@claudexor/daemon 1.0.1 → 2.1.2

package/dist/server.js

@@ -1,11 +1,10 @@
 import { connect, createServer } from "node:net";
 import { timingSafeEqual } from "node:crypto";
-import { chmodSync, copyFileSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { chmodSync, lstatSync, unlinkSync } from "node:fs";
 import { createInterface } from "node:readline";
-import { join } from "node:path";
-import { appendRunEvent } from "@claudexor/event-log";
-import { assertNoInlineSecretValues, errorCode, newId, nowIso, pathExists, readJsonSafe, redactSecrets } from "@claudexor/util";
+import { assertNoInlineSecretValues, errorCode, newId, nowIso, pathExists, redactSecrets, } from "@claudexor/util";
+import { commandStoreForId, commandStoreForRequest, commandStores, } from "./command-authority.js";
+import { productCommandRecords, prunableCommandIds } from "./command-retention.js";
 export const JOB_STATES = [
     "queued",
     "running",
@@ -16,81 +15,78 @@ export const JOB_STATES = [
     "review_not_run",
     "failed",
     "cancelled",
-    "interrupted",
+    "interrupted_unknown",
+    "cost_unverifiable",
+    "exhausted_overshoot",
     "exhausted",
     "not_converged",
     "stuck_no_progress",
 ];
-/**
- * Per-record validation for the persisted registry: one hand-edited or
- * version-skewed record must not wipe the whole run history, and a record
- * with a state outside the enum must never reach the strict control-api
- * DTOs (where it would 500 the entire GET /runs list).
- */
-function salvageJobRecord(raw) {
-    if (!raw || typeof raw !== "object")
-        return null;
-    const rec = raw;
-    if (typeof rec["id"] !== "string" || rec["id"].length === 0)
-        return null;
-    if (typeof rec["state"] !== "string" || !JOB_STATES.includes(rec["state"]))
-        return null;
-    if (typeof rec["createdAt"] !== "string")
-        return null;
-    const optionalString = (key) => typeof rec[key] === "string" ? rec[key] : undefined;
-    return {
-        id: rec["id"],
-        state: rec["state"],
-        params: rec["params"],
-        error: optionalString("error"),
-        errorCode: optionalString("errorCode"),
-        createdAt: rec["createdAt"],
-        runId: optionalString("runId"),
-        taskId: optionalString("taskId"),
-        runDir: optionalString("runDir"),
-        startedAt: optionalString("startedAt"),
-        finishedAt: optionalString("finishedAt"),
-    };
-}
-/**
- * Local daemon: Unix-socket JSON-RPC with token auth + a bounded-concurrency
- * worker pool (up to maxConcurrent jobs in parallel) backed by an optional
- * durable, atomically-written job registry. It does NOT contain a second
- * scheduler — it calls the injected runner (the same Orchestrator the CLI uses).
- */
+/** Unix-socket worker pool; scheduling stays in the injected Orchestrator. */
 export class DaemonServer {
     opts;
     server;
+    sockets = new Set();
     queue = [];
-    records = new Map();
     cancelled = new Set();
     controllers = new Map();
+    activeTasks = new Set();
+    taskFailures = [];
     active = 0;
     startedAt = Date.now();
-    onClosed;
+    stopping = false;
+    startPromise;
+    stopPromise;
+    resolveShutdown;
+    shutdownPromise = new Promise((resolve) => {
+        this.resolveShutdown = resolve;
+    });
     constructor(opts) {
         this.opts = opts;
     }
     async start() {
-        // Refuse to clobber a LIVE daemon: deleting its socket would orphan it and
-        // turn jobs.json into a last-writer-wins race between two processes.
