        const primary = primaryRemedy(item);
+        const isRun = item.action === 'open-run';
+        if (primary === 'resume' && isRun)
+            return { ids: ['resume'], target: { runId: item.subjectId } };
+        if (primary === 'retry' && typeof item.railIndex === 'number') {
+            return { ids: ['retry'], target: { sourceId: isRun ? `run:${item.subjectId}` : item.subjectId, railIndex: item.railIndex } };
+        }
+    }
+    return none;
+}
+function companionView(db, item) {
+    const { ids, target } = companionTargetsFor(item);
+    return {
+        actions: ids.map((id) => ({ id, tier: exports.COMPANION_ACTION_TIERS[id], enabled: (0, mcp_tiers_1.isTierEnabled)(db, exports.COMPANION_ACTION_TIERS[id]) })),
+        ...target,
+    };
+}
+const PID = /^[A-Za-z0-9_-]{1,64}$/;
+const RUN_ID = /^[A-Za-z0-9-]{1,128}$/;
+const SOURCE_ID = /^(?:run:)?[A-Za-z0-9-]{1,128}$/;
+const MAX_ANSWER = 20_000;
+const MAX_RUN_CAP_USD = 10_000;
+const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const pick = (value, keys) => Object.fromEntries(Object.entries(record(value)).filter(([key]) => keys.includes(key)));
+function createMobileInboxRouter({ db, upstream }) {
+    const router = (0, express_1.Router)();
+    const seg = (value) => (typeof value === 'string' ? value : '');
+    const send = async (res, method, path, body, shape) => {
+        try {
+            const result = await upstream(method, path, body);
+            const ok = result.status >= 200 && result.status < 300;
+            res.status(result.status).json((0, mobile_redact_1.redact)(ok && shape ? shape(result.json) : result.json));
+        }
+        catch {
+            res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
+        }
+    };
+    /** 403 unless the action's permission tier is on. */
+    const tierGate = (res, action) => {
+        const tier = exports.COMPANION_ACTION_TIERS[action];
+        if ((0, mcp_tiers_1.isTierEnabled)(db, tier))
+            return true;
+        res.status(403).json({ error: 'tier_disabled', tier, action });
+        return false;
+    };
+    const base = (pid) => `/api/projects/${encodeURIComponent(pid)}`;
+    router.get('/inbox', async (req, res) => {
+        const allowed = (0, mobile_devices_1.getAllowedProjects)(db, req.mobileDevice.id);
+        try {
+            const result = await upstream('GET', '/api/inbox');
+            if (result.status !== 200) {
+                res.status(result.status).json((0, mobile_redact_1.redact)(result.json));
+                return;
+            }
+            const snapshot = record(result.json);
+            const visible = (projectId) => typeof projectId === 'string' && (allowed === null || allowed.has(projectId));
+            const items = (Array.isArray(snapshot.items) ? snapshot.items : [])
+                .filter((item) => visible(record(item).projectId))
+                .map((item) => ({ ...item, companion: companionView(db, item) }));
+            const projects = (Array.isArray(snapshot.projects) ? snapshot.projects : []).filter((p) => visible(record(p).projectId));
+            res.json((0, mobile_redact_1.redact)({ items, projects, generatedAt: snapshot.generatedAt }));
+        }
+        catch {
+            res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
+        }
+    });
+    // The question a paused run is waiting on (the Answer sheet shows it verbatim).
+    router.get('/projects/:pid/inbox/runs/:runId/question', async (req, res) => {
+        const pid = seg(req.params.pid), runId = seg(req.params.runId);
+        if (!PID.test(pid) || !RUN_ID.test(runId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        await send(res, 'GET', `${base(pid)}/agent-runtime/runs/${encodeURIComponent(runId)}`, undefined, (json) => {
+            const run = record((Array.isArray(record(json).runs) ? record(json).runs : [])[0]);
+            const question = record(run.pendingQuestion);
+            return typeof question.question === 'string'
+                ? { pending: true, question: question.question, requestedAt: question.requestedAt ?? null }
+                : { pending: false };
+        });
+    });
+    // Answer agent question: the desktop's run "Answer" (runtime resume with an answer).
