specrails-desktop 2.64.2 → 2.65.1

package/server/dist/db/migrations.js

@@ -5,6 +5,7 @@ const sqlite_migrations_1 = require("../util/sqlite-migrations");
 const multi_repo_execution_store_1 = require("../modules/delivery/runtime/multi-repo-execution-store");
 const project_repository_provenance_1 = require("../project-repository-provenance");
 const file_story_1 = require("../modules/code/runtime/file-story");
+const job_search_1 = require("./job-search");
 /** Backfill only terminal Safe-PR rows whose ticket ownership is unambiguous.
  * Eligibility is intentionally deferred to the outbox drainer, which freezes
  * only candidates still parked at on_review in the external ticket JSON. */
@@ -1617,6 +1618,244 @@ const MIGRATIONS = [
                 db.exec(`ALTER TABLE ${table} ADD COLUMN launch_config_json TEXT`);
         }
     },
+    // Migration 72: delivery-decision-times — first-write-wins ISO instants of
+    // the review lifecycle on each delivery: when it became reviewable
+    // (`on_review_at`), first received a human decision (`decided_at`), was
+    // published for review (`published_at`) and merged (`merged_at`). None of
+    // them is derivable exactly from existing columns (`updated_at` moves on any
+    // later patch), so historical rows stay NULL — unknown, never zero.
+    // Additive + idempotent; self-contained so parallel appends cannot collide.
+    (db) => {
+        const columns = new Set(db.prepare('PRAGMA table_info(rail_pr_deliveries)').all().map(column => column.name));
+        for (const name of ['on_review_at', 'decided_at', 'published_at', 'merged_at']) {
+            if (!columns.has(name))
+                db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN ${name} TEXT`);
+        }
+    },
+    // Migration 73: agent actions audit log (what each run read, wrote, ran,
+    // called over MCP or fetched). Targets only — never file contents or
+    // environment values. Retention is a project setting (default 30 days).
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS agent_actions (
+        id      INTEGER PRIMARY KEY,
+        run_id  TEXT NOT NULL,
+        job_id  TEXT,
+        role    TEXT NOT NULL,
+        kind    TEXT NOT NULL CHECK(kind IN ('read','write','exec','mcp','network')),
+        target  TEXT NOT NULL,
+        hash    TEXT,
+        ts      TEXT NOT NULL,
+        source  TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_agent_actions_run ON agent_actions(run_id, ts);
+      CREATE INDEX IF NOT EXISTS idx_agent_actions_ts ON agent_actions(ts);
+    `);
+    },
+    // Migration 74: Flow mode (server/modules/flow). One row per Flow; it owns its
+    // worktree until a rail adopts it (the adoption inserts the rail_worktrees row
+    // and sets state='handed_off' in one transaction). `ticket_id` is NULL only
+    // while the start saga has not created the placeholder spec: the row is the
+    // saga's durable anchor, and the partial unique index arbitrates concurrent
+    // starts (at most one active or paused Flow per conversation).
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS flow_sessions (
+        id              TEXT PRIMARY KEY,
+        conversation_id TEXT NOT NULL,
+        ticket_id       INTEGER,
+        state           TEXT NOT NULL CHECK (state IN ('active','paused','handed_off','delivered','discarded','needs-review')),
+        branch          TEXT,
+        worktree_path   TEXT,
+        base_sha        TEXT,
+        head_sha        TEXT,
+        core_session_id TEXT,
+        rail_index      INTEGER,
+        delivery_id     TEXT,
+        step            TEXT CHECK (step IS NULL OR step IN ('start:ticket','start:worktree','start:session','handoff:freeze','handoff:launch')),
+        created_at      TEXT NOT NULL,
+        updated_at      TEXT NOT NULL
+      );
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_sessions_open_conversation
+        ON flow_sessions(conversation_id) WHERE state IN ('active','paused');
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_conversation ON flow_sessions(conversation_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_ticket ON flow_sessions(ticket_id);
+    `);
+    },
+    // Migration 75: Flow settlement effects (Flow -> Spec, arch section 4.6).
