specrails-desktop 2.8.0 → 2.9.0

package/server/dist/jira/jira-sync-manager.js

@@ -20,6 +20,7 @@ const jira_materializer_1 = require("./jira-materializer");
 const jira_issue_fields_1 = require("./jira-issue-fields");
 const jira_status_resolver_1 = require("./jira-status-resolver");
 const jira_db_1 = require("./jira-db");
+const workspace_resolution_1 = require("../workspace-resolution");
 const POLL_INTERVAL_MS = 60_000;
 const DRAIN_INTERVAL_MS = 10_000;
 const POLL_OVERLAP_MS = 2 * 60_000;
@@ -54,6 +55,17 @@ class JiraSyncManager {
         if (opts.startTimers !== false)
             this.start();
     }
+    /**
+     * Relocate-artifacts gate: the directory whose `.specrails/{local-tickets,
+     * backlog-config}.json` Jira sync reads/writes. Relocated ⇒ the workspace dir
+     * (the path-deriving helpers join `.specrails/...` under it); legacy ⇒
+     * project.path (byte-identical for existing projects). All Jira artifact I/O
+     * funnels through here.
+     */
+    _artifactRoot() {
+        const exec = (0, workspace_resolution_1.resolveProjectExecution)({ path: this.projectPath });
+        return exec.relocated && exec.workspaceDir ? exec.workspaceDir : this.projectPath;
+    }
     /** Suppress the file-watcher echo for a local write we just made. */
     notifyLocalWrite(revision) {
         try {
@@ -185,7 +197,7 @@ class JiraSyncManager {
         if (input.discardStatus !== undefined) {
             (0, jira_db_1.setDiscardStatus)(this.db, this.projectId, input.discardStatus);
         }
-        (0, jira_backlog_config_1.writeJiraBacklogConfig)(this.projectPath);
+        (0, jira_backlog_config_1.writeJiraBacklogConfig)(this._artifactRoot());
         // Discover the sprint custom-field id (best-effort) so sprint capture works
         // from the first poll. Non-fatal — the poll re-discovers if this fails.
         try {
@@ -248,11 +260,11 @@ class JiraSyncManager {
     setEnabled(enabled) {
         (0, jira_db_1.setConnectionEnabled)(this.db, this.projectId, enabled);
         if (enabled) {
-            (0, jira_backlog_config_1.writeJiraBacklogConfig)(this.projectPath);
+            (0, jira_backlog_config_1.writeJiraBacklogConfig)(this._artifactRoot());
             this.start();
         }
         else {
-            (0, jira_backlog_config_1.writeLocalBacklogConfig)(this.projectPath);
+            (0, jira_backlog_config_1.writeLocalBacklogConfig)(this._artifactRoot());
         }
     }
     /** Configure (or clear) the status a discarded spec is moved to. */
@@ -289,7 +301,7 @@ class JiraSyncManager {
     /** Remove the connection entirely and restore local backlog config. */
     disconnect() {
         (0, jira_db_1.deleteConnection)(this.db, this.projectId);
-        (0, jira_backlog_config_1.writeLocalBacklogConfig)(this.projectPath);
+        (0, jira_backlog_config_1.writeLocalBacklogConfig)(this._artifactRoot());
         this.stop();
     }
     // ─── Create a spec in Jira (Add Spec when source = Jira) ───────────────────
@@ -323,11 +335,11 @@ class JiraSyncManager {
         const issue = full.ok
             ? full.data
             : { id: created.data.id, key: created.data.key, fields: { summary: input.title, labels: input.labels ?? [] } };
-        const r = (0, jira_materializer_1.upsertIssuesIntoStore)(this.db, this.projectPath, conn, [issue], new Set());
+        const r = (0, jira_materializer_1.upsertIssuesIntoStore)(this.db, this._artifactRoot(), conn, [issue], new Set());
         if (r.wrote)
             this.notifyLocalWrite(r.revision);
         const localId = r.changedLocalIds[0];
-        const t = readTicket(this.projectPath, localId);
+        const t = readTicket(this._artifactRoot(), localId);
         if (t)