+    router.post('/projects/:pid/inbox/answer', async (req, res) => {
+        const pid = seg(req.params.pid), body = record(req.body), runId = seg(body.runId), answer = body.answer;
+        if (!PID.test(pid) || !RUN_ID.test(runId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        if (typeof answer !== 'string' || !answer.trim() || answer.length > MAX_ANSWER) {
+            res.status(400).json({ error: `An answer of 1–${MAX_ANSWER} characters is required` });
+            return;
+        }
+        if (!tierGate(res, 'answer'))
+            return;
+        let run;
+        try {
+            const status = await upstream('GET', `${base(pid)}/agent-runtime/runs/${encodeURIComponent(runId)}`);
+            if (status.status !== 200) {
+                res.status(status.status).json((0, mobile_redact_1.redact)(status.json));
+                return;
+            }
+            run = record((Array.isArray(record(status.json).runs) ? record(status.json).runs : [])[0]);
+        }
+        catch {
+            res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
+            return;
+        }
+        const question = record(run.pendingQuestion);
+        if (typeof question.question !== 'string' || question.answeredAt !== undefined) {
+            res.status(409).json({ error: 'no_pending_question' });
+            return;
+        }
+        const definition = run.engineVersion === 2;
+        const path = definition
+            ? `${base(pid)}/loop-runs/${encodeURIComponent(runId)}/resume`
+            : `${base(pid)}/agent-runtime/runs/${encodeURIComponent(runId)}/resume`;
+        await send(res, 'POST', path, { answer: answer.trim(), ...(definition && typeof question.stepId === 'string' ? { interruptId: question.stepId } : {}) });
+    });
+    // Resume a budget/limit-paused or interrupted run; a run paused at its per-run cap takes the person's choice.
+    router.post('/projects/:pid/inbox/resume', async (req, res) => {
+        const pid = seg(req.params.pid), body = record(req.body), runId = seg(body.runId);
+        if (!PID.test(pid) || !RUN_ID.test(runId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        const narrowed = {};
+        if (body.runCap !== undefined) {
+            if (body.runCap !== 'ignore') {
+                res.status(400).json({ error: 'runCap must be "ignore"' });
+                return;
+            }
+            narrowed.runCap = 'ignore';
+        }
+        if (body.runCapUsd !== undefined) {
+            if (typeof body.runCapUsd !== 'number' || !Number.isFinite(body.runCapUsd) || body.runCapUsd <= 0 || body.runCapUsd > MAX_RUN_CAP_USD) {
+                res.status(400).json({ error: 'runCapUsd must be a positive amount' });
+                return;
+            }
+            if (narrowed.runCap) {
+                res.status(400).json({ error: 'Choose ignore or raise, not both' });
+                return;
+            }
+            narrowed.runCapUsd = body.runCapUsd;
+        }
+        if (!tierGate(res, 'resume'))
+            return;
+        await send(res, 'POST', `${base(pid)}/loop-runs/${encodeURIComponent(runId)}/resume`, narrowed);
+    });
+    // Retry the failed attempt: the cockpit's relaunch of the same rail, same source.
+    router.post('/projects/:pid/inbox/retry', async (req, res) => {
+        const pid = seg(req.params.pid), body = record(req.body), sourceId = seg(body.sourceId), railIndex = body.railIndex;
+        if (!PID.test(pid) || !SOURCE_ID.test(sourceId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        if (typeof railIndex !== 'number' || !Number.isSafeInteger(railIndex) || railIndex < 0 || railIndex > 1000) {
+            res.status(400).json({ error: 'Invalid rail' });
+            return;
+        }
+        if (!tierGate(res, 'retry'))
+            return;
+        await send(res, 'POST', `${base(pid)}/rails/${railIndex}/relaunch`, { sourceId });
+    });
+    // Create draft PR: the PR decision, narrowed to create-pr on a delivery that is still on review.
