@aitne/daemon 0.1.0

package/dist/core/dashboard-session-cleanup.js

@@ -0,0 +1,108 @@
+import { CHAT_SIDEBAR_SCOPES, isChatSidebarScope } from "@aitne/shared";
+import { createLogger } from "../logging.js";
+import { cleanupSessionWorkdir, getSessionWorkdirPath } from "./workdir.js";
+const logger = createLogger("dashboard-session-cleanup");
+/**
+ * Delete every non-active chat-sidebar session in a single statement.
+ *
+ * Using `DELETE ... RETURNING id` collapses the original SELECT-then-DELETE
+ * into one atomic operation, which closes two bugs in the previous
+ * implementation:
+ *   1. TOCTOU: a session could flip from `closed` → `active` between the
+ *      SELECT (that captured its id) and the DELETE (that trusted the id
+ *      blindly), causing the live session to be destroyed.
+ *   2. Parameter limit: IN-list expansion of N ids hits
+ *      SQLITE_MAX_VARIABLE_NUMBER (default 999 on older builds) once the
+ *      history grows past that threshold.
+ *
+ * Order: messages first, then conversation_sessions. The messages FK has no
+ * ON DELETE CASCADE, and with foreign_keys=ON the reverse order would error.
+ * Both are wrapped in one tx so a mid-delete failure leaves the DB intact.
+ */
+export function deleteAllChatSidebarSessions(params) {
+    const scopeList = CHAT_SIDEBAR_SCOPES;
+    const placeholders = scopeList.map(() => "?").join(", ");
+    let deletedIds = [];
+    params.db.transaction(() => {
+        params.db
+            .prepare(`DELETE FROM messages
+          WHERE session_id IN (
+            SELECT id FROM conversation_sessions
+             WHERE scope IN (${placeholders})
+               AND status != 'active'
+          )`)
+            .run(...scopeList);
+        const returned = params.db
+            .prepare(`DELETE FROM conversation_sessions
+          WHERE scope IN (${placeholders})
+            AND status != 'active'
+          RETURNING id`)
+            .all(...scopeList);
+        deletedIds = returned.map((row) => row.id);
+    })();
+    if (deletedIds.length === 0)
+        return { deleted: 0 };
+    // Workdir rm runs AFTER the tx commits — if the tx rolled back we would
+    // otherwise delete files the DB still references.
+    for (const id of deletedIds) {
+        cleanupSessionWorkdir(getSessionWorkdirPath(params.dataDir, id));
+    }
+    // Cap the id sample — a 1500-session delete shouldn't dump 1500 ints
+    // into a single log line. The count is the load-bearing signal; a
+    // sample is enough to trace a specific complaint back to a delete.
+    const idSample = deletedIds.slice(0, 20);
+    logger.info({
+        deleted: deletedIds.length,
+        sessionIdSample: idSample,
+        truncated: deletedIds.length > idSample.length,
+    }, "Dashboard bulk-deleted chat sidebar sessions");
+    return { deleted: deletedIds.length };
+}
+/** Delete a single non-active sidebar session. */
+export function deleteChatSession(params) {
+    const row = params.db
+        .prepare(`SELECT id, scope, status FROM conversation_sessions WHERE id = ?`)
+        .get(params.sessionId);
+    if (!row)
+        return { ok: false, status: 404, message: "Session not found" };
+    if (!isChatSidebarScope(row.scope)) {
+        return {
+            ok: false,
+            status: 403,
+            message: "This session cannot be deleted from the dashboard",
+        };
+    }
+    if (row.status === "active") {
+        return {
+            ok: false,
+            status: 409,
+            message: "Active sessions cannot be deleted — end the chat first",
+        };
+    }
+    // Single-row delete is immune to TOCTOU on the scope set (scope is
+    // immutable for a session), but we still re-check `status != 'active'`
+    // inside the DELETE so a concurrent status flip can't slip past the
+    // SELECT-time guard above.