+    // One row per durable effect, keyed `flow:<flowId>:<kind>`; executed in
+    // `seq` order with attempts/backoff and replayed at startup. A failure
+    // never blocks the delivery.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS flow_effects (
+        effect_key      TEXT PRIMARY KEY,
+        flow_id         TEXT NOT NULL,
+        kind            TEXT NOT NULL CHECK (kind IN ('rewrite-spec','jira-create','jira-review')),
+        seq             INTEGER NOT NULL,
+        status          TEXT NOT NULL CHECK (status IN ('pending','done','skipped','failed')),
+        attempts        INTEGER NOT NULL DEFAULT 0,
+        last_error      TEXT,
+        note            TEXT,
+        next_attempt_at TEXT,
+        created_at      TEXT NOT NULL,
+        updated_at      TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_flow_effects_flow ON flow_effects(flow_id, seq);
+      CREATE INDEX IF NOT EXISTS idx_flow_effects_pending ON flow_effects(status) WHERE status = 'pending';
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_delivery ON flow_sessions(delivery_id);
+    `);
+    },
+    // Migration 76: spec triage (launch-triage). Each rail launch records the
+    // loop the triage recommended and the loop actually launched, so loop
+    // economics can compute triage accuracy (matched / total). NULL on history.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all().map((r) => r.name));
+        if (!cols.has('recommended_loop'))
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN recommended_loop TEXT`);
+        if (!cols.has('chosen_loop'))
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN chosen_loop TEXT`);
+    },
+    // Migration 77: architect clarifications on Jira (feedback-2026-10 task 3.2).
+    // One row per clarifications comment Desktop posted on a linked issue (the
+    // questions a run paused on, or the assumptions it proceeded with). The poll
+    // imports later human replies on that issue as `clarification` addenda;
+    // `imported_comment_ids` keeps the import idempotent across restarts.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS jira_clarification_threads (
+        id                   TEXT PRIMARY KEY,
+        run_id               TEXT NOT NULL,
+        ticket_id            INTEGER NOT NULL,
+        jira_issue_id        TEXT NOT NULL,
+        kind                 TEXT NOT NULL CHECK (kind IN ('questions','assumptions')),
+        marker               TEXT NOT NULL,
+        state                TEXT NOT NULL CHECK (state IN ('open','answered','closed')),
+        imported_comment_ids TEXT NOT NULL DEFAULT '[]',
+        created_at           TEXT NOT NULL,
+        updated_at           TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_jira_clarification_threads_open ON jira_clarification_threads(state, created_at);
+    `);
+    },
+    // Migration 78: Back to Flow (feedback-2026-10 Flow → Spec repair). When a
+    // Flow → Spec delivery stopped with requested changes and its worktree went
+    // back to the Flow, the review the agent must address in its NEXT turn.
+    // Cleared once a turn delivered it (or the Flow is handed off again).
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(flow_sessions)').all().map((c) => c.name));
+        if (!cols.has('return_briefing'))
+            db.exec('ALTER TABLE flow_sessions ADD COLUMN return_briefing TEXT');
+    },
+    // Migration 79: the OpenSpec change ids this Flow's own Flow → Spec runs
+    // derived (JSON array, most recent last). A returned worktree still carries
+    // that active change: the next freeze allows it and the next run re-derives
+    // it in place instead of creating another.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(flow_sessions)').all().map((c) => c.name));
+        if (!cols.has('derived_changes'))
+            db.exec('ALTER TABLE flow_sessions ADD COLUMN derived_changes TEXT');
+    },
+    // Migration 80: the project repository a Flow runs in (workspace projects
+    // and multi-repository projects). NULL ⇒ the primary repository at the
+    // project root, exactly as every Flow before it.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(flow_sessions)').all().map((c) => c.name));
+        if (!cols.has('repository_id'))
+            db.exec('ALTER TABLE flow_sessions ADD COLUMN repository_id TEXT');
+    },
+    // Migration 81: a real `closed` Flow state. Closing a needs-review Flow keeps
+    // its branch (nothing is released), which `discarded` (worktree and branch
