@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/sessions/repository.js

@@ -1,7 +1,8 @@
 import { requireFeaturePackage } from '../features/runtime.js';
 import { CandidateReviewReceiptSchema, DeletionReceiptSchema, IntelligenceCandidateSchema, PromotionDependencyDecisionSchema, PromotionReceiptSchema, SessionContractError, sha256, } from './contracts.js';
 import { coverageFromBatchRun, } from './batch-contracts.js';
-import { redactSessionText, sanitizeNativeExtensions } from './policy.js';
+import { redactSessionText, redactSessionValue, sanitizeSessionEvent, sanitizeNativeExtensions } from './policy.js';
+import { effectiveSessionLifecycle } from './lifecycle.js';
 import { deriveSessionAnalytics, } from './analytics.js';
 const POLICY_PROVIDER_MIGRATION = 'policy-provider-identity:v2';
 const EVENT_ORIGIN_INTENT_MIGRATION = 'event-origin-intent:v1';
@@ -12,7 +13,7 @@ const VISIBLE_SESSION_PREDICATE = `s.lifecycle != 'tombstoned' AND EXISTS (
 )`;
 export class SessionRepository {
     db;
-    constructor(path = ':memory:') {
+    constructor(path = ':memory:', options = {}) {
         let Database;
         try {
             Database = requireFeaturePackage('better-sqlite3');
@@ -22,7 +23,9 @@ export class SessionRepository {
                 'run `aiwg features install sqlite`, then retry. If the native build fails, install ' +
                 'Python 3, make, and a C/C++ compiler supported by node-gyp.', { cause });
         }
-        this.db = new Database(path);
+        this.db = new Database(path, options.readonly ? { readonly: true, fileMustExist: true } : undefined);
+        if (options.readonly)
+            return;
         this.db.pragma('foreign_keys = ON');
         this.db.pragma('journal_mode = WAL');
         this.db.pragma('busy_timeout = 5000');
@@ -124,6 +127,12 @@ export class SessionRepository {
         ON sessions(workspace_id, source_id, lifecycle);
       CREATE INDEX IF NOT EXISTS idx_event_session_sequence
         ON session_events(session_id, sequence_no);
+      CREATE INDEX IF NOT EXISTS idx_event_source_run
+        ON session_events(source_id, import_run_id);
+      CREATE INDEX IF NOT EXISTS idx_event_import_run_session
+        ON session_events(import_run_id, session_id);
+      CREATE INDEX IF NOT EXISTS idx_session_analytics_session
+        ON session_analytics_facts(session_id);
       CREATE INDEX IF NOT EXISTS idx_session_analytics_scope
         ON session_analytics_facts(
           workspace_id, category, provider, status, occurred_at, fact_id
@@ -131,6 +140,9 @@ export class SessionRepository {
       CREATE VIRTUAL TABLE IF NOT EXISTS session_event_fts USING fts5(
         event_id UNINDEXED, searchable_text, tokenize='unicode61'
       );
+      -- FTS5 stores event_id in c0. A covering index checks identity/rowid
+      -- alignment without reading searchable text or event JSON.
+      CREATE INDEX IF NOT EXISTS idx_fts_event_id ON session_event_fts_content(c0);
     `);
         const deletionReceiptColumns = this.db.prepare('PRAGMA table_info(deletion_receipts)').all().map((row) => String(row.name));
         if (!deletionReceiptColumns.includes('workspace_id')) {
@@ -154,48 +166,79 @@ export class SessionRepository {
       CREATE INDEX IF NOT EXISTS idx_mutation_audit_workspace
       ON mutation_audit(workspace_id, occurred_at, operation_id)
       ;
+      CREATE INDEX IF NOT EXISTS idx_import_runs_batch
+      ON import_runs(batch_run_id);
       CREATE INDEX IF NOT EXISTS idx_batch_import_workspace
       ON batch_import_runs(workspace_id, updated_at, batch_run_id)
     `);
+        this.initializeAnalyticsVerification();
         this.alignSessionFtsRowids();
         this.migrateSessionPolicyAndProviderIdentity();
         this.migrateEventOriginAndIntent();
         this.alignSessionAnalytics();
     }
+    initializeAnalyticsVerification() {
+        // Invalidate verification even for writes from another connection. Ordinary
+        // repository mutations maintain analytics in the same transaction below.
