@aitne/daemon 0.1.7 → 0.1.9

package/dist/bootstrap/db.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Database bootstrap — §3 of the legacy `startup()` IIFE.
+ *
+ * Extracted from `index.ts` per
+ * `docs/design/appendices/index-bootstrap-stage-split.md` Phase B-1.
+ * Companion to `bootstrap/adapters.ts` and `bootstrap/services.ts`; same
+ * Pattern-C shape (file-split-plan.md §10).
+ *
+ * Responsibilities (in run order):
+ *  1. Open the SQLite file and apply the idempotent schema.
+ *  2. Load persisted `settings` rows and merge them on top of env
+ *     defaults. **Must run before step 3** so `getContextDir(config)`
+ *     sees DB-persisted `vaultMode` / `primaryVaultPath` before the
+ *     context-vault-restructure migration (0004) walks the vault.
+ *     CONTEXT_VAULT_REDESIGN_PLAN.md §11.8 + V21.
+ *  3. Resolve `contextDir`, evaluate the Obsidian-mode consent gate, and
+ *     run the forward-only schema migrations.
+ *  4. Register the wiki workspace token resolver so skill compilation can
+ *     resolve `<wiki_workspace>` tokens via the DB.
+ *  5. Backfill the content-less `fts_wiki` virtual table once per workspace.
+ *  6. Bump `managed_task_seq.next_id` past any restored backup rows.
+ *  7. Close orphaned `dashboard_chat` sessions left active by a crash so
+ *     the setup wizard's resume gate flips correctly on next dashboard load.
+ *  8. Construct the chat `AttachmentStore` (top-level so adapter reloaders
+ *     can capture it in closure) and reap orphan rows.
+ *  9. Fire-and-forget price refresh (best-effort, network call).
+ *  10. Best-effort seed of git-project document templates (filesystem write).
+ *  11. Heal the `delegatedTaskModeEnabled` Phase-1 canary default for users
+ *      who have delegated integrations but never explicitly set the flag.
+ *
+ * Each step that has its own peer-test surface is exported by name so the
+ * test file can pin its behavior independent of the parent `initDatabase`
+ * factory. Steps with no testable branches (boot-time backfill / managed
+ * task seq / price refresh) stay inline.
+ *
+ * Ordering invariants this module preserves (design §11):
+ *  - Wiki token resolver is registered before any observer reads it.
+ *  - Orphan dashboard_chat sessions are closed before `SessionManager` is
+ *    constructed downstream.
+ *  - `mergeRuntimeSettingsFromDb` runs before any observer or service
+ *    reloader reads the config.
+ */
+import type Database from "better-sqlite3";
+import type { AgentConfig } from "../config.js";
+import { type Migration } from "../db/migrations.js";
+import { type SettingsStore } from "../settings/settings-store.js";
+import type { RuntimeSettings } from "../settings/runtime-settings.js";
+import { AttachmentStore } from "../services/attachments/store.js";
+export interface BootstrapDbDeps {
+    readonly config: AgentConfig;
+}
+export interface BootstrapDbResult {
+    readonly db: Database.Database;
+    readonly settingsStore: SettingsStore;
+    readonly persistedSettings: Partial<RuntimeSettings>;
+    readonly attachmentStore: AttachmentStore;
+}
+/**
+ * CONTEXT_VAULT_REDESIGN_PLAN.md V16 — env-var override for the Obsidian
+ * consent gate. Set to `"1"` (or any non-empty string) to declare that
+ * the user has accepted the sidebar reorganization without going
+ * through the dashboard surface. Recorded into
+ * `runtime_state.context_vault_restructure_acknowledged_at` with
+ * `source="env"` so subsequent boots short-circuit the env check.