+    // removed) misrepresented. SQLite cannot alter a CHECK constraint, so the
+    // table is rebuilt with every row, column and index preserved (flow_sessions
+    // has no triggers and no foreign keys). Rows closed before this migration
+    // stay `discarded`: nothing durable tells them apart.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(flow_sessions)').all().map((c) => c.name));
+        if (cols.size === 0)
+            return;
+        const value = (column) => (cols.has(column) ? column : 'NULL');
+        db.exec(`
+      DROP TABLE IF EXISTS flow_sessions_v81;
+      CREATE TABLE flow_sessions_v81 (
+        id              TEXT PRIMARY KEY,
+        conversation_id TEXT NOT NULL,
+        ticket_id       INTEGER,
+        state           TEXT NOT NULL CHECK (state IN ('active','paused','handed_off','delivered','discarded','closed','needs-review')),
+        branch          TEXT,
+        worktree_path   TEXT,
+        base_sha        TEXT,
+        head_sha        TEXT,
+        core_session_id TEXT,
+        rail_index      INTEGER,
+        delivery_id     TEXT,
+        step            TEXT CHECK (step IS NULL OR step IN ('start:ticket','start:worktree','start:session','handoff:freeze','handoff:launch')),
+        created_at      TEXT NOT NULL,
+        updated_at      TEXT NOT NULL,
+        return_briefing TEXT,
+        derived_changes TEXT,
+        repository_id   TEXT
+      );
+      INSERT INTO flow_sessions_v81 (id, conversation_id, ticket_id, state, branch, worktree_path, base_sha, head_sha,
+        core_session_id, rail_index, delivery_id, step, created_at, updated_at, return_briefing, derived_changes, repository_id)
+      SELECT id, conversation_id, ticket_id, state, branch, worktree_path, base_sha, head_sha,
+        core_session_id, rail_index, delivery_id, step, created_at, updated_at,
+        ${value('return_briefing')}, ${value('derived_changes')}, ${value('repository_id')}
+      FROM flow_sessions ORDER BY rowid;
+      DROP TABLE flow_sessions;
+      ALTER TABLE flow_sessions_v81 RENAME TO flow_sessions;
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_flow_sessions_open_conversation
+        ON flow_sessions(conversation_id) WHERE state IN ('active','paused');
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_conversation ON flow_sessions(conversation_id, created_at);
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_ticket ON flow_sessions(ticket_id);
+      CREATE INDEX IF NOT EXISTS idx_flow_sessions_delivery ON flow_sessions(delivery_id);
+    `);
+    },
+    // Migration 82: where a Flow's spec came from. 'existing' ⇒ the person's own
+    // spec started in Flow (restored on discard, never deleted; its original
+    // content is kept as a comment before the settlement rewrites it). NULL ⇒
+    // the Flow's placeholder spec, exactly as every Flow before it.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(flow_sessions)').all().map((c) => c.name));
+        if (!cols.has('spec_origin'))
+            db.exec("ALTER TABLE flow_sessions ADD COLUMN spec_origin TEXT CHECK (spec_origin IS NULL OR spec_origin IN ('placeholder','existing'))");
+    },
+    // Migration 83: rail_pr_deliveries.local_stash — JSON LocalStashRecord of the
+    // user's own uncommitted changes that "Integrate locally" saved as a git stash
+    // (by commit sha) before advancing the target branch. Durable so a restart
+    // between stash and restore re-applies them; NULL on every other delivery.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(rail_pr_deliveries)').all().map((c) => c.name));
+        if (!cols.has('local_stash'))
+            db.exec('ALTER TABLE rail_pr_deliveries ADD COLUMN local_stash TEXT');
+    },
+    // Migration 84: loop_runs.failure_diagnosis — JSON FailureDiagnosis of a run
+    // that ended failed / blocked / stalled (Core's contract 5.8 classification,
+    // or the one Desktop derived from its own signals). NULL for every other run
+    // and for runs that finished before this column; readers re-derive then.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(loop_runs)').all().map((c) => c.name));
+        if (!cols.has('failure_diagnosis'))
+            db.exec('ALTER TABLE loop_runs ADD COLUMN failure_diagnosis TEXT');
+    },
+    // Migration 85: loop_runs.run_cap_usd — the per-run soft cap ("pause and ask
+    // at $X") the run was launched with, as raised or waived on a resume. NULL ⇒
+    // never set (the project/app default applies); 0 ⇒ explicitly no cap for
+    // this run. Persisted so a restart keeps the choice the person made.