+        if (this.stopping) {
+            throw Object.assign(new Error("daemon is stopping and cannot be started"), {
+                code: "daemon_stopping",
+                status: 503,
+            });
+        }
+        this.startPromise ??= this.startOnce();
+        await this.startPromise;
+        if (this.stopping) {
+            await this.stop();
+            throw Object.assign(new Error("daemon startup was cancelled by shutdown"), {
+                code: "daemon_stopping",
+                status: 503,
+            });
+        }
+    }
+    async startOnce() {
         if (pathExists(this.opts.socketPath) && (await socketAlive(this.opts.socketPath))) {
             throw new Error(`a claudexor daemon is already listening on ${this.opts.socketPath}; stop it first`);
         }
-        this.load();
-        try {
-            rmSync(this.opts.socketPath, { force: true });
-        }
-        catch {
-            /* nothing to clean */
+        await this.opts.startupBarrier?.("before_registry_load");
+        if (this.stopping)
+            throw this.stoppingError("daemon startup was cancelled before listen");
+        commandStores(this.opts.commands);
+        await this.opts.startupBarrier?.("after_registry_load");
+        if (this.stopping)
+            throw this.stoppingError("daemon startup was cancelled after registry load");
+        if (pathExists(this.opts.socketPath)) {
+            const stale = lstatSync(this.opts.socketPath);
+            if (!stale.isSocket() || (process.getuid && stale.uid !== process.getuid())) {
+                throw Object.assign(new Error(`refusing to replace non-owned Unix socket path`), {
+                    code: "unsafe_daemon_socket_path",
+                });
+            }
+            unlinkSync(this.opts.socketPath);
         }
+        if (this.stopping)
+            throw this.stoppingError("daemon startup was cancelled before listen");
         await new Promise((resolve, reject) => {
             this.server = createServer((sock) => this.onConnection(sock));
             this.server.once("error", reject);
             this.server.listen(this.opts.socketPath, () => {
-                // Owner-only socket: the bearer token is the auth layer, but a
-                // world-connectable socket needlessly exposes the RPC surface to every
-                // local user; chmod narrows it to the owning account.
                 try {
                     chmodSync(this.opts.socketPath, 0o600);
                 }
@@ -100,47 +96,76 @@ export class DaemonServer {
                 resolve();
             });
         });
-        // Resume any queued jobs re-enqueued from a previous session (see load()).
-        void this.drain();
     }
-    async stop() {
-        // Graceful shutdown: abort in-flight runs so the runner cancels their harness
-        // children and settles each job (no orphaned processes / "running" zombies in
-        // jobs.json), then WAIT (bounded) for the cancellations to settle. Without
-        // the wait, the process could exit before the SIGKILL escalation timers
-        // fire, leaving a SIGTERM-ignoring harness child alive in its group.
+    stop() {
+        this.stopping = true;
+        this.stopPromise ??= this.stopOnce();
+        return this.stopPromise;
+    }
+    async stopOnce() {
         for (const controller of this.controllers.values()) {
             try {
-                controller.abort();
+                controller.abort(new Error("daemon shutdown"));
             }
             catch {
                 /* already gone */
             }
         }
-        const deadline = Date.now() + 5_000;
-        while (this.active > 0 && Date.now() < deadline) {
-            await new Promise((resolve) => setTimeout(resolve, 50));
+        const settled = await Promise.allSettled([...this.activeTasks]);
+        const rejected = settled.filter((entry) => entry.status === "rejected");
+        if (rejected.length > 0 || this.taskFailures.length > 0 || this.active !== 0) {
+            const first = rejected[0]?.reason ??
+                this.taskFailures[0] ??
+                new Error(`daemon still owns ${this.active} active runner(s)`);
+            throw Object.assign(new Error(`daemon shutdown drain failed: ${first instanceof Error ? first.message : String(first)}`), {
+                code: "daemon_shutdown_unconfirmed",
+                status: 503,
+                cause: first,
+            });
         }
-        this.persist();
-        await new Promise((resolve) => {
+        // A signal may have fenced shutdown while listen() was still resolving.
+        // Wait for that raw startup attempt, then close whatever listener exists;
+        // start() observes `stopping` and refuses to advertise readiness.