+ */
+export declare const VAULT_RESTRUCTURE_ACK_ENV_VAR = "PA_VAULT_RESTRUCTURE_ACK";
+export interface VaultRestructureConsentDecision {
+    /** True when the migration is deferred awaiting user consent. */
+    deferred: boolean;
+    /** Migrations to pass into `runMigrations`. `undefined` means "use the
+     *  default MIGRATIONS list" (steady-state proceed). A concrete array
+     *  is the filtered list when the migration is deferred. */
+    migrationsToRun: readonly Migration[] | undefined;
+}
+export interface ResolveVaultRestructureConsentDeps {
+    readonly db: Database.Database;
+    readonly dataDir: string;
+    readonly contextDir: string;
+    /** Test seam — production reads `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Test seam — defaults to `() => new Date().toISOString()`. */
+    readonly nowIso?: () => string;
+}
+/**
+ * Decide whether to run, defer, or short-circuit the context-vault
+ * restructure migration (CONTEXT_VAULT_REDESIGN_PLAN.md §11.3.4 / V16).
+ *
+ * Branches:
+ *  - Vault is in plain mode (under `<dataDir>/context/`): always proceed.
+ *  - Vault is Obsidian-rooted and an explicit ack exists: proceed.
+ *  - Vault is Obsidian-rooted and `PA_VAULT_RESTRUCTURE_ACK` is set:
+ *    record the ack with `source="env"` and proceed.
+ *  - Vault is Obsidian-rooted with no ack: defer. The migration is
+ *    filtered out of the run list (so `schema_migrations` doesn't get
+ *    its row), pending-consent state is recorded, the daemon boots
+ *    normally on the legacy layout, and the alias resolver continues to
+ *    translate legacy paths until the user acks. The Obsidian-mode
+ *    vault-health probe (`config.ts:runVaultHealthProbe`) sees the
+ *    missing `policies/management.md` marker on a legacy vault and
+ *    enters degraded mode for reason `primary_vault_missing_content`
+ *    on its own — that's what 503s context writes during the consent
+ *    window. `bootstrapManagementMd` in `index.ts` reads
+ *    `getVaultRestructurePendingConsent(db)` and skips its write so the
+ *    legacy vault doesn't grow a stray `policies/` directory before the
+ *    user has acknowledged the move.
+ *
+ * **Subsequent-migration ordering caveat**: only the 0004 entry is
+ * filtered out. Any future migration appended AFTER 0004 will still
+ * run while the vault is at the legacy layout. Authors of post-0004
+ * migrations whose body reads from `<contextDir>/policies/...`,
+ * `identity/...`, etc. must either (a) be idempotent against both
+ * layouts, or (b) detect the pending-consent state via
+ * `getVaultRestructurePendingConsent(db)` and skip their body
+ * gracefully. Both are simpler than reintroducing a dependency-graph
+ * framework just for this one transitional window. The window closes
+ * the first time a deferred-consent user runs the daemon with the
+ * env / dashboard ack set — at that point the migration runner picks
+ * up 0004 (and only 0004; later entries already ran on the legacy
+ * layout boot).
+ *
+ * Exported for peer testing.
+ */
+export declare function resolveVaultRestructureConsent(deps: ResolveVaultRestructureConsentDeps): VaultRestructureConsentDecision;
+/**
+ * Open the SQLite file, apply schema, run boot-time backfills, hydrate
+ * persisted settings, and apply the delegated-task-mode default
+ * correction. Mutates `deps.config` in place via
+ * `mergeRuntimeSettingsFromDb` and (when triggered) the default
+ * correction.
+ */
+export declare function initDatabase(deps: BootstrapDbDeps): BootstrapDbResult;
+export interface WikiWorkspaceTokens {
+    vault_path: string;
+    language: string;
+    workspace_name: string;
+    schema_version: string;
+}
+export type WikiTokenResolver = (processKey: string, workspaceName?: string) => WikiWorkspaceTokens | null;
+/**
+ * Pure factory for the wiki workspace token resolver — separated from the
+ * `setWikiWorkspaceTokenResolver` side effect so peer tests can pin the
+ * lookup logic without going through the `skills-compiler.ts` singleton.