+    (db) => {
+        const cols = new Set(db.prepare('PRAGMA table_info(loop_runs)').all().map((c) => c.name));
+        if (!cols.has('run_cap_usd'))
+            db.exec('ALTER TABLE loop_runs ADD COLUMN run_cap_usd REAL');
+    },
+    // Migration 86: job-log search (CD6). An FTS5 trigram index over job
+    // commands, loop names, phase titles and failure-diagnosis kind/detail —
+    // never raw token streams (see db/job-search.ts). The index is derived data:
+    // this migration creates it and runs the idempotent backfill; settle/phase
+    // events keep it current afterwards.
+    (db) => {
+        (0, job_search_1.createJobSearchSchema)(db);
+        (0, job_search_1.rebuildJobSearchIndex)(db);
+    },
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need

package/server/dist/db.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setTelemetryBlobCompacted = exports.listActiveTelemetryBlobs = exports.upsertTelemetryBlob = exports.getTelemetryBlob = exports.setQuickContractRefineLast = exports.hasQuickContractRefineLast = exports.getQuickContractRefineLast = exports.updateProjectSettings = exports.getFreestylePrePrompt = exports.getProjectSettings = exports.normalizeWorktreeEnvPassthrough = exports.WORKTREE_ENV_NAME_RE = exports.DEFAULT_FREESTYLE_PRE_PROMPT = exports.getStats = exports.deleteTemplate = exports.updateTemplate = exports.getTemplate = exports.listTemplates = exports.createTemplate = exports.deleteProposal = exports.updateProposal = exports.listProposals = exports.getProposal = exports.createProposal = exports.getMessages = exports.addMessage = exports.updateConversation = exports.deleteConversation = exports.getConversation = exports.listConversations = exports.createConversation = exports.getProjectActivity = exports.getPipelineJobs = exports.skipJob = exports.purgeJobs = exports.deleteJob = exports.JobRecoveryPendingError = exports.getJobEvents = exports.getJob = exports.listJobs = exports.upsertPhase = exports.appendEvent = exports.finishJob = exports.finalizeInteractiveJob = exports.accumulateInteractiveTurn = exports.markJobInteractive = exports.deleteQueuedJob = exports.upsertQueuedJob = exports.createJob = exports.initDb = void 0;
-exports.hasJobTelemetry = exports.getJobsWithTelemetry = exports.deleteTelemetryForJob = exports.getTelemetrySummaries = exports.insertTelemetrySummary = void 0;
+exports.getQuickContractRefineLast = exports.updateProjectSettings = exports.getFreestylePrePrompt = exports.getProjectSettings = exports.normalizeWorktreeEnvPassthrough = exports.WORKTREE_ENV_NAME_RE = exports.DEFAULT_FREESTYLE_PRE_PROMPT = exports.getStats = exports.deleteTemplate = exports.updateTemplate = exports.getTemplate = exports.listTemplates = exports.createTemplate = exports.deleteProposal = exports.updateProposal = exports.listProposals = exports.getProposal = exports.createProposal = exports.getMessages = exports.addMessage = exports.updateConversation = exports.deleteConversation = exports.getConversation = exports.listConversations = exports.createConversation = exports.getProjectActivity = exports.JOB_SEARCH_MAX_LIMIT = exports.JOB_SEARCH_DEFAULT_LIMIT = exports.safeIndexJob = exports.rebuildJobSearchIndex = exports.indexJob = exports.searchJobs = exports.getPipelineJobs = exports.skipJob = exports.purgeJobs = exports.deleteJob = exports.JobRecoveryPendingError = exports.getJobEvents = exports.getJob = exports.listJobs = exports.upsertPhase = exports.appendEvent = exports.finishJob = exports.finalizeInteractiveJob = exports.accumulateInteractiveTurn = exports.markJobInteractive = exports.deleteQueuedJob = exports.upsertQueuedJob = exports.createJob = exports.initDb = void 0;
+exports.hasJobTelemetry = exports.getJobsWithTelemetry = exports.deleteTelemetryForJob = exports.getTelemetrySummaries = exports.insertTelemetrySummary = exports.setTelemetryBlobCompacted = exports.listActiveTelemetryBlobs = exports.upsertTelemetryBlob = exports.getTelemetryBlob = exports.setQuickContractRefineLast = exports.hasQuickContractRefineLast = void 0;