+        if (this.startPromise) {
+            try {
+                await this.startPromise;
+            }
+            catch {
+                /* a failed startup has no usable listener to preserve */
+            }
+        }
+        const serverClosed = new Promise((resolve, reject) => {
             if (!this.server)
                 return resolve();
-            this.server.close(() => resolve());
+            try {
+                this.server.close((error) => (error ? reject(error) : resolve()));
+            }
+            catch (error) {
+                if (error?.code === "ERR_SERVER_NOT_RUNNING")
+                    resolve();
+                else
+                    reject(error);
+            }
         });
-        this.onClosed?.();
+        // Existing local RPC sockets can otherwise keep server.close() pending
+        // forever. They are destroyed only after every accepted command settled.
+        for (const socket of this.sockets)
+            socket.destroy();
+        await serverClosed;
+        this.resolveShutdown();
     }
     /** Resolves when the daemon is shut down via RPC. */
     waitForShutdown() {
-        return new Promise((resolve) => {
-            this.onClosed = resolve;
-        });
+        return this.shutdownPromise;
     }
     onConnection(sock) {
+        this.sockets.add(sock);
         const rl = createInterface({ input: sock });
         rl.on("line", (line) => {
             void this.handle(line, sock);
         });
         sock.on("error", () => rl.close());
+        sock.on("close", () => this.sockets.delete(sock));
     }
     send(sock, obj) {
         try {
@@ -170,10 +195,17 @@ export class DaemonServer {
             this.send(sock, { id, result: await this.dispatch(method, params) });
         }
         catch (err) {
-            // Carry the machine-readable error code (e.g. inline_secret_rejected)
-            // alongside the redacted message so socket clients get the typed class.
             const code = errorCode(err);
-            this.send(sock, { id, error: { message: redactSecrets(err instanceof Error ? err.message : String(err)), ...(code ? { code } : {}) } });
+            this.send(sock, {
+                id,
+                error: {
+                    message: redactSecrets(err instanceof Error ? err.message : String(err)),
+                    ...(code ? { code } : {}),
+                    ...(err && typeof err === "object" && "status" in err
+                        ? { status: Number(err.status) }
+                        : {}),
+                },
+            });
         }
     }
     async dispatch(method, params) {
@@ -185,43 +217,64 @@ export class DaemonServer {
                     queue: this.queue.length,
                     running: this.active > 0,
                     active: this.active,
-                    jobs: this.records.size,
+                    jobs: this.allRecords().length,
+                    stopping: this.stopping,
                 };
             case "claudexor.enqueue": {
-                assertNoInlineSecretValues(params, "$", "daemon job params");
-                const id = newId("job");
-                this.records.set(id, { id, state: "queued", params, createdAt: nowIso() });
-                this.queue.push(id);
-                this.persist();
+                if (this.stopping) {
+                    throw Object.assign(new Error("daemon is stopping; retry after reconnect"), {
+                        code: "daemon_stopping",
+                        status: 503,
+                    });
+                }
+                const envelope = params;
+                const request = envelope?.request;
+                const idempotencyKey = String(envelope?.idempotencyKey ?? "");
+                const clientId = String(envelope?.clientId ?? "daemon-client");
+                assertNoInlineSecretValues(request, "$", "daemon job params");
+                const accepted = this.acceptCommand(request, idempotencyKey, clientId, envelope.idempotencyRequest, typeof envelope.operation === "string" ? envelope.operation : undefined);
+                if (!accepted.reused)
+                    this.queue.push(accepted.record.id);
                 void this.drain();
-                return { id, state: "queued" };
+                return { id: accepted.record.id, state: accepted.record.state };
             }
             case "claudexor.status": {
-                const rec = this.records.get(String(params?.id));
+                const rec = this.getRecord(String(params?.id));
                 if (!rec)
                     throw new Error(`no such job: ${params?.id}`);
                 return publicJobRecord(rec);
             }
+            case "claudexor.findAccepted": {
+                const store = commandStoreForRequest(this.opts.commands, params?.request);
+                const record = store.find({
+                    params: params?.request,
+                    idempotencyKey: String(params?.idempotencyKey ?? ""),
+                    clientId: String(params?.clientId ?? "daemon-client"),
+                    operation: typeof params?.operation === "string" ? params.operation : undefined,
+                });
+                return record ? publicJobRecord(record) : null;
+            }
             case "claudexor.list":
-                return [...this.records.values()].map(publicJobRecord);
+                return productCommandRecords(this.allRecords()).map(publicJobRecord);
             case "claudexor.cancel": {
                 const jid = String(params?.id);
-                // Honesty: cancelling an unknown id must fail loudly (like status),
-                // never claim `{cancelled:true}` for a job that does not exist.