+    let deleted = 0;
+    params.db.transaction(() => {
+        params.db.prepare(`DELETE FROM messages WHERE session_id = ?`).run(row.id);
+        const info = params.db
+            .prepare(`DELETE FROM conversation_sessions
+          WHERE id = ?
+            AND status != 'active'`)
+            .run(row.id);
+        deleted = info.changes;
+    })();
+    /* v8 ignore next 7 — concurrent status flip between SELECT guard and DELETE; unreachable in single-threaded tests */
+    if (deleted === 0) {
+        return {
+            ok: false,
+            status: 409,
+            message: "Session became active during delete — try again",
+        };
+    }
+    cleanupSessionWorkdir(getSessionWorkdirPath(params.dataDir, row.id));
+    logger.info({ sessionId: row.id, scope: row.scope }, "Dashboard deleted chat sidebar session");
+    return { ok: true, deleted };
+}
+//# sourceMappingURL=dashboard-session-cleanup.js.map

package/dist/core/dashboard-session-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-session-cleanup.js","sourceRoot":"","sources":["../../src/core/dashboard-session-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAMzD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,SAAS,GAAG,mBAAmB,CAAC;IACtC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzD,IAAI,UAAU,GAAa,EAAE,CAAC;IAE9B,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QACzB,MAAM,CAAC,EAAE;aACN,OAAO,CACN;;;+BAGuB,YAAY;;YAE/B,CACL;aACA,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAErB,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE;aACvB,OAAO,CACN;4BACoB,YAAY;;uBAEjB,CAChB;aACA,GAAG,CAAC,GAAG,SAAS,CAA0B,CAAC;QAC9C,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEnD,wEAAwE;IACxE,kDAAkD;IAClD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CACT;QACE,OAAO,EAAE,UAAU,CAAC,MAAM;QAC1B,eAAe,EAAE,QAAQ;QACzB,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;KAC/C,EACD,8CAA8C,CAC/C,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB,CAAC,MAIjC;IACC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE;SAClB,OAAO,CACN,kEAAkE,CACnE;SACA,GAAG,CAAC,MAAM,CAAC,SAAS,CAEV,CAAC;IAEd,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC1E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,mDAAmD;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,2BAA2B;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QACzB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE;aACnB,OAAO,CACN;;mCAE2B,CAC5B;aACA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,qHAAqH;IACrH,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,iDAAiD;SAC3D,CAAC;IACJ,CAAC;IAED,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EACvC,wCAAwC,CACzC,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/core/dashboard-session-controls.d.ts

@@ -0,0 +1,41 @@
+import type Database from "better-sqlite3";
+import type { ISessionManager } from "./dispatcher.js";
+/**
+ * runtime_state key holding the most recent loud prompt-context-change
+ * timestamp (UTC ISO string). Written by `markContextChanged` for changes
+ * that should invalidate active DM sessions and used here to decide whether
+ * a resumed session's stored SDK session id is still reasoning over fresh
+ * context.
+ */
+export declare const CONTEXT_CHANGED_AT_KEY = "dashboard_context_changed_at";
+export type DashboardContinueResult = {
+    ok: true;
+    sessionId: number;
+} | {
+    ok: false;
+    status: 403 | 404 | 409 | 503;
+    message: string;
+};
+/**
+ * Persist "prompt context changed loudly" as a UTC ISO timestamp in
+ * `runtime_state`. `continueDashboardSession` compares this against the target
+ * session's `last_message_at` to decide whether the stored SDK session id has
+ * gone stale and should be discarded before resume.
+ *
+ * Stored as an ISO string rather than a raw number so it compares correctly
+ * (lexicographically) against SQLite's `CURRENT_TIMESTAMP` format.