+        this.db.transaction(() => {
+            this.db.prepare('INSERT OR IGNORE INTO session_catalog_meta(key, value) VALUES (?, ?)').run('consistency:analytics:v1', 'dirty');
+            for (const table of [
+                'session_events', 'session_analytics_facts', 'sessions', 'session_sources', 'import_runs',
+            ]) {
+                for (const operation of ['INSERT', 'UPDATE', 'DELETE']) {
+                    this.db.exec(`
+            CREATE TRIGGER IF NOT EXISTS consistency_${table}_${operation.toLowerCase()}
+            AFTER ${operation} ON ${table}
+            BEGIN
+              UPDATE session_catalog_meta SET value='dirty'
+              WHERE key='consistency:analytics:v1' AND value!='dirty';
+            END;
+          `);
+                }
+            }
+        })();
+    }
+    analyticsVerified() {
+        return this.db.prepare('SELECT value FROM session_catalog_meta WHERE key=?').get('consistency:analytics:v1')?.value === 'verified';
+    }
+    markAnalyticsVerified() {
+        this.db.prepare('UPDATE session_catalog_meta SET value=? WHERE key=?').run('verified', 'consistency:analytics:v1');
+    }
+    maintainedAnalyticsTransaction(mutate) {
+        return this.db.transaction(() => {
+            const verified = this.analyticsVerified();
+            const result = mutate();
+            // A scoped mutation must not hide pre-existing damage elsewhere.
+            if (verified)
+                this.markAnalyticsVerified();
+            return result;
+        });
+    }
     alignSessionAnalytics() {
-        const eventCount = Number(this.db.prepare(`SELECT COUNT(*) AS count
-       FROM session_events e
-       JOIN import_runs r ON r.import_run_id=e.import_run_id
-       JOIN sessions s ON s.session_id=e.session_id
-       WHERE r.status='committed' AND s.lifecycle!='tombstoned'`).get()?.count ?? 0);
-        const factSessions = Number(this.db.prepare('SELECT COUNT(DISTINCT session_id) AS count FROM session_analytics_facts').get()?.count ?? 0);
-        const sourceSessions = Number(this.db.prepare(`SELECT COUNT(DISTINCT e.session_id) AS count
-       FROM session_events e
-       JOIN import_runs r ON r.import_run_id=e.import_run_id
-       JOIN sessions s ON s.session_id=e.session_id
-       WHERE r.status='committed' AND s.lifecycle!='tombstoned'`).get()?.count ?? 0);
-        if (eventCount === 0 || factSessions === sourceSessions)
-            return;
-        this.rebuildAnalytics();
+        this.db.transaction(() => {
+            if (this.analyticsVerified())
+                return;
+            this.rebuildAnalytics();
+        })();
     }
     alignSessionFtsRowids() {
-        const eventCount = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_events').get()?.count ?? 0);
-        const ftsCount = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_event_fts').get()?.count ?? 0);
-        const mismatches = Number(this.db.prepare(`SELECT COUNT(*) AS count
-       FROM session_event_fts f
-       LEFT JOIN session_events e ON e.rowid=f.rowid
-       WHERE e.rowid IS NULL OR e.event_id!=f.event_id`).get()?.count ?? 0);
-        if (eventCount === ftsCount && mismatches === 0)
-            return;
-        const rebuild = this.db.transaction(() => {
+        this.db.transaction(() => {
+            const eventCount = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_events').get()?.count ?? 0);
+            const ftsCount = Number(this.db.prepare('SELECT COUNT(*) AS count FROM session_event_fts_content').get()?.count ?? 0);
+            const mismatch = this.db.prepare(`SELECT 1 AS mismatch
+         FROM session_event_fts_content f
+         LEFT JOIN session_events e ON e.event_id=f.c0
+         WHERE e.rowid IS NULL OR e.rowid!=f.id
+         LIMIT 1`).get();
+            if (eventCount === ftsCount && !mismatch)
+                return;
             this.db.exec('DELETE FROM session_event_fts');
             this.db.exec(`
         INSERT INTO session_event_fts(rowid, event_id, searchable_text)
         SELECT rowid, event_id, json_extract(data, '$.searchableText')
         FROM session_events
       `);
-        });
-        rebuild();
+        })();
     }
     migrateSessionPolicyAndProviderIdentity() {
         this.runCatalogMigration(POLICY_PROVIDER_MIGRATION, () => {
@@ -331,6 +374,7 @@ export class SessionRepository {
         transaction();
     }
     emitMutation(input) {
+        input = redactSessionValue(input).value;
         const unsigned = {
             contractVersion: '1.0.0',
             ...input,
@@ -435,7 +479,17 @@ export class SessionRepository {
         };
     }
     applyImport(batch, checkpoint, publish = true) {
-        const apply = this.db.transaction(() => {
+        // Guard callers that submit normalized batches directly as well as adapters.