+    router.post('/projects/:pid/inbox/create-pr', async (req, res) => {
+        const pid = seg(req.params.pid), body = record(req.body), prDeliveryId = seg(body.prDeliveryId);
+        if (!PID.test(pid) || !RUN_ID.test(prDeliveryId)) {
+            res.status(400).json({ error: 'Invalid parameter' });
+            return;
+        }
+        if (body.expectedDecision !== 'on_review') {
+            res.status(400).json({ error: 'expectedDecision must be on_review' });
+            return;
+        }
+        if (!tierGate(res, 'create-pr'))
+            return;
+        await send(res, 'POST', `${base(pid)}/rails/pr-decision`, { prDeliveryId, action: 'create-pr', expectedDecision: 'on_review' }, (json) => pick(json, ['ok', 'decision', 'prUrl', 'prState', 'detail']));
+    });
+    // Deny by name, not by silence: merge, discard, publish, force-push, settings, delete.
+    router.all('/projects/:pid/inbox/:action', (_req, res) => {
+        res.status(403).json({ error: 'action_not_allowed_for_companion', detail: 'This decision stays on Desktop.' });
+    });
+    return router;
+}

package/server/dist/mobile/mobile-missions.js

@@ -16,11 +16,9 @@ const record = (value) => value && typeof value === 'object' && !Array.isArray(v
 const pick = (value, keys) => Object.fromEntries(Object.entries(record(value)).filter(([key]) => keys.includes(key)));
 exports.MOBILE_PROTOCOL_VERSION = 2;
 exports.MISSION_ACCESS_REASON = 'Mission agents can access more than their pinned project. Missions require an all-projects device grant; your permitted Specs and Rails remain available.';
-function mobileCapabilities(db, deviceId, opts = {}) {
+function mobileCapabilities(db, deviceId) {
     const missions = process.env.SPECRAILS_AGENT_CHAT !== 'false' && (0, mobile_devices_1.getAllowedProjects)(db, deviceId) === null;
-    // App preview targets come from mission processes, so it inherits the
-    // mission grant and additionally needs Desktop's browser capture.
-    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)(), appPreview: missions && opts.appPreview === true },
+    return { protocolVersion: exports.MOBILE_PROTOCOL_VERSION, features: { missions, missionControl: missions, missionQueue: missions, missionProcesses: missions, repositories: true, codeExplorer: (0, feature_flags_1.isCodeExplorerEnabled)(), missionRailCards: missions && (0, feature_flags_1.isMissionRailCardsEnabled)() },
         ...(!missions ? { missionsUnavailableReason: process.env.SPECRAILS_AGENT_CHAT === 'false' ? 'Missions are disabled on Desktop.' : exports.MISSION_ACCESS_REASON } : {}) };
 }
 function conversationView(value) {
@@ -74,7 +72,7 @@ function missionSnapshot(value) {
         pendingMessages, pendingTruncated: pending.length > 50,
         live: { ...pick(live, ['isStreaming', 'startedAt']), streamingText, textTruncated: streamingText.length < liveRaw.length } };
 }
-function createMobileMissionsRouter({ db, upstream, appPreview }) {
+function createMobileMissionsRouter({ db, upstream }) {
     const router = (0, express_1.Router)();
     const segment = (value) => typeof value === 'string' ? value : '';
     const send = async (res, method, path, body, shape) => {
@@ -86,7 +84,7 @@ function createMobileMissionsRouter({ db, upstream, appPreview }) {
             res.status(502).json({ error: 'Desktop is unreachable. Retry when connected.' });
         }
     };
-    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id, { appPreview: appPreview?.() ?? false })));
+    router.get('/capabilities', (req, res) => res.json(mobileCapabilities(db, req.mobileDevice.id)));
     router.get('/mission-models', (req, res) => {
         const provider = segment(req.query.provider);
         if (!/^[a-z0-9_-]{1,40}$/.test(provider)) {
@@ -129,7 +127,7 @@ function createMobileMissionsRouter({ db, upstream, appPreview }) {
             return null;
         }
         const conversation = (0, agent_store_1.getAgentConversation)(db, cid);
-        if (!conversation || conversation.pinned_project_id !== pid) {
+        if (!conversation || conversation.deleted_at || conversation.pinned_project_id !== pid) {
             res.status(404).json({ error: 'Mission not found in this project' });
             return null;
         }
@@ -144,7 +142,7 @@ function createMobileMissionsRouter({ db, upstream, appPreview }) {
         }
         // Query the project before applying the limit: active projects must not
         // disappear behind another project's most recent conversations.