-                const rec = this.records.get(jid);
+                const rec = this.getRecord(jid);
                 if (!rec)
                     throw new Error(`no such job: ${jid}`);
                 this.cancelled.add(jid);
                 if (rec.state === "queued")
-                    rec.state = "cancelled";
-                // Abort the in-flight run; the runner (Orchestrator) honors the signal,
-                // cancels the harness, then settles this job as cancelled.
+                    this.updateRecord(rec, { state: "cancelled" });
                 this.controllers.get(jid)?.abort();
-                this.persist();
                 return { id: jid, cancelled: true };
             }
             case "claudexor.shutdown":
-                setTimeout(() => void this.stop(), 10);
+                setTimeout(() => {
+                    const operation = this.opts.onShutdownRequested?.() ?? this.stop();
+                    void operation.catch(() => {
+                        // Fail closed: the process and ownership lease remain alive. The
+                        // composition root records the detailed failure in its private log.
+                    });
+                }, 10);
                 return { ok: true };
             default:
                 throw new Error(`unknown method: ${method}`);
@@ -230,104 +283,39 @@ export class DaemonServer {
     get maxConcurrent() {
         return this.opts.maxConcurrent ?? 4;
     }
-    /**
-     * Best-effort durable persistence of the job registry. Writes atomically
-     * (temp file + rename) so a crash mid-write cannot corrupt/drop the registry.
-     * The raw run `result` is intentionally NOT persisted: canonical output lives
-     * in .claudexor/runs (redacted), and result.summary can contain raw model text —
-     * keeping it out of jobs.json upholds the redaction-at-persistence invariant.
-     */
-    persist() {
-        const path = this.opts.persistPath;
-        if (!path)
-            return;
-        try {
-            const view = [...this.records.values()].map(persistedJobRecord);
-            mkdirSync(dirname(path), { recursive: true });
-            const tmp = `${path}.tmp`;
-            writeFileSync(tmp, JSON.stringify(view, null, 2) + "\n", { mode: 0o600 });
-            chmodSync(tmp, 0o600);
-            renameSync(tmp, path);
-            chmodSync(path, 0o600);
-        }
-        catch {
-            /* best-effort; never break a run on a persistence failure */
-        }
+    stoppingError(message) {
+        return Object.assign(new Error(message), { code: "daemon_stopping", status: 503 });
     }
-    /** Bound memory/disk: prune the oldest terminal jobs beyond maxHistory.
-     * `blocked` runs are NEVER pruned — they are the needs-human inbox awaiting an
-     * operator decision; dropping one would silently lose a pending action. */
     pruneHistory() {
-        const cap = this.opts.maxHistory ?? 500;
-        const terminal = [...this.records.values()].filter((r) => r.state !== "running" && r.state !== "queued" && r.state !== "blocked");
-        if (terminal.length <= cap)
-            return;
-        terminal.sort((a, b) => (a.createdAt < b.createdAt ? -1 : 1));
-        for (const r of terminal.slice(0, terminal.length - cap)) {
-            this.records.delete(r.id);
-            this.cancelled.delete(r.id);
+        const removed = prunableCommandIds(this.allRecords(), this.opts.maxHistory ?? 500, this.opts.idempotencyRetentionMs ?? 30 * 24 * 60 * 60 * 1_000, (this.opts.now ?? (() => new Date()))().getTime());
+        for (const store of commandStores(this.opts.commands)) {
+            store.prune(removed.filter((id) => store.get(id)));
         }
+        for (const id of removed)
+            this.cancelled.delete(id);
     }
-    /** Reload the registry on startup; a fresh process cannot resume in-memory runs. */
-    load() {
-        const path = this.opts.persistPath;
-        if (!path || !pathExists(path))
-            return;
-        const saved = readJsonSafe(path);
-        if (saved === null || !Array.isArray(saved)) {
-            // A corrupt registry must not be silently wiped: the run history includes
-            // the blocked needs-human inbox. Back the raw bytes up, start empty, and
-            // say so loudly (ThreadStore discipline).