+        batch = redactSessionValue({
+            ...batch,
+            source: { ...batch.source, extensions: sanitizeNativeExtensions(batch.source.extensions).value },
+            sessions: batch.sessions.map((session) => ({
+                ...session, extensions: sanitizeSessionExtensions(session.extensions, session.provider),
+            })),
+            events: batch.events.map(sanitizeSessionEvent),
+        }).value;
+        checkpoint = redactSessionValue(checkpoint).value;
+        const apply = this.maintainedAnalyticsTransaction(() => {
             const existing = this.db.prepare('SELECT outcome, counts, checkpoint FROM import_receipts WHERE import_run_id = ?').get(batch.run.importRunId);
             if (existing) {
                 const counts = JSON.parse(String(existing.counts));
@@ -541,7 +595,7 @@ export class SessionRepository {
         return apply();
     }
     commitStagedImports(sourceId, parserVersion) {
-        const commit = this.db.transaction(() => {
+        const commit = this.maintainedAnalyticsTransaction(() => {
             const staged = this.db.prepare(`SELECT import_run_id FROM import_runs
          WHERE source_id=? AND parser_version=? AND status='staged'`).all(sourceId, parserVersion).map((row) => String(row.import_run_id));
             const result = this.db.prepare(`UPDATE import_runs SET status='committed'
@@ -569,7 +623,7 @@ export class SessionRepository {
            WHERE operation_id=?`).run(updated.observedAt, JSON.stringify(updated), operationId);
             }
             if (result.changes > 0)
-                this.rebuildAnalytics();
+                this.rebuildImportAnalytics(staged);
             return result.changes;
         });
         return commit();
@@ -578,7 +632,7 @@ export class SessionRepository {
         if (sourceIds.length === 0)
             return 0;
         const placeholders = sourceIds.map(() => '?').join(', ');
-        const commit = this.db.transaction(() => {
+        const commit = this.maintainedAnalyticsTransaction(() => {
             const params = [batchRunId, ...sourceIds];
             const staged = this.db.prepare(`SELECT import_run_id FROM import_runs
          WHERE batch_run_id=? AND source_id IN (${placeholders}) AND status='staged'`).all(...params).map((row) => String(row.import_run_id));
@@ -607,28 +661,39 @@ export class SessionRepository {
            WHERE operation_id=?`).run(updated.observedAt, JSON.stringify(updated), operationId);
             }
             if (result.changes > 0)
-                this.rebuildAnalytics();
+                this.rebuildImportAnalytics(staged);
             return result.changes;
         });
         return commit();
     }
-    sourceImportTotals(sourceId, batchRunId) {
-        const events = Number(this.db.prepare(`SELECT COUNT(*) AS count
+    rebuildImportAnalytics(importRunIds) {
+        const affected = this.db.prepare(`SELECT DISTINCT s.workspace_id, s.session_id
        FROM session_events e
-       JOIN import_runs r ON r.import_run_id=e.import_run_id
-       WHERE e.source_id=? AND r.batch_run_id=?`).get(sourceId, batchRunId)?.count ?? 0);
-        const sessions = Number(this.db.prepare(`SELECT COUNT(DISTINCT e.session_id) AS count
+       JOIN sessions s ON s.session_id=e.session_id
+       WHERE e.import_run_id=?`);
+        const sessions = new Map();
+        for (const importRunId of importRunIds) {
+            for (const row of affected.all(importRunId)) {
+                sessions.set(String(row.session_id), String(row.workspace_id));
+            }
+        }
+        for (const [sessionId, workspaceId] of sessions) {
+            this.rebuildAnalytics(workspaceId, sessionId);
+        }
+    }
+    sourceImportTotals(sourceId, batchRunId) {
+        const totals = this.db.prepare(`SELECT COUNT(*) AS events, COUNT(DISTINCT e.session_id) AS sessions
        FROM session_events e
        JOIN import_runs r ON r.import_run_id=e.import_run_id