+ */
+export declare function markContextChanged(db: Database.Database): void;
+export declare function endDashboardSession(params: {
+    sessionManager: ISessionManager;
+    channelId: string;
+}): Promise<{
+    id: number;
+} | null>;
+export declare function continueDashboardSession(params: {
+    db: Database.Database;
+    dataDir: string;
+    sessionManager: ISessionManager;
+    sessionId: number;
+}): DashboardContinueResult;
+//# sourceMappingURL=dashboard-session-controls.d.ts.map

package/dist/core/dashboard-session-controls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-session-controls.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-session-controls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAErE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAM9D;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,cAAc,EAAE,eAAe,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAUjC;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,eAAe,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,uBAAuB,CAwJ1B"}

package/dist/core/dashboard-session-controls.js

@@ -0,0 +1,154 @@
+import { existsSync } from "node:fs";
+import { getSessionWorkdirPath } from "./workdir.js";
+import { DASHBOARD_CHAT_SCOPE } from "../messaging/constants.js";
+import { readRuntimeState, writeRuntimeState } from "../db/runtime-state.js";
+/**
+ * runtime_state key holding the most recent loud prompt-context-change
+ * timestamp (UTC ISO string). Written by `markContextChanged` for changes
+ * that should invalidate active DM sessions and used here to decide whether
+ * a resumed session's stored SDK session id is still reasoning over fresh
+ * context.
+ */
+export const CONTEXT_CHANGED_AT_KEY = "dashboard_context_changed_at";
+/**
+ * Persist "prompt context changed loudly" as a UTC ISO timestamp in
+ * `runtime_state`. `continueDashboardSession` compares this against the target
+ * session's `last_message_at` to decide whether the stored SDK session id has
+ * gone stale and should be discarded before resume.
+ *
+ * Stored as an ISO string rather than a raw number so it compares correctly
+ * (lexicographically) against SQLite's `CURRENT_TIMESTAMP` format.
+ */
+export function markContextChanged(db) {
+    writeRuntimeState(db, CONTEXT_CHANGED_AT_KEY, new Date().toISOString().replace("T", " ").replace(/\.\d+Z$/, ""));
+}
+export async function endDashboardSession(params) {
+    const active = await params.sessionManager.findActive({
+        platform: "dashboard",
+        channel: params.channelId,
+        threadId: null,
+        isDm: true,
+    });
+    if (!active)
+        return null;
+    params.sessionManager.closeSession(active.id);
+    return active;
+}
+export function continueDashboardSession(params) {
+    const sessionRow = params.db
+        .prepare(`SELECT id, scope, scope_key, backend_session_id, last_message_at
+         FROM conversation_sessions
+        WHERE id = ?`)
+        .get(params.sessionId);
+    if (!sessionRow) {
+        return { ok: false, status: 404, message: "Session not found" };
+    }
+    if (sessionRow.scope !== DASHBOARD_CHAT_SCOPE) {
+        return {
+            ok: false,
+            status: 403,
+            message: "Only dashboard chat sessions can be continued from dashboard history",
+        };
+    }
+    // Intentionally NO `backend_session_id != null` precondition here.
+    // This function itself writes NULL as a legal intermediate state when
+    // `shouldInvalidateSdkSession` fires (context changed after the
+    // session's last turn), and the dispatcher's fresh-execute path
+    // handles NULL backend by injecting the prior transcript via
+    // `buildCrossSessionConversationHistory`. Requiring non-null would
+    // refuse the very state this function produces — leaving any
+    // previously-continued session stuck read-only in the sidebar. The
+    // real gate is the workdir: without the instruction files + skill
+    // tree, fresh-execute has no context to boot from.