             this.broadcast({ type: 'ticket_created', ticket: t, projectId: this.projectId, timestamp: t.updated_at });
         return { ok: true, localId, jiraKey: created.data.key };
@@ -351,7 +363,7 @@ class JiraSyncManager {
         const client = this.buildClient();
         if (!client)
             return { ok: false, error: 'no jira credentials' };
-        const file = (0, ticket_store_1.resolveTicketStoragePath)(this.projectPath);
+        const file = (0, ticket_store_1.resolveTicketStoragePath)(this._artifactRoot());
         const ticket = (0, ticket_store_1.readStore)(file).tickets[String(localId)];
         if (!ticket)
             return { ok: false, error: 'ticket not found' };
@@ -449,7 +461,7 @@ class JiraSyncManager {
             }
             const issues = res.data.issues ?? [];
             if (issues.length > 0) {
-                const r = (0, jira_materializer_1.upsertIssuesIntoStore)(this.db, this.projectPath, conn, issues, frozen);
+                const r = (0, jira_materializer_1.upsertIssuesIntoStore)(this.db, this._artifactRoot(), conn, issues, frozen);
                 // Suppress the watcher echo for our own write (avoids the full-board
                 // refresh flicker). When nothing changed, `wrote` is false and we also
                 // skip the granular broadcasts below — the board stays perfectly still.
@@ -459,7 +471,7 @@ class JiraSyncManager {
                 if (r.maxUpdatedMs > maxUpdated)
                     maxUpdated = r.maxUpdatedMs;
                 for (const localId of r.changedLocalIds) {
-                    const t = readTicket(this.projectPath, localId);
+                    const t = readTicket(this._artifactRoot(), localId);
                     if (t)
                         this.broadcast({ type: 'ticket_updated', ticket: t, projectId: this.projectId, timestamp: t.updated_at });
                 }
@@ -826,7 +838,7 @@ class JiraSyncManager {
         if (localIds.length === 0)
             return;
         try {
-            const file = (0, ticket_store_1.resolveTicketStoragePath)(this.projectPath);
+            const file = (0, ticket_store_1.resolveTicketStoragePath)(this._artifactRoot());
             const ids = new Set(localIds.map(String));
             const now = new Date().toISOString();
             const store = (0, ticket_store_1.mutateStore)(file, (s) => {
@@ -885,7 +897,7 @@ class JiraSyncManager {
         const metaRes = await client.getFieldsFull();
         const fieldMeta = metaRes.ok ? metaRes.data : [];
         // 3) Materialized ticket flags suppress already-shown info (no extra HTTP).
-        const ticket = (0, ticket_store_1.readStore)((0, ticket_store_1.resolveTicketStoragePath)(this.projectPath)).tickets[String(localId)];
+        const ticket = (0, ticket_store_1.readStore)((0, ticket_store_1.resolveTicketStoragePath)(this._artifactRoot())).tickets[String(localId)];
         const fields = (0, jira_issue_fields_1.formatIssueFields)({
             fields: issueRes.data.fields,
             fieldMeta,

package/server/dist/openspec-shim.js

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENSPEC_NPX_SPEC = void 0;
+exports.openspecShimDir = openspecShimDir;
+exports.ensureOpenspecShim = ensureOpenspecShim;
+exports.prependShimToPath = prependShimToPath;
+exports.removeOpenspecShim = removeOpenspecShim;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const bundled_openspec_1 = require("./bundled-openspec");
+/**
+ * openspec PATH shim — the robustness backstop for relocated Claude rails.
+ *
+ * THE PROBLEM. When a project's artifacts are RELOCATED to the home workspace,
+ * the rail's `claude` child is spawned with `cwd = <workspace>`. The repo's
+ * `openspec/` tree (changes, specs, .git) lives in the REPO, not the workspace.