-       WHERE e.source_id=? AND r.batch_run_id=?`).get(sourceId, batchRunId)?.count ?? 0);
-        return { sessions, events };
+       WHERE e.source_id=? AND r.batch_run_id=?`).get(sourceId, batchRunId);
+        return { sessions: Number(totals?.sessions ?? 0), events: Number(totals?.events ?? 0) };
     }
     getSession(id, workspaceId) {
         const row = this.db.prepare(`SELECT s.data FROM sessions s
        WHERE s.session_id=? AND ${VISIBLE_SESSION_PREDICATE}
        ${workspaceId ? 'AND s.workspace_id=?' : ''}`)
             .get(...(workspaceId ? [id, workspaceId] : [id]));
-        return row ? JSON.parse(String(row.data)) : null;
+        return row ? effectiveSessionLifecycle(JSON.parse(String(row.data))) : null;
     }
     findSessionsByReference(reference, workspaceId) {
         const internal = this.getSession(reference, workspaceId);
@@ -637,7 +702,7 @@ export class SessionRepository {
         const query = (predicate) => this.db.prepare(`SELECT s.data FROM sessions s
        WHERE ${workspaceId ? 's.workspace_id=? AND' : ''} ${VISIBLE_SESSION_PREDICATE} AND (${predicate})
        ORDER BY s.session_id`).all(...(workspaceId ? [workspaceId, reference] : [reference]))
-            .map((row) => JSON.parse(String(row.data)));
+            .map((row) => effectiveSessionLifecycle(JSON.parse(String(row.data))));
         const exact = query('s.native_session_id=?');
         if (exact.length === 1)
             return exact;
@@ -669,7 +734,7 @@ export class SessionRepository {
          OR substr(s.session_id, 1, length(?))=?)
        ORDER BY s.session_id`).all(...(workspaceId ? [workspaceId, reference, reference, reference, reference]
             : [reference, reference, reference, reference]))
-            .map((row) => JSON.parse(String(row.data)));
+            .map((row) => effectiveSessionLifecycle(JSON.parse(String(row.data))));
     }
     listWorkspaceSessionCounts() {
         return this.db.prepare(`SELECT s.workspace_id, COUNT(*) AS count FROM sessions s
@@ -682,6 +747,7 @@ export class SessionRepository {
         return this.db.prepare('SELECT DISTINCT workspace_id FROM sessions ORDER BY workspace_id').all().map((row) => String(row.workspace_id));
     }
     saveBatchImportRun(run) {
+        run = redactSessionValue(run).value;
         const save = this.db.transaction(() => {
             const prior = this.db.prepare('SELECT manifest_id, workspace_id FROM batch_import_runs WHERE batch_run_id=?').get(run.runId);
             if (prior && (String(prior.manifest_id) !== run.manifestId
@@ -700,6 +766,22 @@ export class SessionRepository {
         const row = this.db.prepare('SELECT data FROM batch_import_runs WHERE batch_run_id=?').get(runId);
         return row ? JSON.parse(String(row.data)) : null;
     }
+    /** Call only while holding the catalog import lease, before starting a new import. */
+    interruptRunningBatchImports(now = new Date()) {
+        const interruptedAt = now.toISOString();
+        return this.db.transaction(() => {
+            const rows = this.db.prepare("SELECT data FROM batch_import_runs WHERE status='running'").all();
+            return rows.map((row) => {
+                const run = JSON.parse(String(row.data));
+                run.status = 'interrupted';
+                run.interruptedAt = interruptedAt;
+                run.updatedAt = interruptedAt;
+                run.completedAt = null;
+                this.saveBatchImportRun(run);
+                return { runId: run.runId, interruptedAt };
+            });
+        })();
+    }
     getBatchImportRunForManifest(manifestId, workspaceId) {
         const row = this.db.prepare(`SELECT data FROM batch_import_runs
        WHERE manifest_id=? AND workspace_id=?`).get(manifestId, workspaceId);
@@ -743,18 +825,18 @@ export class SessionRepository {
         const pageParams = [...params];
         if (cursor) {
             pageWhere.push(`(
-        COALESCE(json_extract(s.data, '$.updatedAt'), '') > ?