-            this.backupCorruptRegistry(path, "registry file is not a JSON array");
-            return;
-        }
-        let dropped = 0;
-        for (const raw of saved) {
-            const rec = salvageJobRecord(raw);
-            if (!rec) {
-                dropped += 1;
-                continue;
-            }
-            // A fresh process cannot resume an in-memory RUN, so a `running` job becomes
-            // interrupted (honest). `blocked` is a TERMINAL outcome (NEEDS_HUMAN / web
-            // policy) the review queue must keep across restarts.
-            if (rec.state === "running") {
-                rec.state = "interrupted";
-                // Stamp the orphaned event log with a TERMINAL event: the
-                // canonical events.jsonl must agree with jobs.json, or SSE tailers and
-                // `follow` wait forever on a log that will never terminate.
-                if (rec.runDir && rec.runId) {
-                    try {
-                        appendRunEvent(join(rec.runDir, "events.jsonl"), rec.runId, rec.taskId ?? "", "run.failed", {
-                            status: "interrupted",
-                            error: "daemon restarted while the run was in flight",
-                        });
-                    }
-                    catch {
-                        /* best-effort: a missing/corrupt log must not block startup */
-                    }
-                }
-            }
-            this.records.set(rec.id, rec);
-            // A `queued` job never started; its params are persisted, so RE-ENQUEUE it
-            // on restart (drain() runs after start()) instead of silently dropping
-            // pending work to interrupted.
-            if (rec.state === "queued")
-                this.queue.push(rec.id);
-        }
-        if (dropped > 0) {
-            this.backupCorruptRegistry(path, `${dropped} unparseable job record(s) dropped`);
-        }
+    acceptCommand(params, idempotencyKey, clientId, idempotencyParams, operation) {
+        const store = commandStoreForRequest(this.opts.commands, params);
+        return store.accept({
+            id: newId("job"),
+            params,
+            idempotencyKey,
+            clientId,
+            idempotencyParams,
+            operation,
+        });
     }
-    /** Preserve the raw bytes of a damaged registry and report the loss loudly. */
-    backupCorruptRegistry(path, reason) {
-        try {
-            copyFileSync(path, `${path}.bak`);
-            console.error(`[claudexor] jobs store: ${reason}; original backed up to ${path}.bak`);
-        }
-        catch {
-            console.error(`[claudexor] jobs store: ${reason}; backup to ${path}.bak FAILED`);
-        }
+    allRecords() {
+        return commandStores(this.opts.commands).flatMap((store) => store.records());
+    }
+    getRecord(id) {
+        return commandStoreForId(this.opts.commands, id)?.get(id);
+    }
+    updateRecord(record, patch) {
+        const store = commandStoreForId(this.opts.commands, record.id);
+        if (!store)
+            throw new Error(`command authority lost job ${record.id}`);
+        return store.update(record.id, patch);
     }
     threadIdOf(rec) {
         const p = rec.params;
@@ -344,14 +332,16 @@ export class DaemonServer {
      * turn starts as soon as its previous one settles.