+    if (!existsSync(getSessionWorkdirPath(params.dataDir, params.sessionId))) {
+        return {
+            ok: false,
+            status: 409,
+            message: "This session's local state has already been cleaned up",
+        };
+    }
+    const sourcePlatforms = params.db
+        .prepare(`SELECT DISTINCT platform
+           FROM messages
+          WHERE session_id = ?`)
+        .all(params.sessionId).map((row) => row.platform);
+    const browserOnly = sourcePlatforms.length > 0 &&
+        sourcePlatforms.every((platform) => platform === "dashboard");
+    if (!browserOnly) {
+        return {
+            ok: false,
+            status: 403,
+            message: "Only browser-only sessions can be continued from dashboard history",
+        };
+    }
+    // If the operator's context (today/roadmap/user/etc.) was mutated after
+    // this session's last turn, the stored SDK session is reasoning over
+    // outdated context. Clear `backend_session_id` inside the same transaction
+    // that re-activates the row so the next user message falls through to the
+    // fresh-execute branch (which rebuilds context and injects history), while
+    // leaving `messages` intact for UI continuity and `requiresHistoryInjection`.
+    const contextChangedAt = readRuntimeState(params.db, CONTEXT_CHANGED_AT_KEY);
+    // Compare against the most recent non-forwarded message — proactive
+    // forwards (dm-channel-timeline.md §F.7) bump `last_message_at` from a
+    // separate SDK session, so using it here would mask context changes
+    // that landed before the forward but still go unread by the resumed
+    // session.
+    const lastConsumedRow = params.db
+        .prepare(`SELECT timestamp
+         FROM messages
+        WHERE session_id = ?
+          AND (
+            role <> 'assistant'
+            OR json_extract(metadata, '$.notificationType') IS NULL
+            OR json_extract(metadata, '$.notificationType') NOT IN
+               ('proactive_forward', 'proactive_forward_batched')
+          )
+        ORDER BY timestamp DESC, id DESC
+        LIMIT 1`)
+        .get(sessionRow.id);
+    const lastConsumedAt = lastConsumedRow?.timestamp ?? sessionRow.last_message_at;
+    const shouldInvalidateSdkSession = typeof contextChangedAt === "string"
+        && contextChangedAt > lastConsumedAt;
+    // Collect the non-transactional side effects produced by closing other
+    // active sessions (workdir cleanup for non-dashboard scopes, staleSet
+    // entry removal) and only run them AFTER this transaction commits. If
+    // the transaction fails anywhere between here and the final UPDATE, the
+    // DB is restored but we must not have already deleted files or mutated
+    // in-memory flags.
+    const effects = params.sessionManager.newEffectsBuffer();
+    params.db.transaction(() => {
+        const activeRows = params.db
+            .prepare(`SELECT id
+           FROM conversation_sessions
+          WHERE scope = ?
+            AND scope_key = ?
+            AND status = 'active'
+            AND id != ?`)
+            .all(sessionRow.scope, sessionRow.scope_key, sessionRow.id);
+        for (const activeRow of activeRows) {
+            params.sessionManager.closeSessionInTx(activeRow.id, effects);
+        }
+        if (shouldInvalidateSdkSession) {
+            params.db
+                .prepare(`UPDATE conversation_sessions
+              SET backend_session_id = NULL
+            WHERE id = ?`)
+                .run(sessionRow.id);
+        }
+        params.db
+            .prepare(`UPDATE conversation_sessions
+            SET status = 'active'
+          WHERE id = ?`)
+            .run(sessionRow.id);
+        // If the target session was flagged stale while it was active (e.g. a
+        // context mutation ran in that window), clear the in-memory flag so
+        // `getOrCreateDm` doesn't immediately reset-in-place on the very first
+        // turn after Continue. The persistent `context_changed_at` check still
+        // fires when truly needed — this only suppresses the duplicate signal.
+        effects.staleFlagClears.push(sessionRow.id);
+    })();
+    // TX committed — safe to flush filesystem and in-memory side effects.
