@alisio/core 0.1.0-alpha.17 → 0.1.0-alpha.18

package/dist/index.js

@@ -1,7 +1,9 @@
 /** @alisio/core public API: embed the Alisio agent programmatically. */
 export * from "@alisio/sdk";
+export { activeAgentCatalog, agentCatalogFromState, agentPickerItems, agentRunOptions, BUILTIN_AGENTS, DEFAULT_AGENT_ID, mainAgentFromRecord, resolveActiveAgent, } from "./agents/active.js";
 export { createApplication, enabledBuiltins, } from "./application.js";
-export { configFile, configHome, configSchema, isSettableSettingKey, loadConfig, loadConfigWithProvenance, overridesSavedProviderProfile, setConfigValue, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, stateHome, } from "./config.js";
+export { BUILTIN_COMMANDS, CommandCatalog, } from "./commands/catalog.js";
+export { configFile, configHome, configSchema, isSettableSettingKey, loadConfig, loadConfigWithProvenance, overridesSavedProviderProfile, setConfigValue, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, settableSettings, stateHome, } from "./config.js";
 export { checkpointInstructions, completeText, effectiveContextBudget, estimateTokens, MAX_TRUSTED_WINDOW, parseCheckpointOutput, planCompaction, renderCheckpoint, serializeForSummary, shouldCompact, shouldCompactContext, summarize, } from "./core/compaction.js";
 export { ToolRegistry } from "./core/registry.js";
 export { AgentRunner, defaultTokenBudget, } from "./core/runner.js";
@@ -12,14 +14,16 @@ export { discoverPlugins, PluginHost, pluginPrefix, } from "./plugins/host.js";
 export { cliInstall, INSTALL_TIMEOUT_MS, installedNpmPlugins, installPlugin, npmInstallTarget, parsePluginSpec, pluginTrustRemark, printInstallResult, registerPluginInstallTool, sanitizeNpmError, } from "./plugins/install.js";
 export { ActiveProvider, ProviderRegistry, UnconfiguredProvider } from "./providers/registry.js";
 export { availableProviderModels, resolveProviderModel, } from "./providers/routing.js";
-export { ProviderSettingsStore, } from "./providers/settings.js";
+export { maskSecret, ProviderSettingsStore, } from "./providers/settings.js";
 export { ProjectContext, } from "./resources/context.js";
 export { expandSlashPrompt, loadPromptTemplates, parsePromptTemplate, promptSources, renderPromptTemplate, splitArguments, } from "./resources/prompts.js";
 export { Skills, skillRoots, } from "./resources/skills.js";
 export { PathAccess, } from "./runtime/access.js";
+export { BlobStore } from "./runtime/blobs.js";
+export { clipLines, unifiedPatch } from "./runtime/diff.js";
 export { exists, fileSize, readHead, readJson, readText, which } from "./runtime/fs.js";
 export { defaultGlobalRoots, isPathSpec, PLUGIN_KEYWORD, resolvePluginSpec, } from "./runtime/modules.js";
-export { findWorkspace, outsideRootsMessage, safePath } from "./runtime/paths.js";
+export { findWorkspace, inside, outsideRootsMessage, safePath } from "./runtime/paths.js";
 export { isMissingCommand, RIPGREP_INSTALL_HINT, runProcess, } from "./runtime/process.js";
 export { isSqliteExperimentalWarning, openDatabase } from "./runtime/sqlite.js";
 export { SQLiteStore } from "./runtime/store.js";

