specrails-desktop 2.64.2 → 2.65.1

package/server/dist/project-router-helpers.js

@@ -6,9 +6,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VALID_MODEL_ALIASES = exports.TERMINAL_PANEL_ENABLED = void 0;
-exports.stripSpecMetadataSections = stripSpecMetadataSections;
-exports.extractShortSummary = extractShortSummary;
+exports.VALID_MODEL_ALIASES = exports.TERMINAL_PANEL_ENABLED = exports.extractShortSummary = exports.stripSpecMetadataSections = void 0;
 exports.deriveFallbackShortSummary = deriveFallbackShortSummary;
 exports.lightlyStructurePrompt = lightlyStructurePrompt;
 exports.formatDescriptionWithCriteria = formatDescriptionWithCriteria;
@@ -259,33 +257,10 @@ function applyModelConfig(project) {
         }
     }
 }
-/**
- * Strip the metadata sections (Spec Title, Labels, Estimated Complexity,
- * Short Summary) from a generate-spec LLM response so they don't end up
- * duplicated inside the ticket's description — they're already parsed into
- * dedicated fields and re-rendered by the UI.
- */
-function stripSpecMetadataSections(buffer) {
-    return buffer
-        .replace(/##\s*Spec Title\s*\n+[^\n]*\n*/i, '')
-        .replace(/##\s*Labels\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .replace(/##\s*Estimated Complexity\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .replace(/##\s*Short Summary\s*\n+(?:[^\n]+(?:\n(?!##)[^\n]+)*)\n*/i, '')
-        .trim();
-}
-/**
- * Extract the `## Short Summary` section body from a generate-spec response.
- * Returns the raw multi-line string (the ticket-store `clampShortSummary`
- * helper applies trim, control-strip, and the 240-char hard cap before
- * persistence). Returns `null` when the section is missing or empty.
- */
-function extractShortSummary(buffer) {
-    const m = buffer.match(/##\s*Short Summary\s*\n+((?:(?!##)[^\n]+(?:\n(?!##)[^\n]+)*))/i);
-    if (!m)
-        return null;
-    const body = m[1].trim();
-    return body.length > 0 ? body : null;
-}
+// Generated-spec parsing lives with the specs capability (spec-generation use case).
+var generated_spec_parser_1 = require("./modules/specs/runtime/generated-spec-parser");
+Object.defineProperty(exports, "stripSpecMetadataSections", { enumerable: true, get: function () { return generated_spec_parser_1.stripSpecMetadataSections; } });
+Object.defineProperty(exports, "extractShortSummary", { enumerable: true, get: function () { return generated_spec_parser_1.extractShortSummary; } });
 function deriveFallbackShortSummary(title, description) {
     const plain = description
         .replace(/```[\s\S]*?```/g, ' ')

package/server/dist/project-router-jobs.js

@@ -21,6 +21,10 @@ const metrics_1 = require("./modules/accounting/runtime/metrics");
 const job_listing_1 = require("./modules/execution/runtime/job-listing");
 const ticket_store_1 = require("./modules/specs/runtime/ticket-store");
 const project_router_background_processes_1 = require("./project-router-background-processes");
+const audit_1 = require("./modules/audit");
+const sqlite_1 = require("./modules/recovery/adapters/sqlite");
+const http_1 = require("./modules/audit/adapters/http");
+const sqlite_2 = require("./modules/audit/adapters/sqlite");
 const project_router_helpers_1 = require("./project-router-helpers");
 function registerJobsRoutes(deps) {
     const { router, ctx, ticketPath } = deps;
@@ -320,6 +324,19 @@ function registerJobsRoutes(deps) {
         const c = ctx(req);
         const jobId = req.params.id;
         const loopPaused = c.loopRunManager?.isPaused?.(jobId) ?? false;
+        // A budget_paused loop resumes through its turn door too (any text): still
+        // over budget ⇒ the shared daily_budget_exceeded 409 body.