+    params.sessionManager.flushEffects(effects);
+    return { ok: true, sessionId: sessionRow.id };
+}
+//# sourceMappingURL=dashboard-session-controls.js.map

package/dist/core/dashboard-session-controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-session-controls.js","sourceRoot":"","sources":["../../src/core/dashboard-session-controls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAMrE;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAqB;IACtD,iBAAiB,CACf,EAAE,EACF,sBAAsB,EACtB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAGzC;IACC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;QACpD,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAKxC;IACC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;SACzB,OAAO,CACN;;qBAEe,CAChB;SACA,GAAG,CAAC,MAAM,CAAC,SAAS,CAMR,CAAC;IAEhB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,sEAAsE;SAChF,CAAC;IACJ,CAAC;IACD,mEAAmE;IACnE,sEAAsE;IACtE,gEAAgE;IAChE,gEAAgE;IAChE,6DAA6D;IAC7D,mEAAmE;IACnE,6DAA6D;IAC7D,mEAAmE;IACnE,kEAAkE;IAClE,mDAAmD;IACnD,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GACnB,MAAM,CAAC,EAAE;SACN,OAAO,CACN;;+BAEuB,CACxB;SACA,GAAG,CAAC,MAAM,CAAC,SAAS,CACxB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,WAAW,GACf,eAAe,CAAC,MAAM,GAAG,CAAC;QAC1B,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,oEAAoE;SAC9E,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,MAAM,CAAC,EAAE,EACT,sBAAsB,CACvB,CAAC;IACF,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,WAAW;IACX,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE;SAC9B,OAAO,CACN;;;;;;;;;;gBAUU,CACX;SACA,GAAG,CAAC,UAAU,CAAC,EAAE,CAAsC,CAAC;IAC3D,MAAM,cAAc,GAAG,eAAe,EAAE,SAAS,IAAI,UAAU,CAAC,eAAe,CAAC;IAChF,MAAM,0BAA0B,GAC9B,OAAO,gBAAgB,KAAK,QAAQ;WACjC,gBAAgB,GAAG,cAAc,CAAC;IAEvC,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;IAEzD,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;aACzB,OAAO,CACN;;;;;wBAKgB,CACjB;aACA,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAA0B,CAAC;QAEvF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,0BAA0B,EAAE,CAAC;YAC/B,MAAM,CAAC,EAAE;iBACN,OAAO,CACN;;yBAEe,CAChB;iBACA,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,CAAC,EAAE;aACN,OAAO,CACN;;uBAEe,CAChB;aACA,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEtB,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,EAAE,CAAC;IAEL,sEAAsE;IACtE,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAE5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;AAChD,CAAC"}

package/dist/core/delegated-connector-health.d.ts

@@ -0,0 +1,63 @@
+import type Database from "better-sqlite3";
+import { type BackendId, type IntegrationKey } from "@aitne/shared";
+export interface DelegatedSignoutWarning {
+    integration: IntegrationKey;
+    /** Backend whose connector reported missing required capabilities. */
+    backend: BackendId;
+    /** Display name from the integration descriptor — used in the DM body. */
+    displayName: string;
+    /** Required capabilities the cached probe says are no longer satisfied. */
+    missingRequired: readonly string[];
+}
+export interface DelegatedConnectorHealthResult {
+    /**
+     * Warnings the caller must DM the owner about (one per integration that
+     * just transitioned to broken, or that is broken and has not yet been
+     * warned about). Empty when nothing to do.
+     */
+    warnings: readonly DelegatedSignoutWarning[];
+    /**
+     * Integrations that were previously warned about but whose cached probe
+     * now reports the required capabilities are present again. Pure
+     * diagnostic — the helper has already cleared the runtime_state marker
+     * for these by the time it returns.
+     */
+    recovered: readonly IntegrationKey[];
+}
+/**
+ * Inspect cached probe state for every delegated integration whose
+ * `delegatedBackend` matches the active session backend. Returns warnings
+ * for integrations that need a one-shot DM (deduped via `runtime_state`)
+ * and the list of integrations whose markers were cleared because the
+ * cached probe now reports recovery.