+ * specrails-core's stage-3 templates wrap repo-resident `openspec <verb>` calls
+ * in `(cd "${SPECRAILS_REPO_DIR:-.}" && openspec …)` so they land in the repo —
+ * but a BARE `openspec …` that a skill, sub-agent, or an un-wrapped template
+ * line emits would run from the workspace cwd, where there is no OpenSpec
+ * project → "Error: not an OpenSpec project".
+ *
+ * THE FIX. For a relocated rail we materialize a per-job shim directory and
+ * PREPEND it to the spawn `PATH`. It contains an `openspec` executable (POSIX
+ * `sh` script + a Windows `openspec.cmd`) that unconditionally does:
+ *
+ *     cd "$SPECRAILS_REPO_DIR" && exec <real openspec> "$@"
+ *
+ * so EVERY `openspec` invocation — wrapped OR bare, skill- OR template-driven —
+ * resolves against the repo. The "real openspec" is the bundled openspec
+ * (`node <cli>`) when present, else the legacy `npx @fission-ai/openspec@<pin>`.
+ *
+ * EXISTENCE-GATED. Only injected for a RELOCATED rail. Legacy (in-repo) rails
+ * spawn from the repo cwd where a bare `openspec` already resolves correctly, so
+ * the shim is never created and `PATH` is byte-identical to today.
+ */
+/** Pinned openspec npm spec for the `npx` fallback when no bundled openspec is
+ *  present. Matches specrails-core's `pinned-versions.json` openspec pin and the
+ *  desktop OPENSPEC_BUNDLE_VERSION in the release workflow. */
+exports.OPENSPEC_NPX_SPEC = '@fission-ai/openspec@1.4.1';
+/** `~/.specrails/projects/<slug>/openspec-shim/<jobId>` — the per-job shim dir. */
+function openspecShimDir(slug, jobId, home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.specrails', 'projects', slug, 'openspec-shim', jobId);
+}
+/**
+ * Build the command the shim should `exec` to run the REAL openspec, as an argv
+ * array already shell-quoted into a single string. Prefers the bundled openspec
+ * (`node <cli>`); falls back to `npx -y <pinned openspec>`.
+ */
+function realOpenspecInvocation() {
+    const cli = (0, bundled_openspec_1.getBundledOpenspecCli)();
+    if (cli) {
+        // node "<cli>" — invoke the bundled openspec as a node script (Tauri strips
+        // exec bits from bundled resources, so it can't be run as a binary).
+        return {
+            posix: `node ${shq(cli)}`,
+            windows: `node ${winq(cli)}`,
+        };
+    }
+    // Legacy fallback: npx resolves + caches openspec. `-y` skips the install
+    // confirmation prompt (rails are headless).
+    return {
+        posix: `npx -y ${shq(exports.OPENSPEC_NPX_SPEC)}`,
+        windows: `npx -y ${winq(exports.OPENSPEC_NPX_SPEC)}`,
+    };
+}
+/** POSIX single-quote a string for embedding in an `sh` script. */
+function shq(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/** Windows double-quote a string for a `.cmd` script. */
+function winq(s) {
+    return `"${s.replace(/"/g, '""')}"`;
+}
+/**
+ * Materialize the per-job openspec shim directory and return its absolute path
+ * (to be PREPENDED to the spawn PATH). Writes both an `openspec` POSIX script
+ * (chmod 755 inside a 700 dir) and an `openspec.cmd` for Windows. The shim cd's
+ * into `$SPECRAILS_REPO_DIR` (defaulting to `.` so a missing var degrades to the
+ * cwd) before exec'ing the real openspec, so the repo's OpenSpec project is
+ * always the one operated on.
+ *
+ * Returns null when the shim could not be created (best-effort — a failure must
+ * never block a spawn; the rail still runs, just without the shim's safety net).