package/dist/mcp/rich.js

@@ -16,6 +16,7 @@
  *   `JSON.stringify(result)` behavior verbatim.
  */
 import { textResult } from "@alisio/sdk";
+import { stripAnsi } from "../startup/text.js";
 const scalar = (value) => typeof value === "string"
     ? value
     : typeof value === "number" || typeof value === "boolean" || value === null
@@ -177,6 +178,73 @@ export function renderUiBlockText(block) {
         }
         case "markdown":
             return block.text;
+        case "diff": {
+            const label = [block.caption, block.path].filter(Boolean).join(" · ");
+            const head = label ? `[diff: ${label}]` : "[diff]";
+            if (block.patch !== undefined)
+                return `${head}\n${fenced(block.patch, "diff")}`;
+            return [
+                head,
+                `before:\n${fenced(block.before ?? "", block.lang)}`,
+                `after:\n${fenced(block.after ?? "", block.lang)}`,
+            ].join("\n");
+        }
+        case "terminal": {
+            const status = [
+                block.exitCode !== undefined ? `exit ${block.exitCode}` : "",
+                block.durationMs !== undefined ? `${block.durationMs}ms` : "",
+                block.truncated ? "output truncated" : "",
+            ]
+                .filter(Boolean)
+                .join(" · ");
+            return [
+                block.command ? `$ ${block.command}` : "[terminal]",
+                fenced(stripAnsi(block.output)),
+                status,
+            ]
+                .filter((line) => line !== "")
+                .join("\n");
+        }
+        case "mermaid":
+            return [block.title ? `[mermaid: ${block.title}]` : "", fenced(block.source, "mermaid")]
+                .filter((line) => line !== "")
+                .join("\n");
+        case "math":
+            return block.display ? `$$\n${block.latex}\n$$` : `$${block.latex}$`;
+        case "json":
+            return [
+                block.caption ? `[json: ${block.caption}]` : "",
+                fenced(jsonText(block.value), "json"),
+            ]
+                .filter((line) => line !== "")
+                .join("\n");
+        case "test-results": {
+            const cases = block.suites.flatMap((suite) => suite.cases.map((c) => `${c.status.toUpperCase()} ${suite.name} › ${c.name}${c.error ? `: ${c.error}` : ""}`));
+            return [`[test-results${block.framework ? `: ${block.framework}` : ""}]`, ...cases].join("\n");
+        }
+        case "progress":
+            return [
+                block.title ? `[progress: ${block.title}]` : "[progress]",
+                ...block.steps.map((step) => `- [${step.status}] ${step.label}${step.detail ? ` (${step.detail})` : ""}`),
+            ].join("\n");
+        default: {
+            // A kind this build does not know (e.g. persisted by a newer Alisio): keep it readable.
+            const kind = String(block.kind ?? "unknown");
+            return `[ui block: ${kind}]\n${fenced(jsonText(block), "json")}`;
+        }
+    }
+}
+function fenced(text, lang) {
+    const body = text.endsWith("\n") ? text : `${text}\n`;
+    return `\`\`\`${lang ?? ""}\n${body}\`\`\``;
+}
+/** `JSON.stringify` that never throws and never returns `undefined`. */
+function jsonText(value) {
+    try {
+        return JSON.stringify(value, null, 2) ?? String(value);
+    }
+    catch {
+        return String(value);
     }
 }
 const base64Bytes = (data) => Math.floor((data.length * 3) / 4);

package/dist/plugins/host.d.ts

@@ -37,6 +37,8 @@ export declare class PluginHost implements RunnerExtensions {
     private startHandlers;
     private endHandlers;
     private fieldOwners;
+    /** Registered tool name → contributing plugin id. */
+    private toolOwners;
     private completer?;
     private modelsImpl?;
     observers: Set<(event: Readonly<RunEvent>) => void>;
@@ -166,6 +168,8 @@ export declare class PluginHost implements RunnerExtensions {
     }>;
     /** Loaded plugins (id, version, built-in flag), ordered by id. */
     metadata(): PluginMetadata[];
+    /** Registered names of the tools a plugin contributes (namespaced unless built in). */
+    toolsOf(plugin: string): string[];
     get hasSessionEndHooks(): boolean;
     /** Conservative ownership check used to protect a live session from plugin removal. */
     ownsSessionResources(plugin: string): boolean;