+        if (loopPaused && c.loopRunManager?.budgetPause?.(jobId)) {
+            const resumed = c.loopRunManager.resumeBudgetPause(jobId);
+            if (resumed.status === 'over_budget') {
+                res.status(409).json(resumed.rejection);
+                return;
+            }
+            if (resumed.status === 'resumed') {
+                res.status(202).json({ ok: true });
+                return;
+            }
+        }
         if (!(0, feature_flags_1.isInteractiveJobsEnabled)() && !loopPaused) {
             res.status(403).json({ error: 'Interactive jobs are disabled on this server' });
             return;
@@ -430,10 +447,30 @@ function registerJobsRoutes(deps) {
         // Annotate each job with hasTelemetry so the client can show the
         // Export diagnostic button without an extra round trip.
         const jobsWithTelemetry = (0, db_1.getJobsWithTelemetry)(db);
+        // The first spec a job refers to names it in lists (palette, tables):
+        // `#14` alone says nothing. Resolved best-effort; an unreadable store
+        // never fails the listing.
+        let store;
+        const specOf = (command) => {
+            const [id] = (0, ticket_store_1.extractTicketIdsFromCommand)(command);
+            if (id === undefined)
+                return null;
+            if (store === undefined) {
+                try {
+                    store = (0, ticket_store_1.readStore)(ticketPath(req) ?? (0, ticket_store_1.resolveTicketStoragePath)(ctx(req).project.path));
+                }
+                catch {
+                    store = null;
+                }
+            }
+            const title = store?.tickets[String(id)]?.title;
+            return title ? { ticketId: id, ticketTitle: title } : null;
+        };
         const annotatedJobs = result.jobs.map((j) => ({
             ...j,
             ...((0, agent_runtime_controls_router_1.isRuntimeContinuationActive)(ctx(req), j.id) ? { status: 'running', finished_at: null } : {}),
             hasTelemetry: jobsWithTelemetry.has(j.id),
+            ...(specOf(j.command) ?? {}),
         }));
         res.json({ jobs: annotatedJobs, total: result.total });
     });
@@ -450,6 +487,11 @@ function registerJobsRoutes(deps) {
         return lines.join('\n');
     };
     // ─── Jobs export (must be before /:projectId/jobs/:id) ─────────────────────
+    // Agent actions audit exports (JSONL/CSV): one run, or a project-wide window.
+    (0, http_1.registerAgentAuditHttp)(router, (req) => {
+        const context = ctx(req);
+        return context.agentAudit?.service ?? (0, audit_1.createAgentAuditService)({ store: (0, sqlite_2.createSqliteAgentActionStore)(context.db) });
+    });
     router.get('/:projectId/jobs/export', (req, res) => {
         const format = req.query.format || 'json';
         if (format !== 'json' && format !== 'csv') {
@@ -605,6 +647,7 @@ function registerJobsRoutes(deps) {
         const loopRun = (0, loop_runs_store_1.getLoopRun)(db, jobId);
         const loopPaused = loopRun?.status === 'paused' || (c.loopRunManager?.isPaused?.(jobId) ?? false);
         const loopPauseReason = c.loopRunManager?.pausedReason?.(jobId) ?? null;
+        const loopPauseBudget = c.loopRunManager?.budgetPause?.(jobId) ?? null;
         const pendingInterrupts = c.loopRunManager?.pendingInterrupts?.(jobId) ?? [];
         if (job.status === 'running' && (((0, feature_flags_1.isInteractiveJobsEnabled)() && job.interactive) || loopPaused)) {
             const qmMode = queueManager.getInteractiveSettleMode?.(jobId) ?? null;
@@ -612,7 +655,12 @@ function registerJobsRoutes(deps) {
             interactiveAcceptingTurns = qmMode !== null || loopStepActive || loopPaused;
             interactiveSettleMode = qmMode ?? ((loopStepActive || loopPaused || loopRun) ? 'auto' : null);
         }
-        const annotated = { ...job, ...((0, agent_runtime_controls_router_1.isRuntimeContinuationActive)(c, jobId) ? { status: 'running', finished_at: null } : {}), hasTelemetry: (0, db_1.hasJobTelemetry)(db, jobId), tickets, interactiveSettleMode, interactiveAcceptingTurns, loopPaused, loopPauseReason, pendingInterrupts };