+ */
+function ensureOpenspecShim(slug, jobId, home = os_1.default.homedir()) {
+    try {
+        const dir = openspecShimDir(slug, jobId, home);
+        fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        try {
+            fs_1.default.chmodSync(dir, 0o700);
+        }
+        catch {
+            /* chmod may be unsupported (Windows) — non-fatal */
+        }
+        const { posix, windows } = realOpenspecInvocation();
+        // POSIX shim: `openspec` (no extension). `${SPECRAILS_REPO_DIR:-.}` makes a
+        // missing var degrade to the current dir instead of an unbound-var error.
+        const posixScript = '#!/bin/sh\n' +
+            '# Auto-generated by specrails-desktop (relocated-rail openspec shim).\n' +
+            '# Re-points every bare `openspec` call at the repo working tree.\n' +
+            'cd "${SPECRAILS_REPO_DIR:-.}" || exit 1\n' +
+            `exec ${posix} "$@"\n`;
+        const posixPath = path_1.default.join(dir, 'openspec');
+        fs_1.default.writeFileSync(posixPath, posixScript, { mode: 0o755 });
+        try {
+            fs_1.default.chmodSync(posixPath, 0o755);
+        }
+        catch {
+            /* non-fatal */
+        }
+        // Windows shim: `openspec.cmd`. cmd.exe resolves `openspec` to this on PATH.
+        const winScript = '@echo off\r\n' +
+            'rem Auto-generated by specrails-desktop (relocated-rail openspec shim).\r\n' +
+            'if defined SPECRAILS_REPO_DIR cd /d "%SPECRAILS_REPO_DIR%"\r\n' +
+            `${windows} %*\r\n`;
+        fs_1.default.writeFileSync(path_1.default.join(dir, 'openspec.cmd'), winScript);
+        return dir;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Prepend `shimDir` to a PATH string using the platform delimiter, de-duping a
+ * leading entry that already equals `shimDir`. Returns the original `pathValue`
+ * unchanged when `shimDir` is null/empty.
+ */
+function prependShimToPath(pathValue, shimDir) {
+    const base = pathValue ?? '';
+    if (!shimDir)
+        return base;
+    const sep = path_1.default.delimiter;
+    const segments = base.split(sep).filter((s) => s.length > 0);
+    if (segments[0] === shimDir)
+        return base;
+    return [shimDir, ...segments].join(sep);
+}
+/** Remove a per-job shim dir (best-effort cleanup). No-op when absent. */
+function removeOpenspecShim(slug, jobId, home = os_1.default.homedir()) {
+    try {
+        const dir = openspecShimDir(slug, jobId, home);
+        if (fs_1.default.existsSync(dir))
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        /* best-effort */
+    }
+}

package/server/dist/plugins-router.js

@@ -7,6 +7,17 @@ const manager_1 = require("./plugins/manager");
 const prereq_installer_1 = require("./plugins/prereq-installer");
 const path_resolver_1 = require("./path-resolver");
 const claude_approval_1 = require("./plugins/claude-approval");
+const workspace_resolution_1 = require("./workspace-resolution");
+/**
+ * Relocate-artifacts gate: the dir the PluginManager mutates (`.mcp.json` +
+ * `.specrails/plugins/` state + `.claude/agents/custom-*.md`). Relocated ⇒ the
+ * workspace (so the relocated CLI, spawned with cwd=workspace, loads the
+ * `.mcp.json` the manager wrote); legacy ⇒ project.path (byte-identical).