package/dist/plugins/host.js

@@ -38,6 +38,8 @@ export class PluginHost {
     startHandlers = [];
     endHandlers = [];
     fieldOwners = new Map();
+    /** Registered tool name → contributing plugin id. */
+    toolOwners = new Map();
     completer;
     modelsImpl;
     observers = new Set();
@@ -198,14 +200,22 @@ export class PluginHost {
         };
         const api = {
             tools: {
-                register: (tool) => track(this.registry.register(builtin
-                    ? tool
-                    : {
-                        ...tool,
-                        name: `${pluginPrefix(plugin.id)}_${tool.name}`,
-                        // Only built-ins may claim the always-allowed internal effect.
-                        ...(tool.effect === "internal" ? { effect: "external" } : {}),
-                    })),
+                register: (tool) => {
+                    const registered = builtin
+                        ? tool
+                        : {
+                            ...tool,
+                            name: `${pluginPrefix(plugin.id)}_${tool.name}`,
+                            // Only built-ins may claim the always-allowed internal effect.
+                            ...(tool.effect === "internal" ? { effect: "external" } : {}),
+                        };
+                    const unregister = this.registry.register(registered);
+                    this.toolOwners.set(registered.name, plugin.id);
+                    return track(() => {
+                        unregister();
+                        this.toolOwners.delete(registered.name);
+                    });
+                },
             },
             commands: {
                 register: (name, handler, info) => {
@@ -544,6 +554,10 @@ export class PluginHost {
         }))
             .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
     }
+    /** Registered names of the tools a plugin contributes (namespaced unless built in). */
+    toolsOf(plugin) {
+        return [...this.toolOwners].filter(([, owner]) => owner === plugin).map(([name]) => name);
+    }
     get hasSessionEndHooks() {
         return this.endHandlers.length > 0;
     }

package/dist/providers/settings.d.ts

@@ -9,6 +9,11 @@ export interface ProviderSettings {
     active?: string;
     profiles: Record<string, ProviderProfile>;
 }
+/**
+ * Display form of a secret: its last three characters behind an ellipsis, and nothing at all for
+ * secrets shorter than 16 characters (a tail would reveal too much of them).
+ */
+export declare function maskSecret(secret: string): string | undefined;
 export declare class ProviderSettingsStore {
     readonly profilesPath: string;
     readonly credentialsPath: string;
@@ -27,4 +32,14 @@ export declare class ProviderSettingsStore {
         credentials: Record<string, string>;
     } | undefined>;
     saveActive(name: string, profile: ProviderProfile, secrets: Record<string, string>): Promise<void>;
+    /** Stores or replaces a profile's non-secret values without changing the active profile. */
+    saveProfile(name: string, profile: ProviderProfile): Promise<void>;
+    /** Merges secrets into a profile's stored credentials (write-only: nothing is returned). */
+    setCredentials(name: string, secrets: Record<string, string>): Promise<void>;
+    /** Removes every stored credential of a profile; false when it had none. */
+    deleteCredentials(name: string): Promise<boolean>;
+    /** Which credentials a profile has stored, masked (`maskSecret`); never the values. */
+    credentialStatus(name: string): Promise<Record<string, {
+        tail?: string;
+    }>>;
 }

package/dist/providers/settings.js

@@ -29,6 +29,13 @@ async function atomicJson(path, value, mode) {
     await rename(temporary, path);
     await chmod(path, mode);
 }
+/**
+ * Display form of a secret: its last three characters behind an ellipsis, and nothing at all for
+ * secrets shorter than 16 characters (a tail would reveal too much of them).
+ */
+export function maskSecret(secret) {
+    return secret.length >= 16 ? `…${secret.slice(-3)}` : undefined;
+}
 export class ProviderSettingsStore {
     profilesPath;
     credentialsPath;
@@ -77,4 +84,35 @@ export class ProviderSettingsStore {
         await atomicJson(this.credentialsPath, credentials, 0o600);
         await atomicJson(this.profilesPath, settings, 0o600);
     }
+    /** Stores or replaces a profile's non-secret values without changing the active profile. */
+    async saveProfile(name, profile) {
+        const settings = await this.load();
+        settings.profiles[name] = profile;
+        await atomicJson(this.profilesPath, settings, 0o600);
+    }
+    /** Merges secrets into a profile's stored credentials (write-only: nothing is returned). */
+    async setCredentials(name, secrets) {
+        const credentials = await this.credentials();
+        credentials.providers[name] = { ...(credentials.providers[name] ?? {}), ...secrets };
+        await atomicJson(this.credentialsPath, credentials, 0o600);
+    }
+    /** Removes every stored credential of a profile; false when it had none. */
+    async deleteCredentials(name) {
+        const credentials = await this.credentials();
+        if (!credentials.providers[name] || !Object.keys(credentials.providers[name]).length)
+            return false;
+        delete credentials.providers[name];
+        await atomicJson(this.credentialsPath, credentials, 0o600);
+        return true;
+    }
+    /** Which credentials a profile has stored, masked (`maskSecret`); never the values. */
+    async credentialStatus(name) {
+        const stored = (await this.credentials()).providers[name] ?? {};
+        return Object.fromEntries(Object.entries(stored)
+            .filter(([, value]) => typeof value === "string" && value.length > 0)
+            .map(([key, value]) => {
+            const tail = maskSecret(value);
+            return [key, tail ? { tail } : {}];
+        }));
+    }
 }