+        const annotated = { ...job, ...((0, agent_runtime_controls_router_1.isRuntimeContinuationActive)(c, jobId) ? { status: 'running', finished_at: null } : {}), hasTelemetry: (0, db_1.hasJobTelemetry)(db, jobId), tickets, interactiveSettleMode, interactiveAcceptingTurns, loopPaused, loopPauseReason, ...(loopPauseBudget ? { loopPauseKind: 'budget_paused', loopPauseBudget: { scope: loopPauseBudget.scope, ...(loopPauseBudget.period ? { period: loopPauseBudget.period } : {}), budgetUsd: loopPauseBudget.budgetUsd, spentUsd: loopPauseBudget.spentUsd, resetsAt: loopPauseBudget.resetsAt } } : {}), pendingInterrupts, failureDiagnosis: (() => { try {
+                return (0, sqlite_1.readJobDiagnosis)(db, jobId, job.status);
+            }
+            catch {
+                return null;
+            } })() };
         res.json({ job: annotated, events, phaseDefinitions });
     });
     router.delete('/:projectId/jobs', (req, res) => {

package/server/dist/project-router-loop-runs.js

@@ -13,6 +13,7 @@ const db_1 = require("./db");
 const loop_definition_controls_1 = require("./modules/loops/runtime/loop-definition-controls");
 const loop_definition_recovery_1 = require("./modules/loops/runtime/loop-definition-recovery");
 const run_duration_stats_1 = require("./modules/execution/runtime/run-duration-stats");
+const launch_forecast_1 = require("./modules/execution/runtime/launch-forecast");
 const loop_constants_1 = require("./modules/loops/runtime/loop-constants");
 const providers_1 = require("./providers");
 const runtime_1 = require("./providers/runtime");
@@ -22,6 +23,7 @@ const spec_models_1 = require("./modules/specs/runtime/spec-models");
 const workspace_resolution_1 = require("./workspace-resolution");
 const loop_command_catalog_1 = require("./modules/loops/runtime/loop-command-catalog");
 const ids_1 = require("./ids");
+const sqlite_1 = require("./modules/recovery/adapters/sqlite");
 const project_repositories_1 = require("./project-repositories");
 const multi_repo_execution_1 = require("./modules/delivery/runtime/multi-repo-execution");
 const rails_store_1 = require("./modules/delivery/runtime/rails-store");
@@ -51,12 +53,36 @@ function registerLoopRunRoutes(deps) {
             return;
         }
         const c = ctx(req), runId = String(req.params.id), run = (0, loop_runs_store_1.getLoopRun)(c.db, runId);
+        // rail-loop-budget-guard: a resident run paused on the daily budget (either
+        // engine) resumes in place once the budget allows the next step.
+        if (run && run.project_id === c.project.id && c.loopRunManager.budgetPause?.(runId)) {
+            // A per-run soft cap is answered explicitly: `{ runCap: 'ignore' }` continues
+            // without it, `{ runCapUsd: n }` raises it. Anything else leaves it standing.
+            const body = (req.body ?? {});
+            const choice = body.runCap === 'ignore' ? { ignore: true }
+                : typeof body.runCapUsd === 'number' && Number.isFinite(body.runCapUsd) && body.runCapUsd > 0 ? { raiseTo: body.runCapUsd } : undefined;
+            const resumed = c.loopRunManager.resumeBudgetPause(runId, choice);
+            if (resumed.status === 'over_budget') {
+                res.status(409).json(resumed.rejection);
+                return;
+            }
+            if (resumed.status === 'resumed') {
+                res.status(202).json({ loopRunId: runId, resumed: true });
+                return;
+            }
+        }
         if (!run || run.project_id !== c.project.id || run.engine_version !== 2) {
             res.status(404).json({ error: 'Definition run not found' });
             return;
         }
         try {
             (0, process_admission_1.assertProcessAdmission)(c.project.id);
+            // Continuing a workflow is cost-incurring: same gate as a rail launch.