+ */
+function pluginRoot(project) {
+    const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: project.slug, path: project.path });
+    return exec.relocated && exec.workspaceDir ? exec.workspaceDir : project.path;
+}
 function pluginsSectionEnabled() {
     return process.env.SPECRAILS_PLUGINS_SECTION !== 'false';
 }
@@ -46,7 +57,7 @@ function createPluginsRouter() {
     router.get('/', async (req, res) => {
         try {
             const { project } = ctx(req);
-            const list = await (0, manager_1.getPluginManager)().listAvailable(project.path, project.provider);
+            const list = await (0, manager_1.getPluginManager)().listAvailable(pluginRoot(project), project.provider);
             res.json({ plugins: list });
         }
         catch (err) {
@@ -57,7 +68,7 @@ function createPluginsRouter() {
     router.get('/:name/preview-install', async (req, res) => {
         try {
             const { project } = ctx(req);
-            const result = await (0, manager_1.getPluginManager)().previewInstall(project.path, project.id, req.params.name);
+            const result = await (0, manager_1.getPluginManager)().previewInstall(pluginRoot(project), project.id, req.params.name);
             res.json(result);
         }
         catch (err) {
@@ -68,7 +79,7 @@ function createPluginsRouter() {
     router.post('/:name/install', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().install(project.path, project.id, req.params.name, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().install(pluginRoot(project), project.id, req.params.name, broadcast, project.provider);
             res.status(200).json({ ok: true });
         }
         catch (err) {
@@ -79,7 +90,7 @@ function createPluginsRouter() {
     router.delete('/:name', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().uninstall(project.path, project.id, req.params.name, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().uninstall(pluginRoot(project), project.id, req.params.name, broadcast, project.provider);
             res.status(200).json({ ok: true });
         }
         catch (err) {
@@ -171,7 +182,7 @@ function createPluginsRouter() {
     router.post('/:name/activate', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().setActive(project.path, project.id, req.params.name, true, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().setActive(pluginRoot(project), project.id, req.params.name, true, broadcast, project.provider);
             res.json({ ok: true });
         }
         catch (err) {
@@ -182,7 +193,7 @@ function createPluginsRouter() {
     router.post('/:name/deactivate', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().setActive(project.path, project.id, req.params.name, false, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().setActive(pluginRoot(project), project.id, req.params.name, false, broadcast, project.provider);
             res.json({ ok: true });
         }
         catch (err) {
@@ -193,7 +204,7 @@ function createPluginsRouter() {
     router.post('/:name/update', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            await (0, manager_1.getPluginManager)().updateMcpEntry(project.path, project.id, req.params.name, broadcast, project.provider);
+            await (0, manager_1.getPluginManager)().updateMcpEntry(pluginRoot(project), project.id, req.params.name, broadcast, project.provider);
             res.json({ ok: true });
         }
         catch (err) {
@@ -204,7 +215,7 @@ function createPluginsRouter() {
     router.get('/:name/health', async (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            const result = await (0, manager_1.getPluginManager)().verify(project.path, project.id, req.params.name, broadcast);
+            const result = await (0, manager_1.getPluginManager)().verify(pluginRoot(project), project.id, req.params.name, broadcast);
             res.json(result);
         }
         catch (err) {

package/server/dist/profiles-router.js

@@ -12,6 +12,27 @@ const agent_refine_db_1 = require("./agent-refine-db");
 const agent_refine_manager_1 = require("./agent-refine-manager");
 const providers_1 = require("./providers");
 const profile_manager_1 = require("./profile-manager");
+const workspace_resolution_1 = require("./workspace-resolution");
+/**
+ * Relocate-artifacts gate: the dir whose `.specrails/{profiles,specrails-version}`
+ * AND whose `.claude/agents/**` catalog the profiles surface reads/writes.
+ * Relocated ⇒ the workspace dir (where core assembled the agents catalog +
+ * `.specrails/profiles`); legacy ⇒ project.path (byte-identical to today).
+ *
+ * The `.claude/agents/**` catalog MUST follow this same root: when relocated,
+ * core materializes the agents into `<workspace>/.claude/agents`, so a profiles
+ * catalog read/write rooted at `project.path` would (a) read a stale/absent repo
+ * copy and (b) write custom-* agents into the repo — violating repo-immutability
+ * and never reaching the workspace the rails actually load from.