 var connection_1 = require("./db/connection");
 Object.defineProperty(exports, "initDb", { enumerable: true, get: function () { return connection_1.initDb; } });
 var jobs_1 = require("./db/jobs");
@@ -22,6 +22,13 @@ Object.defineProperty(exports, "deleteJob", { enumerable: true, get: function ()
 Object.defineProperty(exports, "purgeJobs", { enumerable: true, get: function () { return jobs_1.purgeJobs; } });
 Object.defineProperty(exports, "skipJob", { enumerable: true, get: function () { return jobs_1.skipJob; } });
 Object.defineProperty(exports, "getPipelineJobs", { enumerable: true, get: function () { return jobs_1.getPipelineJobs; } });
+var job_search_1 = require("./db/job-search");
+Object.defineProperty(exports, "searchJobs", { enumerable: true, get: function () { return job_search_1.searchJobs; } });
+Object.defineProperty(exports, "indexJob", { enumerable: true, get: function () { return job_search_1.indexJob; } });
+Object.defineProperty(exports, "rebuildJobSearchIndex", { enumerable: true, get: function () { return job_search_1.rebuildJobSearchIndex; } });
+Object.defineProperty(exports, "safeIndexJob", { enumerable: true, get: function () { return job_search_1.safeIndexJob; } });
+Object.defineProperty(exports, "JOB_SEARCH_DEFAULT_LIMIT", { enumerable: true, get: function () { return job_search_1.JOB_SEARCH_DEFAULT_LIMIT; } });
+Object.defineProperty(exports, "JOB_SEARCH_MAX_LIMIT", { enumerable: true, get: function () { return job_search_1.JOB_SEARCH_MAX_LIMIT; } });
 var activity_1 = require("./db/activity");
 Object.defineProperty(exports, "getProjectActivity", { enumerable: true, get: function () { return activity_1.getProjectActivity; } });
 var conversations_1 = require("./db/conversations");

package/server/dist/desktop-db.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GLOBAL_SUBAGENT_RUNTIME_KEY = exports.GLOBAL_ALLOW_SUBAGENTS_KEY = exports.AGENT_SEARCH_INDEX_DDL = void 0;
+exports.UPDATE_CHANNEL_KEY = exports.GLOBAL_SUBAGENT_RUNTIME_KEY = exports.GLOBAL_ALLOW_SUBAGENTS_KEY = exports.AGENT_SEARCH_INDEX_DDL = void 0;
 exports.setProjectProvidersMirror = setProjectProvidersMirror;
 exports.getDesktopDbPath = getDesktopDbPath;
 exports.rebuildAgentSearchIndex = rebuildAgentSearchIndex;
@@ -22,6 +22,8 @@ exports.touchProject = touchProject;
 exports.getGlobalAllowSubagents = getGlobalAllowSubagents;
 exports.getGlobalSubagentRuntime = getGlobalSubagentRuntime;
 exports.setGlobalSubagentRuntime = setGlobalSubagentRuntime;
+exports.getUpdateChannel = getUpdateChannel;
+exports.setUpdateChannel = setUpdateChannel;
 exports.getDesktopSetting = getDesktopSetting;
 exports.setDesktopSetting = setDesktopSetting;
 exports.setProjectSetupSession = setProjectSetupSession;
@@ -42,6 +44,7 @@ exports.getWebhook = getWebhook;
 exports.addWebhook = addWebhook;
 exports.updateWebhook = updateWebhook;
 exports.removeWebhook = removeWebhook;
+exports.sumFlowInvocations = sumFlowInvocations;
 const project_settings_1 = require("./modules/project-settings");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -51,6 +54,7 @@ const secure_fs_1 = require("./util/secure-fs");
 const sqlite_migrations_1 = require("./util/sqlite-migrations");
 const crypto_1 = require("crypto");
 const project_repositories_1 = require("./project-repositories");
+const update_channel_1 = require("./update-channel");
 function parseProviders(raw, primary) {
     if (raw) {
         try {
@@ -756,6 +760,67 @@ function applyDesktopMigrations(db) {
             if (!columns.includes('delegated_model'))
                 db.exec('ALTER TABLE agent_subagents ADD COLUMN delegated_model TEXT');
         },
+        // 35: flow-subagents — a mission conversation can own more than one Core
+        // session (its own and its Flow's `flow:<flowId>`). The projection cursor
+        // is keyed by (conversation, Core session) and each sub-agent records the
+        // session that launched it, so Flow usage never mixes with the mission's.