+        COALESCE(json_extract(s.data, '$.updatedAt'), '') < ?
         OR (
           COALESCE(json_extract(s.data, '$.updatedAt'), '') = ?
-          AND s.session_id > ?
+          AND s.session_id < ?
         )
       )`);
             pageParams.push(cursor.updatedAt, cursor.updatedAt, cursor.sessionId);
         }
         const items = this.db.prepare(`SELECT s.data FROM sessions s WHERE ${pageWhere.join(' AND ')}
-       ORDER BY COALESCE(json_extract(s.data, '$.updatedAt'), ''), s.session_id
+       ORDER BY COALESCE(json_extract(s.data, '$.updatedAt'), '') DESC, s.session_id DESC
        LIMIT ?${options.offset ? ' OFFSET ?' : ''}`).all(...pageParams, options.limit + 1, ...(options.offset ? [options.offset] : []))
-            .map((row) => JSON.parse(String(row.data)));
+            .map((row) => effectiveSessionLifecycle(JSON.parse(String(row.data))));
         const page = items.slice(0, options.limit);
         const last = page.at(-1);
         return {
@@ -779,6 +861,7 @@ export class SessionRepository {
             .map((row) => String(row.tag));
     }
     tagSession(sessionId, tag, workspaceId) {
+        tag = redactSessionText(tag).text;
         const mutate = this.db.transaction(() => {
             if (!this.getSession(sessionId, workspaceId))
                 return false;
@@ -819,7 +902,7 @@ export class SessionRepository {
          e.session_id,
          e.sequence_no,
          e.event_id`).all(workspaceId).map((row) => ({
-            session: JSON.parse(String(row.session_data)),
+            session: effectiveSessionLifecycle(JSON.parse(String(row.session_data))),
             event: JSON.parse(String(row.event_data)),
         }));
     }
@@ -960,6 +1043,14 @@ export class SessionRepository {
         };
     }
     rebuildAnalytics(workspaceId, sessionId) {
+        return this.maintainedAnalyticsTransaction(() => {
+            const inserted = this.rebuildAnalyticsFacts(workspaceId, sessionId);
+            if (!workspaceId && !sessionId)
+                this.markAnalyticsVerified();
+            return inserted;
+        })();
+    }
+    rebuildAnalyticsFacts(workspaceId, sessionId) {
         const where = [
             `r.status='committed'`,
             `s.lifecycle!='tombstoned'`,
@@ -1128,7 +1219,10 @@ export class SessionRepository {
                 }
             }
             const saved = candidates.map((input) => {
-                const parsed = IntelligenceCandidateSchema.parse(input);
+                const redacted = redactSessionValue(input);
+                const parsed = IntelligenceCandidateSchema.parse(redacted.value);
+                if (redacted.classes.length)
+                    parsed.sensitivity = 'sensitive';
                 this.assertCandidateEvidence(parsed);
                 const priorRow = this.db.prepare(`SELECT data FROM intelligence_candidates
            WHERE candidate_id=? ORDER BY version DESC LIMIT 1`).get(parsed.candidateId);
@@ -1196,6 +1290,7 @@ export class SessionRepository {
         return rows.map((row) => IntelligenceCandidateSchema.parse(JSON.parse(String(row.data))));
     }
     reviewCandidate(input) {
+        input = redactSessionValue(input).value;
         const review = this.db.transaction(() => {
             const candidate = this.getCandidate(input.candidateId, input.version, input.workspaceId);
             if (!candidate) {