+            const budgetRejection = c.dailyBudgetRejection?.() ?? null;
+            if (budgetRejection) {
+                res.status(409).json(budgetRejection);
+                return;
+            }
             const successor = (0, loop_runs_store_1.readDefinitionSuccessor)(c.db, runId);
             if (successor) {
                 res.status(409).json({ error: 'runtime_fork_owns_worktree', loopRunId: successor });
@@ -239,11 +265,19 @@ function registerLoopRunRoutes(deps) {
         const usageAvailable = !run.provider
             || !(0, providers_1.hasAdapter)(run.provider)
             || (0, providers_1.getAdapter)(run.provider).capabilities.reportsUsage !== false;
+        const { failure_diagnosis: _stored, ...publicRun } = run;
+        const failureDiagnosis = (() => { try {
+            return (0, sqlite_1.readRunDiagnosis)(c.db, run.id);
+        }
+        catch {
+            return null;
+        } })();
         res.json({
             loopRun: usageAvailable
-                ? { ...run, usage_available: true }
+                ? { ...publicRun, failureDiagnosis, usage_available: true }
                 : {
-                    ...run,
+                    ...publicRun,
+                    failureDiagnosis,
                     total_cost_usd: null,
                     total_tokens: null,
                     usage_available: false,
@@ -266,6 +300,33 @@ function registerLoopRunRoutes(deps) {
             : (0, run_duration_stats_1.getJobCommandDurationRange)(c.db, (0, run_duration_stats_1.jobCommandShape)(command));
         res.json({ range, minSamples: run_duration_stats_1.MIN_DURATION_SAMPLES });
     });
+    // Launch forecast ("Usually 6-9 min · $2-4 for runs like this"): the same
+    // measured samples as run-duration-range, narrowed to the provider about to
+    // run, plus a provider-reported cost band and the tightest daily budget's
+    // headroom. Read-only. `time`/`cost` are null below the sample floor — the
+    // caller MUST say "Not enough history yet", never guess. Costs here are an
+    // estimate from past runs, never a billed figure.
+    router.get('/:projectId/launch-forecast', (req, res) => {
+        const c = ctx(req);
+        const text = (value) => (typeof value === 'string' && value.length > 0 && value.length <= 200 ? value : null);
+        const loopId = text(req.query.loopId);
+        const command = text(req.query.command);
+        const provider = text(req.query.provider);
+        if (!loopId && !command) {
+            res.status(400).json({ error: 'loopId or command is required' });
+            return;
+        }
+        if (provider && !/^[a-z0-9][a-z0-9_-]{0,63}$/i.test(provider)) {
+            res.status(400).json({ error: 'provider is invalid' });
+            return;
+        }
+        const forecast = (0, launch_forecast_1.getLaunchForecast)(c.db, c.project.id, {
+            loopId,
+            commandShape: command ? (0, run_duration_stats_1.jobCommandShape)(command) : null,
+            provider,
+        });
+        res.json({ ...forecast, budget: c.dailyBudgetHeadroom?.() ?? null });
+    });
     router.post('/:projectId/loop-runs', async (req, res) => {
         if (!(0, feature_flags_1.isLoopsEnabled)()) {
             res.status(404).json({ error: 'Not Found' });
@@ -274,6 +335,8 @@ function registerLoopRunRoutes(deps) {
         const c = ctx(req);
         const body = req.body ?? {};
         const { loopId, aiEngine, provider: providerAlias, reasoning_effort, model: requestedModel } = body;
+        // Per-launch override of the per-run soft cap: a number > 0 caps this run, 0 waives the default.
+        const runCapUsd = typeof body.runCapUsd === 'number' && Number.isFinite(body.runCapUsd) && body.runCapUsd >= 0 ? body.runCapUsd : undefined;
         if (typeof loopId !== 'string' || !loopId) {
             res.status(400).json({ error: 'loopId is required' });
             return;
@@ -364,6 +427,12 @@ function registerLoopRunRoutes(deps) {
             res.status(error instanceof project_repositories_1.RepositoryValidationError ? error.status : error instanceof process_admission_1.ProcessAdmissionClosedError ? 409 : 400).json({ error: error instanceof Error ? error.message : 'Invalid repository scope' });
             return;
         }
+        // Standalone loop runs are cost-incurring launches too (rail-loop-budget-guard).