+ *
+ * Marker lifecycle:
+ * - The "would warn" decision is made here, but the warning marker is
+ *   NOT written. The caller must invoke {@link markSignoutWarned} only
+ *   after the DM has been successfully dispatched. This avoids the
+ *   "marker set, DM never delivered" silent-failure trap (Slack outage,
+ *   adapter crash) that would otherwise leave the user uninformed
+ *   forever (the next consult sees the marker and stays silent until
+ *   the probe transitions back through `present=true`).
+ * - Recovery markers (probe transitioned back to `present=true`) are
+ *   cleared inline because there is no dispatch failure mode to guard
+ *   against — clearing a stale "we warned" marker is unconditionally
+ *   safe.
+ */
+export declare function consultDelegatedConnectorHealth(db: Database.Database, sessionBackend: BackendId): DelegatedConnectorHealthResult;
+/**
+ * Persist the "we warned the user" marker for one warning. The dispatcher
+ * calls this only after the underlying DM has been delivered successfully
+ * — if delivery fails, the marker stays absent and the next consult will
+ * re-issue the warning. This keeps the throttling guarantee
+ * (one-DM-per-sign-out-event) without trading it for silent failure on
+ * messaging-adapter outages.
+ */
+export declare function markSignoutWarned(db: Database.Database, warning: DelegatedSignoutWarning, now?: Date): void;
+/**
+ * Compose the user-facing DM body for a single sign-out warning. Kept as
+ * a pure function so the dispatcher can pass the rendered string straight
+ * into `INotificationManager.send`. US-English per Decision Log #11.
+ */
+export declare function renderSignoutDm(warning: DelegatedSignoutWarning): string;
+//# sourceMappingURL=delegated-connector-health.d.ts.map

package/dist/core/delegated-connector-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-connector-health.d.ts","sourceRoot":"","sources":["../../src/core/delegated-connector-health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAkEvB,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,cAAc,CAAC;IAC5B,sEAAsE;IACtE,OAAO,EAAE,SAAS,CAAC;IACnB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;OAIG;IACH,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,+BAA+B,CAC7C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,cAAc,EAAE,SAAS,GACxB,8BAA8B,CAoEhC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,OAAO,EAAE,uBAAuB,EAChC,GAAG,GAAE,IAAiB,GACrB,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CASxE"}

package/dist/core/delegated-connector-health.js

@@ -0,0 +1,157 @@
+import { INTEGRATION_DESCRIPTORS, } from "@aitne/shared";
+import { readIntegrations } from "../db/integrations-store.js";
+import { readProbe } from "../db/integration-probe-store.js";
+import { readRuntimeState, writeRuntimeState, deleteRuntimeState, } from "../db/runtime-state.js";
+import { createLogger } from "../logging.js";
+const logger = createLogger("delegated-connector-health");
+/**
+ * DELEGATED-MODE-V2-DESIGN.md §4.5 / §10 — connector cached re-probe at DM
+ * session-init.
+ *
+ * The §10 "post-setup connector sign-out" risk is that a user who completes
+ * the wizard (live probe passes), then signs out of the connector in the
+ * Claude.ai / Codex UI, leaves same-backend mode silently broken: the agent
+ * keeps trying to call MCP tools that no longer exist and surfaces opaque
+ * "tool not available" errors. Phase 4.5 closes the loop by consulting the
+ * cached probe at every DM dispatch and DM-ing the owner once when the
+ * cached probe says the required capabilities are no longer satisfied.
+ *
+ * Scope (intentional):
+ * - Same-backend only. Cross-backend delegation runs through the
+ *   `/api/integrations/:key/exec` chokepoint, which surfaces failures
+ *   directly through its 5xx response. (Earlier drafts cited the
+ *   `/invoke` route here; that route is retired but the internal
+ *   `DelegatedBackendInvoker.invoke()` API continues to surface
+ *   failures the same way for daemon-internal callers.) The §4.5 risk
+ *   is exclusively about same-backend native-MCP usage where there is
+ *   no daemon-side chokepoint to fail on.