+ *
+ * Matches the per-event lookup in `context-builder.ts`: prefer the named
+ * workspace, fall back to the default. Without this, multi-workspace
+ * installs would render the `<wiki_workspace>` XML against the target
+ * workspace while skill prose (`{{vault_path}}` etc.) referenced the
+ * default — the agent would then operate on the wrong vault.
+ */
+export declare function createWikiTokenResolver(db: Database.Database): WikiTokenResolver;
+/**
+ * Register the per-process wiki workspace token resolver consumed by
+ * `skills-compiler.ts`. Idempotent: replacing the resolver simply
+ * re-points the singleton at the new DB handle.
+ */
+export declare function initWikiTokenResolver(db: Database.Database): void;
+/**
+ * Close any `dashboard_chat` sessions that were left `status='active'`
+ * from before the daemon restart. They cannot be resumed cleanly: the
+ * SSE channel is gone and `Dispatcher.currentSetupMode` is in-process
+ * state lost on restart, so a setup conversation half-way through would
+ * otherwise be re-adopted by `findActiveDashboardSessionId` and processed
+ * as regular chat against stale prompts. The setup wizard's resume path
+ * on the client-side checks active status; closing here flips the check
+ * so the wizard correctly falls through to a fresh `/setup/start`.
+ *
+ * Best-effort: logs and returns 0 on failure (a DB that can't accept this
+ * one UPDATE has bigger problems that downstream steps will surface).
+ */
+export declare function closeOrphanedDashboardChatSessions(db: Database.Database): number;
+export interface LoadPersistedSettingsDeps {
+    readonly db: Database.Database;
+    readonly config: AgentConfig;
+}
+export interface LoadPersistedSettingsResult {
+    readonly settingsStore: SettingsStore;
+    readonly persistedSettings: Partial<RuntimeSettings>;
+}
+/**
+ * Construct the `SettingsStore`, read its current snapshot, and merge
+ * the persisted values on top of the env-derived `config`. Mutates
+ * `deps.config` in place via `mergeRuntimeSettingsFromDb`.
+ */
+export declare function loadPersistedSettings(deps: LoadPersistedSettingsDeps): LoadPersistedSettingsResult;
+export interface DelegatedTaskModeCorrectionDeps {
+    readonly db: Database.Database;
+    readonly config: AgentConfig;
+    readonly settingsStore: SettingsStore;
+    readonly persistedSettings: Partial<RuntimeSettings>;
+}
+/**
+ * BROWSER_TASK_REDESIGN_PLAN.md §6.5 boot-recovery — flip every
+ * non-terminal `browser_task` row to `failed (daemon_restarted)` and
+ * emit a single `agent_actions(action_type='browser_task.boot_recovery')`
+ * row per affected task so the operator can DM-fan them out post-boot
+ * via a reconciliation tool. We do NOT call the sender here because
+ * the messaging adapters are still constructing at this stage of boot.
+ *
+ * Pure SQL UPDATE inside `sweepNonTerminalRowsForBootRecovery`; this
+ * wrapper handles the audit-row emission + the log line. Exported so
+ * a peer test can exercise both branches (no rows vs. some rows).
+ */
+export declare function surfaceBrowserTaskBootRecovery(db: Database.Database): number;
+/**
+ * AGENT_DEFINITIONS_DESIGN.md §7.4 — boot-time agent-execution crash janitor.
+ * Force-closes every `agent_executions` row left non-terminal (`result IS
+ * NULL`) by a crashed prior run, stamping `result='error', error_kind='crash'`.
+ * Idempotent (a second boot finds nothing non-terminal). Best-effort: a sweep
+ * failure (e.g. a hand-crafted partial DB missing the table) logs and returns 0
+ * so boot proceeds. Exported so a peer test can exercise both branches.
+ */
+export declare function sweepAbandonedAgentExecutions(db: Database.Database, bootTime?: number): number;
+export declare function applyDelegatedTaskModeDefaultCorrection(deps: DelegatedTaskModeCorrectionDeps): void;