package/dist/runtime/blobs.d.ts

@@ -0,0 +1,29 @@
+import type { Attachment, BlobRef, SqlDatabase } from "@alisio/sdk";
+export interface BlobStoreOptions {
+    /** Directory that holds `sha256/…` (by default `<state home>/blobs`). */
+    root: string;
+    /** Session database with the v4 `blobs` table (e.g. `SQLiteStore.db`). */
+    db: SqlDatabase;
+}
+export declare class BlobStore {
+    private readonly options;
+    constructor(options: BlobStoreOptions);
+    /** Absolute file path of a blob. Throws for anything that is not a lowercase sha256 hex. */
+    path(hash: string): string;
+    has(hash: string): boolean;
+    private row;
+    /** Stores bytes once per content hash and returns their reference. */
+    put(bytes: Uint8Array, mimeType: string, dims?: {
+        width?: number;
+        height?: number;
+    }): BlobRef;
+    get(hash: string): {
+        bytes: Buffer;
+        mimeType: string;
+    } | undefined;
+    /**
+     * Resolves a reference into a provider-ready image `Attachment` (base64 `data`), verifying
+     * that the stored bytes still match the hash.
+     */
+    attachment(ref: BlobRef): Attachment;
+}

package/dist/runtime/blobs.js

@@ -0,0 +1,94 @@
+/**
+ * Content-addressed attachment bytes (v4). Files live at `<root>/sha256/<hash[0..2]>/<hash>`
+ * (directories 0700, files 0600, atomic temp-file + rename); metadata lives in the `blobs` table
+ * of the session database. Portable `node:fs`/`node:crypto` only (Node and Bun).
+ *
+ * `Attachment.data` stays required in the SDK, so blobs never reach the runner by reference: the
+ * host resolves a `BlobRef` into a base64 `Attachment` with `attachment()` before `runner.run`.
+ * Persisted messages therefore still carry base64 (as legacy inline attachments do).
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+const HASH = /^[0-9a-f]{64}$/;
+export class BlobStore {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Absolute file path of a blob. Throws for anything that is not a lowercase sha256 hex. */
+    path(hash) {
+        if (!HASH.test(hash))
+            throw new Error(`Invalid blob hash: ${hash.slice(0, 80)}`);
+        return join(this.options.root, "sha256", hash.slice(0, 2), hash);
+    }
+    has(hash) {
+        return HASH.test(hash) && existsSync(this.path(hash)) && !!this.row(hash);
+    }
+    row(hash) {
+        return this.options.db.prepare("SELECT * FROM blobs WHERE hash=?").get(hash);
+    }
+    /** Stores bytes once per content hash and returns their reference. */
+    put(bytes, mimeType, dims = {}) {
+        const mime = mimeType.trim();
+        if (!mime || mime.length > 255)
+            throw new Error("A blob needs a MIME type");
+        const hash = createHash("sha256").update(bytes).digest("hex");
+        const file = this.path(hash);
+        if (!existsSync(file)) {
+            const dir = join(this.options.root, "sha256", hash.slice(0, 2));
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+            chmodSync(dir, 0o700);
+            const temp = join(dir, `.tmp-${randomUUID()}`);
+            try {
+                writeFileSync(temp, bytes, { mode: 0o600, flag: "wx" });
+                renameSync(temp, file);
+            }
+            catch (error) {
+                rmSync(temp, { force: true });
+                throw error;
+            }
+        }
+        this.options.db
+            .prepare("INSERT OR IGNORE INTO blobs(hash,mime,size,width,height,created_at) VALUES(?,?,?,?,?,?)")
+            .run(hash, mime, bytes.byteLength, dims.width ?? null, dims.height ?? null, Date.now());
+        const row = this.row(hash);
+        return {
+            hash,
+            mimeType: row?.mime ?? mime,
+            bytes: bytes.byteLength,
+            ...(row?.width != null ? { width: Number(row.width) } : {}),
+            ...(row?.height != null ? { height: Number(row.height) } : {}),
+        };
+    }
+    get(hash) {
+        if (!HASH.test(hash))
+            return undefined;
+        const row = this.row(hash);
+        const file = this.path(hash);
+        if (!row || !existsSync(file))
+            return undefined;
+        return { bytes: readFileSync(file), mimeType: row.mime };
+    }
+    /**
+     * Resolves a reference into a provider-ready image `Attachment` (base64 `data`), verifying
+     * that the stored bytes still match the hash.
+     */
+    attachment(ref) {
+        const found = this.get(ref.hash);
+        if (!found)
+            throw new Error(`Blob not found: ${ref.hash}`);
+        if (createHash("sha256").update(found.bytes).digest("hex") !== ref.hash)
+            throw new Error(`Blob content does not match its hash: ${ref.hash}`);
+        if (!found.mimeType.startsWith("image/"))
+            throw new Error(`Only image blobs can be attached (got ${found.mimeType})`);
+        return {
+            kind: "image",
+            mimeType: found.mimeType,
+            data: found.bytes.toString("base64"),
+            bytes: found.bytes.byteLength,
+            ...(ref.width !== undefined ? { width: ref.width } : {}),
+            ...(ref.height !== undefined ? { height: ref.height } : {}),
+        };
+    }
+}