+ */
+function specRoot(project) {
+    const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: project.slug, path: project.path });
+    return exec.relocated && exec.workspaceDir ? exec.workspaceDir : project.path;
+}
+/** The agents-catalog directory for the relocate-aware root (`<root>/.claude/agents`). */
+function agentsCatalogDir(project) {
+    return path_1.default.join(specRoot(project), '.claude', 'agents');
+}
 const AGENTS_SECTION_ENABLED = process.env.SPECRAILS_AGENTS_SECTION !== 'false';
 function handleError(res, err) {
     if (err instanceof profile_manager_1.ProfileValidationError) {
@@ -48,7 +69,7 @@ function createProfilesRouter() {
     router.post('/migrate-from-settings', (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            const agentsDir = path_1.default.join(project.path, '.claude', 'agents');
+            const agentsDir = agentsCatalogDir(project);
             if (!fs_1.default.existsSync(agentsDir)) {
                 res.status(400).json({ error: 'no .claude/agents/ directory found' });
                 return;
@@ -129,7 +150,7 @@ function createProfilesRouter() {
                 ],
             };
             try {
-                (0, profile_manager_1.createProfile)(project.path, profile, provider);
+                (0, profile_manager_1.createProfile)(specRoot(project), profile, provider);
             }
             catch (err) {
                 if (err instanceof profile_manager_1.ProfileConflictError) {
@@ -189,8 +210,9 @@ function createProfilesRouter() {
     router.get('/core-version', (req, res) => {
         try {
             const { project } = ctx(req);
+            const root = specRoot(project);
             const candidates = [
-                path_1.default.join(project.path, '.specrails', 'specrails-version'),
+                path_1.default.join(root, '.specrails', 'specrails-version'),
                 path_1.default.join(project.path, '.specrails-version'),
             ];
             let version = null;
@@ -230,7 +252,7 @@ function createProfilesRouter() {
     router.get('/catalog', (req, res) => {
         try {
             const { project } = ctx(req);
-            const dir = path_1.default.join(project.path, '.claude', 'agents');
+            const dir = agentsCatalogDir(project);
             if (!fs_1.default.existsSync(dir)) {
                 res.json({ agents: [] });
                 return;
@@ -305,7 +327,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: 'invalid agent id' });
                 return;
             }
-            const file = path_1.default.join(project.path, '.claude', 'agents', `${agentId}.md`);
+            const file = path_1.default.join(agentsCatalogDir(project), `${agentId}.md`);
             if (!fs_1.default.existsSync(file)) {
                 res.status(404).json({ error: 'agent not found' });
                 return;
@@ -333,7 +355,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: 'body is required' });
                 return;
             }
-            const agentsDir = path_1.default.join(project.path, '.claude', 'agents');
+            const agentsDir = agentsCatalogDir(project);
             fs_1.default.mkdirSync(agentsDir, { recursive: true });
             const file = path_1.default.join(agentsDir, `${id}.md`);
             if (fs_1.default.existsSync(file)) {
@@ -366,7 +388,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: 'body is required' });
                 return;
             }
-            const file = path_1.default.join(project.path, '.claude', 'agents', `${agentId}.md`);
+            const file = path_1.default.join(agentsCatalogDir(project), `${agentId}.md`);
             if (!fs_1.default.existsSync(file)) {
                 res.status(404).json({ error: 'agent not found' });
                 return;
@@ -394,7 +416,7 @@ function createProfilesRouter() {
                 res.status(403).json({ error: 'only custom-* agents can be deleted' });
                 return;
             }
-            const file = path_1.default.join(project.path, '.claude', 'agents', `${agentId}.md`);
+            const file = path_1.default.join(agentsCatalogDir(project), `${agentId}.md`);
             if (!fs_1.default.existsSync(file)) {