+        const budgetRejection = c.dailyBudgetRejection?.() ?? null;
+        if (budgetRejection) {
+            res.status(409).json(budgetRejection);
+            return;
+        }
         if (repositoryIds.length !== 1 || repositoryIds[0] !== primary.id) {
             if (!(0, rail_isolation_1.isolationApplies)({ loopsEnabled: true, scope: 'all', ticketCount: 1, readOnly: false })) {
                 res.status(409).json({ error: 'repository_isolation_required' });
@@ -430,6 +499,7 @@ function registerLoopRunRoutes(deps) {
             provider,
             model,
             effort,
+            ...(runCapUsd !== undefined ? { runCapUsd } : {}),
         })
             .then((r) => c.onLoopRunFinished(r.runId, r.outcome, r.stallReason ? { stallReason: r.stallReason } : undefined))
             .catch((err) => {

package/server/dist/project-router-rules.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRulesRoutes = registerRulesRoutes;
+const core_capabilities_1 = require("./modules/agent-runtime/runtime/core-capabilities");
+const http_1 = require("./modules/project-rules/adapters/http");
+const rules_inventory_runs_1 = require("./modules/project-rules/runtime/rules-inventory-runs");
+const ticket_store_1 = require("./modules/specs/runtime/ticket-store");
+function registerRulesRoutes({ router, ctx, ticketPath }) {
+    // Phase-3 Core capabilities for the settings UI (each surface gates on its own flag).
+    router.get('/:projectId/core/phase3-capabilities', async (_req, res) => {
+        res.json(await (0, core_capabilities_1.corePhase3Capabilities)());
+    });
+    (0, http_1.registerProjectRulesHttp)(router, (req) => {
+        const context = ctx(req);
+        return {
+            project: { id: context.project.id, slug: context.project.slug, path: context.project.path },
+            supported: async () => (await (0, core_capabilities_1.corePhase3Capabilities)()).rulesInventory,
+            createRuleSpec: (fields) => {
+                const now = new Date().toISOString();
+                let created;
+                const store = (0, ticket_store_1.mutateStore)(ticketPath(req), (s) => {
+                    const id = s.next_id++;
+                    created = {
+                        id,
+                        title: fields.title,
+                        description: fields.description,
+                        status: 'todo',
+                        priority: 'medium',
+                        labels: fields.labels,
+                        assignee: null,
+                        prerequisites: [],
+                        metadata: {},
+                        comments: [],
+                        origin_conversation_id: null,
+                        is_epic: false,
+                        parent_epic_id: null,
+                        execution_order: null,
+                        short_summary: null,
+                        nonGoals: fields.nonGoals,
+                        created_at: now,
+                        updated_at: now,
+                        created_by: 'rules-inventory',
+                        source: 'rules',
+                    };
+                    s.tickets[String(id)] = created;
+                });
+                context.ticketWatcher.notifyDesktopWrite(store.revision);
+                const message = { type: 'ticket_created', ticket: created, projectId: context.project.id, timestamp: now };
+                context.broadcast(message);
+                return created;
+            },
+        };
+    }, rules_inventory_runs_1.rulesInventoryRuns);
+}

package/server/dist/project-router-search.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSearchRoutes = registerSearchRoutes;
+const db_1 = require("./db");
+const ticket_store_1 = require("./modules/specs/runtime/ticket-store");
+const spec_search_1 = require("./modules/specs/runtime/spec-search");
+const MAX_QUERY_LENGTH = 200;
+function parseQuery(req, res) {
+    const q = typeof req.query.q === 'string' ? req.query.q.trim() : '';
+    if (!q) {
+        res.status(400).json({ error: 'q is required' });
+        return null;
+    }
+    if (q.length > MAX_QUERY_LENGTH || /[\r\n]/.test(q)) {
+        res.status(400).json({ error: `q must be a single line of at most ${MAX_QUERY_LENGTH} characters` });
+        return null;
+    }
+    return q;
+}
+function parseLimit(raw, fallback, max) {
+    const n = typeof raw === 'string' ? Number.parseInt(raw, 10) : NaN;
+    return Number.isFinite(n) && n > 0 ? Math.min(n, max) : fallback;
+}
+function registerSearchRoutes({ router, ctx, ticketPath }) {