package/dist/runtime/diff.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Unified line diffs for the `diff` UiBlock that `write_file`/`edit_file` attach for rich
+ * clients (spec §8.6, RF-13). Myers O((N+M)·D) on lines after trimming the common prefix and
+ * suffix; when the edit distance exceeds `maxD` the middle becomes a full replacement. Pure and
+ * portable (no dependency). The web UI ships its own copy of the algorithm for third-party blocks
+ * that only carry `before`/`after` (packages cannot share code with the browser bundle).
+ */
+type Op = 0 | 1 | 2;
+/** Line edit script (0 equal, 1 delete, 2 insert). */
+export declare function lineEdits(a: string[], b: string[], maxD?: number): Op[];
+/**
+ * A unified patch (`--- a/path`, `+++ b/path`, hunks with `context` lines) from `before` to
+ * `after`; `undefined` means the file did not exist. Identical texts give `""`.
+ */
+export declare function unifiedPatch(path: string, before: string | undefined, after: string | undefined, options?: {
+    context?: number;
+}): string;
+/** Cuts `text` at a line boundary so it fits in `maxBytes` (UTF-8). */
+export declare function clipLines(text: string, maxBytes: number): {
+    text: string;
+    clipped: boolean;
+};
+export {};

package/dist/runtime/diff.js

@@ -0,0 +1,154 @@
+/**
+ * Unified line diffs for the `diff` UiBlock that `write_file`/`edit_file` attach for rich
+ * clients (spec §8.6, RF-13). Myers O((N+M)·D) on lines after trimming the common prefix and
+ * suffix; when the edit distance exceeds `maxD` the middle becomes a full replacement. Pure and
+ * portable (no dependency). The web UI ships its own copy of the algorithm for third-party blocks
+ * that only carry `before`/`after` (packages cannot share code with the browser bundle).
+ */
+function myers(a, b, maxD) {
+    const n = a.length;
+    const m = b.length;
+    if (!n)
+        return b.map(() => 2);
+    if (!m)
+        return a.map(() => 1);
+    const max = n + m;
+    const offset = max + 1;
+    const v = new Int32Array(2 * max + 3);
+    const trace = [];
+    for (let d = 0; d <= Math.min(max, maxD); d++) {
+        trace.push(v.slice(offset - d - 1, offset + d + 2));
+        for (let k = -d; k <= d; k += 2) {
+            let x = k === -d || (k !== d && v[offset + k - 1] < v[offset + k + 1])
+                ? v[offset + k + 1]
+                : v[offset + k - 1] + 1;
+            let y = x - k;
+            while (x < n && y < m && a[x] === b[y]) {
+                x++;
+                y++;
+            }
+            v[offset + k] = x;
+            if (x >= n && y >= m)
+                return backtrack(trace, n, m);
+        }
+    }
+    return undefined;
+}
+function backtrack(trace, n, m) {
+    const ops = [];
+    let x = n;
+    let y = m;
+    for (let d = trace.length - 1; d > 0; d--) {
+        const snap = trace[d];
+        const at = (k) => snap[k + d + 1];
+        const k = x - y;
+        const prevK = k === -d || (k !== d && at(k - 1) < at(k + 1)) ? k + 1 : k - 1;
+        const prevX = at(prevK);
+        const prevY = prevX - prevK;
+        while (x > prevX && y > prevY) {
+            ops.push(0);
+            x--;
+            y--;
+        }
+        ops.push(x === prevX ? 2 : 1);
+        x = prevX;
+        y = prevY;
+    }
+    while (x > 0 && y > 0) {
+        ops.push(0);
+        x--;
+        y--;
+    }
+    return ops.reverse();
+}
+/** Line edit script (0 equal, 1 delete, 2 insert). */
+export function lineEdits(a, b, maxD = 2000) {
+    let start = 0;