-        const rows = db.prepare('SELECT id FROM agent_conversations WHERE pinned_project_id = ? ORDER BY updated_at DESC, id DESC LIMIT ?').all(pid, rawLimit + 1);
+        const rows = db.prepare('SELECT id FROM agent_conversations WHERE pinned_project_id = ? AND deleted_at IS NULL ORDER BY updated_at DESC, id DESC LIMIT ?').all(pid, rawLimit + 1);
         try {
             const active = await upstream('GET', '/api/agent/active-turns');
             if (active.status !== 200) {

package/server/dist/mobile/mobile-router.js

@@ -9,7 +9,7 @@ const mobile_auth_1 = require("./mobile-auth");
 const mobile_devices_1 = require("./mobile-devices");
 const mobile_missions_1 = require("./mobile-missions");
 const mobile_code_1 = require("./mobile-code");
-const mobile_preview_1 = require("./mobile-preview");
+const mobile_inbox_1 = require("./mobile-inbox");
 // The gateway's authenticated REST surface: the `/v1/*` allow-list. Each route
 // forwards, in-process, via a REAL loopback HTTP request to
 // http://127.0.0.1:<desktopPort> with the master token injected server-side as
@@ -456,10 +456,9 @@ function createMobileRouter(deps) {
             ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
         return { status: response.status, json: await response.json() };
     };
-    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: mobileUpstream, appPreview: () => deps.preview?.available() ?? false }));
-    if (deps.preview)
-        v1.use((0, mobile_preview_1.createMobilePreviewRouter)({ db: deps.db, preview: deps.preview }));
+    v1.use((0, mobile_missions_1.createMobileMissionsRouter)({ db: deps.db, upstream: mobileUpstream }));
     v1.use((0, mobile_code_1.createMobileCodeRouter)(mobileUpstream));
+    v1.use((0, mobile_inbox_1.createMobileInboxRouter)({ db: deps.db, upstream: mobileUpstream }));
     router.use('/v1', v1);
     // Any unmatched gateway path → 404 JSON (NEVER falls through to a SPA handler;
     // the gateway serves JSON/WS only, no static client).
@@ -471,15 +470,16 @@ function createMobileRouter(deps) {
 /** The allow-list, exported for the CI drift test (asserts each entry resolves
  *  against a real internal route, and that no traversal param is accepted). */
 exports.MOBILE_ALLOWLIST = [
+    { method: 'GET', path: '/v1/inbox' },
+    { method: 'GET', path: '/v1/projects/:pid/inbox/runs/:runId/question' },
+    { method: 'POST', path: '/v1/projects/:pid/inbox/answer' },
+    { method: 'POST', path: '/v1/projects/:pid/inbox/resume' },
+    { method: 'POST', path: '/v1/projects/:pid/inbox/retry' },
+    { method: 'POST', path: '/v1/projects/:pid/inbox/create-pr' },
     { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/tree' },
     { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/find' },
     { method: 'GET', path: '/v1/projects/:pid/repositories/:rid/code/file' },
     { method: 'GET', path: '/v1/capabilities' },
-    { method: 'GET', path: '/v1/projects/:pid/missions/:cid/preview-targets' },
-    { method: 'POST', path: '/v1/projects/:pid/preview-sessions' },
-    { method: 'POST', path: '/v1/projects/:pid/preview-sessions/:sid/attach' },
-    { method: 'POST', path: '/v1/projects/:pid/preview-sessions/:sid/navigate' },
-    { method: 'DELETE', path: '/v1/projects/:pid/preview-sessions/:sid' },
     { method: 'GET', path: '/v1/mission-models' },
     { method: 'PATCH', path: '/v1/projects/:pid/missions/:cid/messages/:mid/intent' },
     { method: 'GET', path: '/v1/projects/:pid/repositories' },

package/server/dist/mobile/mobile-webrtc-peer.js

@@ -14,9 +14,6 @@ class MobileWebrtcGateway {
     // answer to whatever happened to be pending. Per-room keying isolates them.