+        // Existing rows belong to the mission session (core_session_id =
+        // conversation_id). Rebuild/column guarded for migration replay fixtures.
+        () => {
+            const cursorPk = db.prepare('PRAGMA table_info(agent_session_cursors)').all().filter((c) => c.pk > 0).map((c) => c.name);
+            if (!cursorPk.includes('core_session_id')) {
+                db.exec(`
+          CREATE TABLE agent_session_cursors_v35 (
+            conversation_id TEXT NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
+            core_session_id TEXT NOT NULL,
+            scope TEXT NOT NULL,
+            last_seq INTEGER NOT NULL DEFAULT 0,
+            resident_phase TEXT NOT NULL DEFAULT 'idle' CHECK (resident_phase IN ('idle', 'turn', 'background')),
+            process_alive INTEGER NOT NULL DEFAULT 0,
+            live_subagents INTEGER NOT NULL DEFAULT 0,
+            updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+            PRIMARY KEY (conversation_id, core_session_id)
+          );
+          INSERT INTO agent_session_cursors_v35 (conversation_id, core_session_id, scope, last_seq, resident_phase, process_alive, live_subagents, updated_at)
+            SELECT conversation_id, core_session_id, scope, last_seq, resident_phase, process_alive, live_subagents, updated_at FROM agent_session_cursors;
+          DROP TABLE agent_session_cursors;
+          ALTER TABLE agent_session_cursors_v35 RENAME TO agent_session_cursors;
+        `);
+            }
+            const columns = db.prepare('PRAGMA table_info(agent_subagents)').all().map((c) => c.name);
+            if (!columns.includes('core_session_id'))
+                db.exec('ALTER TABLE agent_subagents ADD COLUMN core_session_id TEXT');
+            db.exec(`
+        UPDATE agent_subagents SET core_session_id = conversation_id WHERE core_session_id IS NULL;
+        CREATE INDEX IF NOT EXISTS idx_agent_subagents_session ON agent_subagents(conversation_id, core_session_id);
+      `);
+        },
+        // 36: mission-core-session-generations — a Core session is bound to the
+        // driver that opened it, so a provider switch (or a closed session) moves
+        // the mission to a new session. Generation 0 keeps the historical id (the
+        // conversation id); generation n uses `<conversationId>:g<n>`. `provider`
+        // records the driver the current generation was opened with (null =
+        // unknown for pre-existing sessions; the turn verifies it against Core).
+        () => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS agent_core_sessions (
+          conversation_id TEXT PRIMARY KEY REFERENCES agent_conversations(id) ON DELETE CASCADE,
+          generation INTEGER NOT NULL DEFAULT 0 CHECK (generation >= 0),
+          provider TEXT,
+          updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+      `);
+        },
+        // 37: undo-instead-of-confirm — a deleted mission is SOFT-deleted: `deleted_at`
+        // hides it from every list/search and starts its 30-day "Recently deleted"
+        // window (restore clears it; the purge hard-deletes expired rows). NULL =
+        // live, which is every pre-existing row.
+        () => {
+            const cols = new Set(db.prepare('PRAGMA table_info(agent_conversations)').all().map((c) => c.name));
+            if (!cols.has('deleted_at'))
+                db.exec(`ALTER TABLE agent_conversations ADD COLUMN deleted_at TEXT;`);
+            db.exec(`CREATE INDEX IF NOT EXISTS idx_agent_conversations_deleted_at ON agent_conversations(deleted_at) WHERE deleted_at IS NOT NULL;`);
+        },
     ];
     (0, sqlite_migrations_1.applyNumberedMigrations)(db, migrations);
 }
@@ -878,10 +943,10 @@ function removeProject(db, id) {
 function touchProject(db, id) {
     db.prepare("UPDATE projects SET last_seen_at = datetime('now') WHERE id = ?").run(id);
 }
-/** App-global "Allow sub-agents" for missions without a project (default off). */