+    router.get('/:projectId/search/specs', (req, res) => {
+        const q = parseQuery(req, res);
+        if (q === null)
+            return;
+        try {
+            const store = (0, ticket_store_1.readStore)(ticketPath(req));
+            const limit = parseLimit(req.query.limit, spec_search_1.SPEC_SEARCH_DEFAULT_LIMIT, spec_search_1.SPEC_SEARCH_MAX_LIMIT);
+            res.json({ results: (0, spec_search_1.searchSpecs)(Object.values(store.tickets), q, limit) });
+        }
+        catch (err) {
+            console.error('[project-router] spec search error:', err);
+            res.status(500).json({ error: 'Failed to search specs' });
+        }
+    });
+    router.get('/:projectId/search/jobs', (req, res) => {
+        const q = parseQuery(req, res);
+        if (q === null)
+            return;
+        try {
+            const limit = parseLimit(req.query.limit, db_1.JOB_SEARCH_DEFAULT_LIMIT, db_1.JOB_SEARCH_MAX_LIMIT);
+            res.json({ results: (0, db_1.searchJobs)(ctx(req).db, q, limit) });
+        }
+        catch (err) {
+            console.error('[project-router] job search error:', err);
+            res.status(500).json({ error: 'Failed to search job logs' });
+        }
+    });
+}

package/server/dist/project-router-settings.js

@@ -10,6 +10,8 @@ const project_settings_1 = require("./modules/project-settings");
 const sqlite_1 = require("./modules/project-settings/adapters/sqlite");
 const http_1 = require("./modules/project-settings/adapters/http");
 const project_env_1 = require("./project-env");
+const registry_1 = require("./providers/registry");
+const runtime_1 = require("./providers/runtime");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const db_1 = require("./db");
@@ -53,6 +55,10 @@ function registerSettingsRoutes(deps) {
             return (0, project_env_1.getProjectEnvStatus)(db);
         },
     });
+    // Value-free minimal agent environment report (names, never values).
+    (0, http_1.registerAgentEnvStatusHttp)(router, {
+        read: req => (0, project_env_1.getProjectAgentEnvStatus)(ctx(req).db, (0, registry_1.listAdapters)().map(adapter => ({ id: adapter.id, displayName: adapter.displayName, allowlist: (0, runtime_1.providerEnvAllowlist)(adapter) }))),
+    });
     // ─── Per-project Quick mode Contract Refine last-used value ─────────────────
     router.get('/:projectId/add-spec-quick-contract-refine-last', (req, res) => {
         res.json({

package/server/dist/project-router-setup.js

@@ -175,7 +175,7 @@ function registerSetupRoutes(deps) {
         // execution cwd (including relocated workspaces) and understands Kimi's
         // materialized headless skills rather than probing only Claude markdown.
         if (!ctx(req).proposalManager.canStartExploration()) {
-            res.status(400).json({ error: 'This project does not have the /specrails:propose-feature command installed. Run "npx specrails-core@latest" to update.' });
+            res.status(400).json({ error: 'This project does not have the /specrails:propose-feature command installed. Update Specrails Core from Settings → Updates.' });
             return;
         }
         const id = (0, ids_1.newId)();

package/server/dist/project-router-spending.js

@@ -8,7 +8,14 @@ const config_1 = require("./config");
 const workspace_resolution_1 = require("./workspace-resolution");
 const ai_invocations_1 = require("./modules/accounting/runtime/ai-invocations");
 const spending_1 = require("./modules/accounting/runtime/spending");
+const decision_times_1 = require("./modules/accounting/runtime/decision-times");
+const what_if_1 = require("./modules/accounting/runtime/what-if");
+const budget_overview_1 = require("./modules/execution/runtime/budget-overview");
+const budget_storage_1 = require("./modules/execution/adapters/budget-storage");
+const desktop_db_1 = require("./desktop-db");
+const loop_economics_1 = require("./modules/accounting/runtime/loop-economics");
 const ticket_store_1 = require("./modules/specs/runtime/ticket-store");
+const loops_store_1 = require("./modules/loops/runtime/loops-store");
 const legacy_launch_telemetry_1 = require("./modules/loops/runtime/legacy-launch-telemetry");
 /**
  * Parse + clamp a `tzOffsetMinutes` query param (minutes east of UTC, the value
@@ -56,6 +63,73 @@ function registerSpendingRoutes(deps) {
             res.status(503).json({ error: 'legacy_telemetry_unavailable' });
         }
     });
+    // Time to decision / merge per delivery (delivery-decision-times). Unknown
+    // instants stay counted as unknown — never folded into a zero duration.