                 res.status(404).json({ error: 'agent not found' });
                 return;
@@ -647,7 +669,7 @@ function createProfilesRouter() {
     router.get('/', (req, res) => {
         try {
             const { project } = ctx(req);
-            res.json({ profiles: (0, profile_manager_1.listProfiles)(project.path) });
+            res.json({ profiles: (0, profile_manager_1.listProfiles)(specRoot(project)) });
         }
         catch (err) {
             handleError(res, err);
@@ -658,7 +680,7 @@ function createProfilesRouter() {
         try {
             const { project } = ctx(req);
             const explicit = typeof req.query.profile === 'string' ? req.query.profile : undefined;
-            const resolved = (0, profile_manager_1.resolveProfile)(project.path, explicit, project.provider ?? 'claude');
+            const resolved = (0, profile_manager_1.resolveProfile)(specRoot(project), explicit, project.provider ?? 'claude');
             if (!resolved) {
                 res.json({ resolved: null });
                 return;
@@ -674,7 +696,7 @@ function createProfilesRouter() {
         try {
             const { project, broadcast } = ctx(req);
             const body = req.body;
-            (0, profile_manager_1.createProfile)(project.path, body, project.provider ?? 'claude');
+            (0, profile_manager_1.createProfile)(specRoot(project), body, project.provider ?? 'claude');
             broadcast({ type: 'profile.changed', projectId: project.id, name: body.name });
             res.status(201).json({ profile: body });
         }
@@ -691,7 +713,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: "body field 'name' is required" });
                 return;
             }
-            const copy = (0, profile_manager_1.duplicateProfile)(project.path, req.params.name, newName, project.provider ?? 'claude');
+            const copy = (0, profile_manager_1.duplicateProfile)(specRoot(project), req.params.name, newName, project.provider ?? 'claude');
             broadcast({ type: 'profile.changed', projectId: project.id, name: newName });
             res.status(201).json({ profile: copy });
         }
@@ -708,7 +730,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: "body field 'name' is required" });
                 return;
             }
-            const renamed = (0, profile_manager_1.renameProfile)(project.path, req.params.name, newName, project.provider ?? 'claude');
+            const renamed = (0, profile_manager_1.renameProfile)(specRoot(project), req.params.name, newName, project.provider ?? 'claude');
             broadcast({ type: 'profile.changed', projectId: project.id, name: newName });
             res.json({ profile: renamed });
         }
@@ -720,7 +742,7 @@ function createProfilesRouter() {
     router.get('/:name', (req, res) => {
         try {
             const { project } = ctx(req);
-            res.json({ profile: (0, profile_manager_1.getProfile)(project.path, req.params.name, project.provider ?? 'claude') });
+            res.json({ profile: (0, profile_manager_1.getProfile)(specRoot(project), req.params.name, project.provider ?? 'claude') });
         }
         catch (err) {
             handleError(res, err);
@@ -735,7 +757,7 @@ function createProfilesRouter() {
                 res.status(400).json({ error: "body.name must match path parameter (use /rename to change name)" });
                 return;
             }
-            (0, profile_manager_1.updateProfile)(project.path, body, project.provider ?? 'claude');
+            (0, profile_manager_1.updateProfile)(specRoot(project), body, project.provider ?? 'claude');
             broadcast({ type: 'profile.changed', projectId: project.id, name: body.name });
             res.json({ profile: body });
         }
@@ -747,7 +769,7 @@ function createProfilesRouter() {
     router.delete('/:name', (req, res) => {
         try {
             const { project, broadcast } = ctx(req);
-            (0, profile_manager_1.deleteProfile)(project.path, req.params.name);
+            (0, profile_manager_1.deleteProfile)(specRoot(project), req.params.name);
             broadcast({ type: 'profile.changed', projectId: project.id, name: req.params.name, deleted: true });
             res.json({ ok: true });
         }