# Provisioning Repository - Changes --- ## 2026-06-08 — provisioning-desktop: NATS auto-start + configurable launchers (ADR-049) Refines ADR-048 by extending what the shell does on the local host. **Generalized process supervision**: the daemon supervisor is extracted into a process-agnostic `ProcessSupervisor` driven by a `ProcessSpec` (spawn + health + restart-backoff + graceful SIGTERM→SIGKILL, port pre-check). The daemon (HTTP `/health`) and a local `nats-server` (TCP-connect health) are two specs on one shared path; `DaemonStatus`/`DaemonControl` are kept as aliases so existing code is untouched and the backoff tests are preserved. **NATS auto-start (local-or-remote, like the daemon)**: a local `nats-server` is spawned and supervised **only when `nats.spawn` is set AND `nats.url` is loopback** (`-a -p -js`), started *before* the daemon and awaited (bounded) so the daemon and consumer bridge find it listening. The same port pre-check **adopts** an already-running external server instead of double-spawning. Remote `nats.url` stays connect-only — never spawned. Absent `nats-server` degrades to the REST poller, not a panic. **Configurable launchers** (replaces tray `actions`): a unified `Launcher { kind, label, target, args, params, show_output, confirm }` declared **per-connection and globally**, merged in the tray. `kind=url` opens the OS browser (platform opener); `kind=command` runs a local program host-side via `tokio::process`, capturing stdout/stderr into a reusable bundled output window (`dist/output.html`); `kind=tool` invokes a daemon `/api/v1` tool (the former action). Legacy `[[connections.actions]]` TOML migrates transparently (serde `alias = "actions"`, defaulted `kind=tool`, `tool`→`target` alias). **Security boundary**: command execution is **host-side only** — in the Rust tray handler, sourced from the local `settings.toml`, and deliberately **not** a Tauri command — so the external `/ui/` webview (no invoke) and remote connections cannot trigger host execution. Preserves the ADR-048 host-bridge boundary. **Settings form**: the bundled settings window gains a Launchers editor (scope selector, kind-aware fields, JSON params validation); `save_settings` now carries the `AppHandle` and rebuilds the tray so edits appear immediately. **Verified**: `cargo clippy -p provisioning-desktop --all-targets -- -D warnings` clean; `cargo test -p provisioning-desktop` → 34 passed (incl. legacy `actions`→launcher migration, NATS loopback-spawn gating, host/port parsing). **Also — daemon UI SPA fix** (`provisioning-daemon/ui/templates/base.html`): the SPA router dropped per-page `` `