@@ -1257,7 +1352,7 @@ export class SessionRepository {
     }
     recordPromotion(receiptInput) {
         const record = this.db.transaction(() => {
-            const receipt = PromotionReceiptSchema.parse(receiptInput);
+            const receipt = PromotionReceiptSchema.parse(redactSessionValue(receiptInput).value);
             const existing = this.getPromotionReceipt(receipt.candidateId, receipt.candidateVersion, receipt.consumer);
             if (existing)
                 return { ...existing, duplicate: true };
@@ -1324,6 +1419,7 @@ export class SessionRepository {
         return row ? JSON.parse(String(row.checkpoint)) : null;
     }
     relocateSource(sourceId, redactedLocator, workspaceId) {
+        redactedLocator = redactSessionText(redactedLocator).text;
         const relocate = this.db.transaction(() => {
             const row = this.db.prepare(`SELECT src.data FROM session_sources src
          WHERE src.source_id=? ${workspaceId ? `AND EXISTS (
@@ -1381,7 +1477,7 @@ export class SessionRepository {
         };
     }
     tombstoneSession(sessionId, workspaceId) {
-        const tombstone = this.db.transaction(() => {
+        const tombstone = this.maintainedAnalyticsTransaction(() => {
             const row = this.db.prepare(`SELECT data, workspace_id FROM sessions
          WHERE session_id=? ${workspaceId ? 'AND workspace_id=?' : ''}`).get(...(workspaceId ? [sessionId, workspaceId] : [sessionId]));
             if (!row)
@@ -1410,7 +1506,7 @@ export class SessionRepository {
         return tombstone();
     }
     restoreSession(sessionId, workspaceId) {
-        const restore = this.db.transaction(() => {
+        const restore = this.maintainedAnalyticsTransaction(() => {
             const row = this.db.prepare(`SELECT data, workspace_id FROM sessions
          WHERE session_id=? ${workspaceId ? 'AND workspace_id=?' : ''}`).get(...(workspaceId ? [sessionId, workspaceId] : [sessionId]));
             if (!row)
@@ -1524,6 +1620,7 @@ export class SessionRepository {
         return rows.map((row) => JSON.parse(String(row.data)));
     }
     purgeSession(input) {
+        input = redactSessionValue(input).value;
         const existing = this.db.prepare('SELECT data FROM deletion_receipts WHERE operation_id=?').get(input.preview.operationId);
         if (existing)
             return JSON.parse(String(existing.data));
@@ -1543,7 +1640,7 @@ export class SessionRepository {
         if (!mutationWorkspaceId) {
             throw new SessionContractError('OPERATION_NOT_AUTHORIZED', 'purge mutation lacks an authorized workspace');
         }
-        const apply = this.db.transaction(() => {
+        const apply = this.maintainedAnalyticsTransaction(() => {
             for (const decision of validatedDecisions) {
                 this.db.prepare(`INSERT INTO promotion_dependency_decisions
            (operation_id, dependent_id, action, basis) VALUES (?, ?, ?, ?)`).run(input.preview.operationId, decision.dependentId, decision.action, decision.basis);
@@ -1637,7 +1734,7 @@ export class SessionRepository {
         return apply();
     }
     reindex(workspaceId) {
-        const rebuild = this.db.transaction(() => {
+        const rebuild = this.maintainedAnalyticsTransaction(() => {
             let indexed = 0;
             if (!workspaceId) {
                 this.db.exec('REINDEX');