+/** App-global "Allow sub-agents" for missions without a project (default on; only an explicit opt-out disables it). */
 exports.GLOBAL_ALLOW_SUBAGENTS_KEY = 'agent_allow_subagents';
 function getGlobalAllowSubagents(db) {
-    return getDesktopSetting(db, exports.GLOBAL_ALLOW_SUBAGENTS_KEY) === 'true';
+    return getDesktopSetting(db, exports.GLOBAL_ALLOW_SUBAGENTS_KEY) !== 'false';
 }
 /** App-wide "Run sub-agents with" for missions without a project; null = the mission agent's provider. */
 exports.GLOBAL_SUBAGENT_RUNTIME_KEY = 'agent_subagent_runtime';
@@ -902,6 +967,16 @@ function setGlobalSubagentRuntime(db, value) {
     else
         setDesktopSetting(db, exports.GLOBAL_SUBAGENT_RUNTIME_KEY, JSON.stringify(value));
 }
+/** App-global release channel for Desktop and Core updates (default `latest`). */
+exports.UPDATE_CHANNEL_KEY = 'update_channel';
+function getUpdateChannel(db) {
+    return (0, update_channel_1.parseUpdateChannel)(getDesktopSetting(db, exports.UPDATE_CHANNEL_KEY));
+}
+function setUpdateChannel(db, channel) {
+    if (!(0, update_channel_1.isUpdateChannel)(channel))
+        throw new Error('updateChannel must be "latest" or "stable"');
+    setDesktopSetting(db, exports.UPDATE_CHANNEL_KEY, channel);
+}
 function getDesktopSetting(db, key) {
     const row = db.prepare('SELECT value FROM desktop_settings WHERE key = ?').get(key);
     return row?.value;
@@ -926,8 +1001,8 @@ function recordAgentInvocation(db, input) {
       started_at, finished_at, duration_ms, duration_api_ms,
       tokens_in, tokens_out, tokens_cache_read, tokens_cache_create,
       total_cost_usd, total_cost_usd_estimated, num_turns, session_id, origin
-    ) VALUES (?, ?, ?, ?, 'agent-chat', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(input.id, input.conversation_id, input.project_id ?? null, input.provider, input.model ?? null, input.status, input.started_at, input.finished_at ?? null, input.duration_ms ?? null, input.duration_api_ms ?? null, input.tokens_in ?? null, input.tokens_out ?? null, input.tokens_cache_read ?? null, input.tokens_cache_create ?? null, input.total_cost_usd ?? null, input.total_cost_usd_estimated ? 1 : 0, input.num_turns ?? null, input.session_id ?? null, input.origin ?? 'user');
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(input.id, input.conversation_id, input.project_id ?? null, input.provider, input.surface ?? 'agent-chat', input.model ?? null, input.status, input.started_at, input.finished_at ?? null, input.duration_ms ?? null, input.duration_api_ms ?? null, input.tokens_in ?? null, input.tokens_out ?? null, input.tokens_cache_read ?? null, input.tokens_cache_create ?? null, input.total_cost_usd ?? null, input.total_cost_usd_estimated ? 1 : 0, input.num_turns ?? null, input.session_id ?? null, input.origin ?? 'user');
 }
 /**
  * Sum of all agent-chat turn costs, optionally since an ISO instant (inclusive).
@@ -1025,3 +1100,22 @@ function updateWebhook(db, id, updates) {
 function removeWebhook(db, id) {
     db.prepare('DELETE FROM webhooks WHERE id = ?').run(id);
 }
+/**
+ * Real usage of a conversation's Flow turns in a time window (Flow bar).
+ * `costUsd` sums ONLY provider-billed cost; turns whose cost was estimated (or
+ * unknown) are counted in `unpricedTurns` and never added. Tokens are the
+ * provider-reported counts.
+ */
+function sumFlowInvocations(db, input) {
+    const row = db.prepare(`
+    SELECT
+      COALESCE(SUM(CASE WHEN total_cost_usd_estimated = 0 AND total_cost_usd IS NOT NULL THEN total_cost_usd ELSE 0 END), 0) AS costUsd,
+      COUNT(*) AS turns,
+      COALESCE(SUM(CASE WHEN total_cost_usd_estimated = 1 OR total_cost_usd IS NULL THEN 1 ELSE 0 END), 0) AS unpricedTurns,
+      COALESCE(SUM(tokens_in), 0) AS tokensIn,
+      COALESCE(SUM(tokens_out), 0) AS tokensOut
+    FROM agent_invocations
+    WHERE conversation_id = ? AND surface = 'flow' AND started_at >= ? AND (? IS NULL OR started_at <= ?)
+  `).get(input.conversationId, input.from, input.to, input.to);
+    return row;
+}