+ * - Cache-only. The §4.5 spec is explicit: "Cheaper than a live probe;
+ *   the cache is already populated by the wizard." A periodic
+ *   re-probe that drives the cache to `present=false` is a separate
+ *   §13 TODO; until that lands, this helper alarms only after the user
+ *   (or some future cron) hits `POST /api/integrations/:key/probe`
+ *   with a connector that has signed out. Do not promote this to a
+ *   live probe — that re-introduces the cost we deliberately rejected.
+ *
+ * Throttling:
+ * - One DM per (integration, backend) sign-out event. Tracked via a
+ *   `runtime_state` row keyed by
+ *   `delegated_signout_warned:<integration>:<backend>`. When a later
+ *   probe transitions `present` back to true, the marker is cleared so
+ *   a future sign-out re-arms the alarm.
+ * - The marker survives daemon restarts so a crash-loop does not spam
+ *   the user.
+ */
+const RUNTIME_STATE_PREFIX = "delegated_signout_warned";
+function markerKey(key, backend) {
+    return `${RUNTIME_STATE_PREFIX}:${key}:${backend}`;
+}
+/**
+ * Inspect cached probe state for every delegated integration whose
+ * `delegatedBackend` matches the active session backend. Returns warnings
+ * for integrations that need a one-shot DM (deduped via `runtime_state`)
+ * and the list of integrations whose markers were cleared because the
+ * cached probe now reports recovery.
+ *
+ * Marker lifecycle:
+ * - The "would warn" decision is made here, but the warning marker is
+ *   NOT written. The caller must invoke {@link markSignoutWarned} only
+ *   after the DM has been successfully dispatched. This avoids the
+ *   "marker set, DM never delivered" silent-failure trap (Slack outage,
+ *   adapter crash) that would otherwise leave the user uninformed
+ *   forever (the next consult sees the marker and stays silent until
+ *   the probe transitions back through `present=true`).
+ * - Recovery markers (probe transitioned back to `present=true`) are
+ *   cleared inline because there is no dispatch failure mode to guard
+ *   against — clearing a stale "we warned" marker is unconditionally
+ *   safe.
+ */
+export function consultDelegatedConnectorHealth(db, sessionBackend) {
+    const integrations = readIntegrations(db);
+    const warnings = [];
+    const recovered = [];
+    for (const [keyRaw, state] of Object.entries(integrations)) {
+        const key = keyRaw;
+        if (state.mode !== "delegated")
+            continue;
+        if (state.delegatedBackend !== sessionBackend)
+            continue;
+        const descriptor = INTEGRATION_DESCRIPTORS[key];
+        const connector = descriptor.backendConnectors[sessionBackend];
+        /* c8 ignore start -- registry-rollback / hand-edited-DB defense */
+        if (!connector) {
+            // Registry inconsistency — delegated state stored against a
+            // backend the descriptor does not list a connector for. The
+            // PATCH route guards against this; reaching it here means a
+            // hand-edited DB or a registry rollback. Don't DM, don't crash;
+            // the next mode change will reconcile.
+            logger.warn({ key, sessionBackend }, "Delegated state references a backend with no connector — skipping health consult");
+            continue;
+        }
+        /* c8 ignore stop */
+        const probe = readProbe(db, key, sessionBackend);
+        const marker = readRuntimeState(db, markerKey(key, sessionBackend));
+        if (!probe) {
+            // No cached probe row at all. Either the user delegated outside
+            // the wizard's live-probe path, or the cache was just evicted by
+            // a mode change. Cannot assert "broken" without ground truth, so
+            // do nothing — the cache will be repopulated by the next explicit
+            // probe call.
+            logger.debug({ key, sessionBackend }, "No cached probe for delegated integration — skipping health consult");
+            continue;
+        }
+        if (!probe.present) {
+            if (marker) {
+                // Already warned about this exact sign-out — stay silent. Only
+                // a transition through `present=true` resets the marker so a
+                // true re-sign-out can re-fire.