+    while (start < a.length && start < b.length && a[start] === b[start])
+        start++;
+    let endA = a.length;
+    let endB = b.length;
+    while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) {
+        endA--;
+        endB--;
+    }
+    const midA = a.slice(start, endA);
+    const midB = b.slice(start, endB);
+    const middle = myers(midA, midB, maxD) ?? [...midA.map(() => 1), ...midB.map(() => 2)];
+    return [...new Array(start).fill(0), ...middle, ...new Array(a.length - endA).fill(0)];
+}
+const NO_EOL = "\u0000no-eol";
+/** Lines of a text; a last line without `\n` carries a marker so a newline change is a change. */
+function linesOf(text) {
+    if (!text)
+        return [];
+    const lines = text.split("\n");
+    if (lines.at(-1) === "")
+        lines.pop();
+    else
+        lines[lines.length - 1] = `${lines.at(-1)}${NO_EOL}`;
+    return lines;
+}
+/**
+ * A unified patch (`--- a/path`, `+++ b/path`, hunks with `context` lines) from `before` to
+ * `after`; `undefined` means the file did not exist. Identical texts give `""`.
+ */
+export function unifiedPatch(path, before, after, options = {}) {
+    const context = options.context ?? 3;
+    const a = linesOf(before);
+    const b = linesOf(after);
+    const rows = [];
+    let i = 0;
+    let j = 0;
+    for (const op of lineEdits(a, b)) {
+        if (op === 0)
+            rows.push({ op, text: a[i], old: i++, new: j++ });
+        else if (op === 1)
+            rows.push({ op, text: a[i], old: i++, new: j });
+        else
+            rows.push({ op, text: b[j], old: i, new: j++ });
+    }
+    const hunks = [];
+    for (let k = 0; k < rows.length; k++) {
+        if (rows[k].op === 0)
+            continue;
+        const from = Math.max(0, k - context);
+        const last = hunks.at(-1);
+        if (last && from <= last[1] + 1)
+            last[1] = Math.min(rows.length - 1, k + context);
+        else
+            hunks.push([from, Math.min(rows.length - 1, k + context)]);
+    }
+    if (!hunks.length)
+        return "";
+    const out = [
+        `--- ${before === undefined ? "/dev/null" : `a/${path}`}`,
+        `+++ ${after === undefined ? "/dev/null" : `b/${path}`}`,
+    ];
+    const range = (start, count) => count === 1 ? `${start + 1}` : `${count === 0 ? start : start + 1},${count}`;
+    for (const [from, to] of hunks) {
+        const slice = rows.slice(from, to + 1);
+        const first = slice[0];
+        const oldCount = slice.filter((r) => r.op !== 2).length;
+        const newCount = slice.filter((r) => r.op !== 1).length;
+        out.push(`@@ -${range(first.old, oldCount)} +${range(first.new, newCount)} @@`);
+        for (const row of slice) {
+            const noEol = row.text.endsWith(NO_EOL);
+            const text = noEol ? row.text.slice(0, -NO_EOL.length) : row.text;
+            out.push(`${row.op === 0 ? " " : row.op === 1 ? "-" : "+"}${text}`);
+            if (noEol)
+                out.push("\");
+        }
+    }
+    return out.join("\n");
+}
+/** Cuts `text` at a line boundary so it fits in `maxBytes` (UTF-8). */
+export function clipLines(text, maxBytes) {
+    if (Buffer.byteLength(text) <= maxBytes)
+        return { text, clipped: false };
+    let cut = Buffer.from(text).subarray(0, maxBytes).toString("utf8");
+    // A split multi-byte character decodes to U+FFFD; drop the partial last line either way.
+    const newline = cut.lastIndexOf("\n");
+    cut = newline > 0 ? cut.slice(0, newline) : cut.replace(/�$/, "");
+    return { text: cut, clipped: true };
+}