+    router.get('/:projectId/analytics/decision-times', (req, res) => {
+        const filters = (0, spending_1.parseSpendingFilters)(req.query);
+        if (filters.period && !['7d', '30d', '90d', 'all', 'custom'].includes(filters.period)) {
+            res.status(400).json({ error: 'invalid_period' });
+            return;
+        }
+        if (filters.period === 'custom' && (!filters.from || !filters.to)) {
+            res.status(400).json({ error: 'from and to are required for custom period' });
+            return;
+        }
+        try {
+            res.json((0, decision_times_1.getDecisionTimes)(ctx(req).db, filters));
+        }
+        catch (err) {
+            console.error('[decision-times] query failed:', err);
+            res.status(500).json({ error: 'decision_times_unavailable' });
+        }
+    });
+    // Loop economics per loop (loop-economics-analytics). Unknown values stay
+    // null — no data — never a manufactured zero.
+    router.get('/:projectId/analytics/loop-economics', (req, res) => {
+        const filters = (0, spending_1.parseSpendingFilters)(req.query);
+        if (filters.period && !['7d', '30d', '90d', 'all', 'custom'].includes(filters.period)) {
+            res.status(400).json({ error: 'invalid_period' });
+            return;
+        }
+        if (filters.period === 'custom' && (!filters.from || !filters.to)) {
+            res.status(400).json({ error: 'from and to are required for custom period' });
+            return;
+        }
+        // Escaped-defect links come from the ticket store; an unreadable store
+        // leaves the metric untracked (null) rather than zero.
+        let regressionLinks = [];
+        try {
+            regressionLinks = (0, ticket_store_1.listRegressionLinks)((0, ticket_store_1.readStore)(ticketPath(req)));
+        }
+        catch { /* untracked */ }
+        // Saved loops are global (desktop DB). Only published ones are listed as
+        // "no data" rows; an unavailable registry just omits them.
+        let knownLoops = [];
+        try {
+            const desktopDb = registry?.desktopDb;
+            if (desktopDb)
+                knownLoops = (0, loops_store_1.listLoops)(desktopDb).filter((loop) => loop.status === 'published').map((loop) => ({ id: loop.id, name: loop.name }));
+        }
+        catch { /* no saved loops */ }
+        try {
+            res.json((0, loop_economics_1.getLoopEconomics)(ctx(req).db, filters, { regressionLinks, knownLoops }));
+        }
+        catch (err) {
+            console.error('[loop-economics] query failed:', err);
+            res.status(500).json({ error: 'loop_economics_unavailable' });
+        }
+    });
+    // Recent delivered deliveries — source of the ticket "Regression of" picker.
+    router.get('/:projectId/analytics/loop-economics/deliveries', (req, res) => {
+        const limit = typeof req.query.limit === 'string' ? parseInt(req.query.limit, 10) : 50;
+        try {
+            res.json({ deliveries: (0, loop_economics_1.listRecentDeliveries)(ctx(req).db, Number.isFinite(limit) ? limit : 50) });
+        }
+        catch (err) {
+            console.error('[loop-economics] deliveries query failed:', err);
+            res.status(500).json({ error: 'deliveries_unavailable' });
+        }
+    });
     // Build a YAML-store-backed title resolver for getSpending's 4th arg
     // (BUG-ANALYTICS-18/36). Without it, topTickets keeps ticketTitle:null and the
     // client mislabels every live ticket "Deleted ticket #N". Returns undefined
@@ -398,8 +472,12 @@ function registerSpendingRoutes(deps) {
             const budgetUtilizationPct = dailyBudgetUsd != null && dailyBudgetUsd > 0 && unpricedRuns === 0
                 ? (costToday / dailyBudgetUsd) * 100
                 : null;
+            const caps = (0, budget_storage_1.readProjectCaps)(db);
             res.json({
                 dailyBudgetUsd,
+                weeklyBudgetUsd: caps.week,
+                monthlyBudgetUsd: caps.month,
+                runCapUsd: caps.run,
                 jobCostThresholdUsd,
                 costToday,
                 pricedRuns: costRow.pricedRuns,
@@ -412,9 +490,19 @@ function registerSpendingRoutes(deps) {
             res.status(500).json({ error: 'Failed to read budget' });
         }
     });
+    // Caps beyond the daily budget (CD5). `null` clears, a number > 0 sets; anything
+    // else is a 400 (the historical daily/job fields keep their silent-ignore).