+                continue;
+            }
+            warnings.push({
+                integration: key,
+                backend: sessionBackend,
+                displayName: descriptor.displayName,
+                missingRequired: probe.missingRequired,
+            });
+            continue;
+        }
+        // probe.present === true — connector is healthy. If we previously
+        // warned, clear the marker so the next sign-out re-arms the alarm.
+        if (marker) {
+            deleteRuntimeState(db, markerKey(key, sessionBackend));
+            recovered.push(key);
+        }
+    }
+    return { warnings, recovered };
+}
+/**
+ * Persist the "we warned the user" marker for one warning. The dispatcher
+ * calls this only after the underlying DM has been delivered successfully
+ * — if delivery fails, the marker stays absent and the next consult will
+ * re-issue the warning. This keeps the throttling guarantee
+ * (one-DM-per-sign-out-event) without trading it for silent failure on
+ * messaging-adapter outages.
+ */
+export function markSignoutWarned(db, warning, now = new Date()) {
+    const record = {
+        warnedAt: now.toISOString(),
+        missingRequired: warning.missingRequired,
+    };
+    writeRuntimeState(db, markerKey(warning.integration, warning.backend), record);
+}
+/**
+ * Compose the user-facing DM body for a single sign-out warning. Kept as
+ * a pure function so the dispatcher can pass the rendered string straight
+ * into `INotificationManager.send`. US-English per Decision Log #11.
+ */
+export function renderSignoutDm(warning) {
+    const caps = warning.missingRequired.length > 0
+        ? ` (missing: ${warning.missingRequired.join(", ")})`
+        : "";
+    return [
+        `Your ${warning.displayName} connector on ${warning.backend} appears signed out${caps}.`,
+        `Same-backend delegated mode for ${warning.integration} is non-functional until you sign back in.`,
+        `Re-authorize from your ${warning.backend} connector settings, then re-run the integration probe from the dashboard.`,
+    ].join(" ");
+}
+//# sourceMappingURL=delegated-connector-health.js.map

package/dist/core/delegated-connector-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-connector-health.js","sourceRoot":"","sources":["../../src/core/delegated-connector-health.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,GAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,SAAS,SAAS,CAAC,GAAmB,EAAE,OAAkB;IACxD,OAAO,GAAG,oBAAoB,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;AACrD,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,EAAqB,EACrB,cAAyB;IAEzB,MAAM,YAAY,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzC,IAAI,KAAK,CAAC,gBAAgB,KAAK,cAAc;YAAE,SAAS;QAExD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC/D,mEAAmE;QACnE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,4DAA4D;YAC5D,4DAA4D;YAC5D,4DAA4D;YAC5D,gEAAgE;YAChE,uCAAuC;YACvC,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,cAAc,EAAE,EACvB,kFAAkF,CACnF,CAAC;YACF,SAAS;QACX,CAAC;QACD,oBAAoB;QAEpB,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,gBAAgB,CAAuB,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gEAAgE;YAChE,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,cAAc;YACd,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,cAAc,EAAE,EACvB,qEAAqE,CACtE,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,+DAA+D;gBAC/D,6DAA6D;gBAC7D,gCAAgC;gBAChC,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,GAAG;gBAChB,OAAO,EAAE,cAAc;gBACvB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;YACvD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAqB,EACrB,OAAgC,EAChC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAyB;QACnC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC;IACF,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC7C,CAAC,CAAC,cAAc,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACrD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,QAAQ,OAAO,CAAC,WAAW,iBAAiB,OAAO,CAAC,OAAO,sBAAsB,IAAI,GAAG;QACxF,mCAAmC,OAAO,CAAC,WAAW,4CAA4C;QAClG,0BAA0B,OAAO,CAAC,OAAO,4EAA4E;KACtH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}