package/dist/runtime/store.d.ts

@@ -1,5 +1,5 @@
 import { type Message, type SqlDatabase, type ToolCall, type ToolResult } from "@alisio/sdk";
-import type { Session, SessionStore } from "../core/contracts.ts";
+import type { BeginRunInput, EndRunInput, EventPage, MessagePage, PageOptions, RunRecord, Session, SessionStore, ToolCallMeta } from "../core/contracts.ts";
 export declare class SQLiteStore implements SessionStore {
     readonly db: SqlDatabase;
     constructor(path: string);
@@ -23,17 +23,83 @@ export declare class SQLiteStore implements SessionStore {
     interruptStale(): number;
     messages(id: string): Message[];
     append(id: string, message: Message): void;
+    private touch;
     setModel(id: string, model: string): void;
     compact(id: string, replaced: number, summary: Message): void;
     overwrite(id: string, messages: Message[]): void;
     acquire(id: string): void;
     release(id: string): void;
-    beginCall(id: string, call: ToolCall): void;
+    beginCall(id: string, call: ToolCall, meta?: ToolCallMeta): void;
     endCall(id: string, call: ToolCall, result: ToolResult): void;
+    /**
+     * Calls of a session with one effect (for example `write`), oldest first. Needs the v4
+     * `effect`/`run_id`/`started_at` columns; rows written by older versions have no effect.
+     */
+    effectCalls(session: string, effect: string): Array<{
+        callId: string;
+        name: string;
+        runId?: string;
+        startedAt?: number;
+    }>;
     /** Rich (ui/image) parts persist as part of the serialized result and replay verbatim. */
     callResult(id: string, callId: string): ToolResult | undefined;
     reconcile(id: string, acknowledge?: boolean): void;
-    event(id: string, runId: string, type: string, data: unknown): void;
+    /** Persists a durable event and returns its global `events.seq`. */
+    event(id: string, runId: string, type: string, data: unknown, meta?: {
+        correlationId?: string;
+    }): number;
+    private runRow;
+    private runById;
+    beginRun(input: BeginRunInput): {
+        run: RunRecord;
+        created: boolean;
+    };
+    endRun(id: string, input: EndRunInput): void;
+    runByRequest(session: string, requestId: string): RunRecord | undefined;
+    runs(session: string, options?: {
+        limit?: number;
+    }): RunRecord[];
+    interruptRuns(): number;
+    /**
+     * A page of messages by `seq`. With `after`, the first `limit` rows after it; otherwise the
+     * newest `limit` rows (before `before` when given). Items are always in ascending order.
+     */
+    messagesPage(session: string, options?: PageOptions & {
+        compacted?: boolean;
+    }): MessagePage;
+    /** Durable events of a session after `after` (a previous `eventId`), ascending. */
+    eventsPage(session: string, options?: PageOptions): EventPage;
+    /**
+     * Known workspaces for web clients: the workspaces of root sessions plus the ones recorded with
+     * `recordWorkspace` (v4 `workspaces` table), with their UI metadata and root-session count.
+     */
+    workspaces(): Array<{
+        path: string;
+        label?: string;
+        pinned: boolean;
+        lastOpenedAt?: number;
+        sessions: number;
+    }>;
+    /** Records a workspace and patches its UI metadata (`label: null` clears the label). */
+    recordWorkspace(path: string, patch?: {
+        label?: string | null;
+        pinned?: boolean;
+        lastOpenedAt?: number;
+    }): void;
+    /**
+     * Patches web-facing session metadata: title, pin, archive flag and `options` (shallow-merged
+     * into the stored options object). Does not touch the run-relevant columns.
+     */
+    updateSessionMeta(id: string, patch: {
+        title?: string | null;
+        pinned?: boolean;
+        archived?: boolean;
+        options?: Record<string, unknown>;
+    }): void;
+    /** `MAX(events.seq)` of a session (0 without events): the web snapshot cursor. */
+    lastEventId(session: string): number;
+    /** The pid of another live process holding the session lock, if any. */
+    lockedBy(id: string): number | undefined;
     getState(plugin: string, key: string): unknown;
     setState(plugin: string, key: string, value: unknown): void;
     close(): void;