     _pending = new Map();
     _active = new Set();
-    /** The live peer of each authenticated device (latest wins), so Desktop can
-     *  open extra DataChannels (app preview) on the connection it already has. */
-    _byDevice = new Map();
     constructor(_deps) {
         this._deps = _deps;
     }
@@ -51,23 +48,17 @@ class MobileWebrtcGateway {
         //    require a valid existing device token instead, and never mint.
         new mobile_datachannel_1.DataChannelPeer(toChannelLike(dc), {
             registerDevice: async (input) => {
-                let result;
                 if (isReconnect) {
-                    result = await this._deps.registerDevice({
+                    return this._deps.registerDevice({
                         deviceName: input.deviceName,
                         platform: input.platform,
                         token: input.token,
                         requireExistingToken: true,
                     });
                 }
-                else {
-                    result = input.secret && (0, auth_1.safeEqual)(input.secret, secret)
-                        ? await this._deps.registerDevice({ deviceName: input.deviceName, platform: input.platform, token: input.token })
-                        : { ok: false };
-                }
-                if (result.ok)
-                    this._byDevice.set(result.deviceId, pc);
-                return result;
+                return input.secret && (0, auth_1.safeEqual)(input.secret, secret)
+                    ? this._deps.registerDevice({ deviceName: input.deviceName, platform: input.platform, token: input.token })
+                    : { ok: false };
             },
             rpcDispatch: this._deps.rpcDispatch,
             bridge: this._deps.bridge,
@@ -76,9 +67,6 @@ class MobileWebrtcGateway {
             console.log('[webrtc] pc connectionState:', s);
             if (s === 'failed' || s === 'closed' || s === 'disconnected') {
                 this._active.delete(pc);
-                for (const [deviceId, owned] of this._byDevice)
-                    if (owned === pc)
-                        this._byDevice.delete(deviceId);
                 // Drop this pc from whichever room slot still holds it.
                 if (this._pending.get(key)?.pc === pc)
                     this._pending.delete(key);
@@ -113,24 +101,6 @@ class MobileWebrtcGateway {
             return { ok: false };
         }
     }
-    /** Open an ordered, reliable DataChannel on the device's live peer (no SDP
-     *  renegotiation: the SCTP association already exists). Null when the
-     *  device has no connected WebRTC peer. */
-    openChannel(deviceId, label) {
-        const pc = this._byDevice.get(deviceId);
-        if (!pc || pc.connectionState !== 'connected')
-            return null;
-        try {
-            return toPreviewChannel(pc.createDataChannel(label, { ordered: true }));
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Forget a device's peer (revoked). Its channels close with the peer. */
-    forgetDevice(deviceId) {
-        this._byDevice.delete(deviceId);
-    }
     /** Tear down every peer (gateway stopping / disabled). */
     stop() {
         for (const key of [...this._pending.keys()])
@@ -138,7 +108,6 @@ class MobileWebrtcGateway {
         for (const pc of this._active)
             this._close(pc);
         this._active.clear();
-        this._byDevice.clear();
     }
     _close(pc) {
         try {
@@ -168,25 +137,6 @@ function toChannelLike(dc) {
         },
     };
 }
-function toPreviewChannel(dc) {
-    return {
-        get label() { return dc.label; },
-        get readyState() { return dc.readyState; },
-        get bufferedAmount() { return dc.bufferedAmount; },
-        send: (data) => dc.send(data),
-        close: () => dc.close(),
-        onOpen: (cb) => {
-            if (dc.readyState === 'open')
-                queueMicrotask(cb);
-            else
-                dc.stateChanged.subscribe((s) => { if (s === 'open')
-                    cb(); });
-        },
-        onMessage: (cb) => { dc.onMessage.subscribe((d) => cb(d)); },
-        onClose: (cb) => { dc.stateChanged.subscribe((s) => { if (s === 'closed')
-            cb(); }); },
-    };
-}
 /** Vanilla ICE: resolve once gathering completes so the offer SDP carries all
  *  candidates (there's no trickle channel — the SDP travels by QR). */
 function waitIceComplete(pc) {