+    const NEW_CAP_FIELDS = [['weeklyBudgetUsd', 'week'], ['monthlyBudgetUsd', 'month'], ['runCapUsd', 'run']];
     router.patch('/:projectId/budget', (req, res) => {
         const { dailyBudgetUsd, jobCostThresholdUsd } = req.body ?? {};
         const { db } = ctx(req);
+        for (const [field] of NEW_CAP_FIELDS) {
+            const value = (req.body ?? {})[field];
+            if (value !== undefined && value !== null && !(typeof value === 'number' && Number.isFinite(value) && value > 0)) {
+                res.status(400).json({ error: 'invalid_cap', field });
+                return;
+            }
+        }
         try {
             if (dailyBudgetUsd !== undefined) {
                 if (dailyBudgetUsd === null) {
@@ -424,6 +512,11 @@ function registerSpendingRoutes(deps) {
                     db.prepare(`INSERT OR REPLACE INTO queue_state (key, value) VALUES ('config.daily_budget_usd', ?)`).run(String(dailyBudgetUsd));
                 }
             }
+            for (const [field, key] of NEW_CAP_FIELDS) {
+                const value = (req.body ?? {})[field];
+                if (value !== undefined)
+                    (0, budget_storage_1.writeProjectCap)(db, key, value);
+            }
             if (jobCostThresholdUsd !== undefined) {
                 if (jobCostThresholdUsd === null) {
                     db.prepare(`DELETE FROM queue_state WHERE key = 'config.job_cost_threshold_usd'`).run();
@@ -439,6 +532,51 @@ function registerSpendingRoutes(deps) {
             res.status(500).json({ error: 'Failed to update budget' });
         }
     });
+    // Budget panel read model: every cap with its spend (project and app-wide, the
+    // same read the gate uses), spend per period split by provider, and the
+    // month-end projection (an estimate from the trailing burn).
+    router.get('/:projectId/budget/caps', (req, res) => {
+        const c = ctx(req);
+        try {
+            const at = new Date();
+            res.json({
+                ...(0, budget_overview_1.readSpendOverview)([{ db: c.db, projectId: c.project.id }], at),
+                config: (0, budget_storage_1.readProjectCaps)(c.db),
+                appConfig: (0, budget_storage_1.readDesktopCaps)((key) => (0, desktop_db_1.getDesktopSetting)(registry.desktopDb, key)),
+                caps: c.budgetCaps?.(at) ?? [],
+            });
+        }
+        catch (err) {
+            console.error('[project-router] budget caps error:', err);
+            res.status(500).json({ error: 'budget_caps_unavailable' });
+        }
+    });
+    // What-if pricing: re-price this project's recorded usage of one model as if
+    // another model had run it. Estimate only; a model without a rate card is
+    // reported (`noPricing`), never guessed.
+    router.get('/:projectId/budget/what-if', (req, res) => {
+        const c = ctx(req);
+        const text = (value) => (typeof value === 'string' && value.length > 0 && value.length <= 200 ? value : null);
+        const ref = (spec) => {
+            if (!spec)
+                return null;
+            const at = spec.indexOf(':');
+            return at > 0 && at < spec.length - 1 ? { provider: spec.slice(0, at), model: spec.slice(at + 1) } : null;
+        };
+        const fromSpec = text(req.query.from), toSpec = text(req.query.to);
+        const from = ref(fromSpec), to = ref(toSpec);
+        if ((fromSpec || toSpec) && (!from || !to)) {
+            res.status(400).json({ error: 'invalid_model_ref' });
+            return;
+        }
+        try {
+            res.json((0, what_if_1.computeWhatIf)(c.db, c.project.id, (0, what_if_1.clampDays)(req.query.days), from && to ? { from, to } : null));
+        }
+        catch (err) {
+            console.error('[project-router] what-if error:', err);
+            res.status(500).json({ error: 'what_if_unavailable' });
+        }
+    });
     router.get('/:projectId/issues', (req, res) => {
         const { project, db } = ctx(req);
         try {