      */
     drain() {
+        if (this.stopping)
+            return;
         while (this.active < this.maxConcurrent && this.queue.length > 0) {
-            const busyThreads = new Set([...this.records.values()]
+            const busyThreads = new Set(this.allRecords()
                 .filter((r) => r.state === "running")
                 .map((r) => this.threadIdOf(r))
                 .filter((t) => !!t));
             let pickIdx = -1;
             for (let i = 0; i < this.queue.length; i++) {
-                const rec = this.records.get(this.queue[i]);
+                const rec = this.getRecord(this.queue[i]);
                 const tid = rec ? this.threadIdOf(rec) : undefined;
                 if (!rec || !tid || !busyThreads.has(tid)) {
                     pickIdx = i;
@@ -361,59 +351,75 @@ export class DaemonServer {
             if (pickIdx === -1)
                 break; // every queued job waits on a busy thread
             const id = this.queue.splice(pickIdx, 1)[0];
-            const rec = this.records.get(id);
+            const rec = this.getRecord(id);
             if (!rec)
                 continue;
             if (this.cancelled.has(id)) {
-                rec.state = "cancelled";
+                this.updateRecord(rec, { state: "cancelled", finishedAt: nowIso() });
                 continue;
             }
             this.active += 1;
-            void this.runJob(id, rec);
+            const task = this.runJob(id, rec);
+            this.activeTasks.add(task);
+            void task.then(() => this.activeTasks.delete(task), (error) => {
+                this.activeTasks.delete(task);
+                this.taskFailures.push(error);
+            });
         }
     }
     async runJob(id, rec) {
         const controller = new AbortController();
         this.controllers.set(id, controller);
-        rec.state = "running";
-        rec.startedAt = nowIso();
-        this.persist();
+        rec = this.updateRecord(rec, { state: "running", startedAt: nowIso() });
         try {
-            rec.result = await this.opts.runner(rec.params, {
+            const result = await this.opts.runner(rec.params, {
                 signal: controller.signal,
                 onRunStart: (info) => {
-                    rec.runId = info.runId;
-                    rec.taskId = info.taskId;
-                    rec.runDir = info.runDir;
-                    // Persist the pointer immediately so a mid-run crash still reloads with
-                    // runId/runDir to locate .claudexor/runs/<runId> (the recovery path).
-                    this.persist();
+                    rec = this.updateRecord(rec, info);
                 },
             });
-            rec.state = jobStateFromResult(rec.result, controller.signal.aborted);
-            // Only failure-shaped terminals carry an error string. no_op / ungated /
-            // review_not_run / blocked are HONEST terminals: fabricating an error here
-            // would make the control facade render a failure that never happened.
-            if (rec.state === "failed" || rec.state === "exhausted" || rec.state === "not_converged" || rec.state === "stuck_no_progress") {
-                rec.error = resultSummary(rec.result) ?? `run ended with status ${rec.state}`;
+            const state = jobStateFromResult(result, controller.signal.aborted);
+            if (state === "failed" ||
+                state === "cost_unverifiable" ||
+                state === "exhausted_overshoot" ||
+                state === "exhausted" ||
+                state === "not_converged" ||
+                state === "stuck_no_progress") {
+                rec = this.updateRecord(rec, {
+                    state,
+                    result,
+                    error: resultSummary(result) ?? `run ended with status ${state}`,
+                    finishedAt: nowIso(),
+                });
+            }
+            else {
+                rec = this.updateRecord(rec, { state, result, finishedAt: nowIso() });
             }
         }
         catch (err) {
-            rec.state = controller.signal.aborted ? "cancelled" : "failed";
-            rec.error = redactSecrets(err instanceof Error ? err.message : String(err));
-            // Preserve a typed throw's machine code (e.g. the trust gate) so
-            // consumers can key remedies on it instead of parsing the message.
-            const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
-            if (typeof code === "string" && code)
-                rec.errorCode = code;
+            const code = err && typeof err === "object" && "code" in err
+                ? err.code
+                : undefined;
+            const status = err && typeof err === "object" && "status" in err
+                ? err.status
+                : undefined;
+            const typedStatus = typeof status === "number" && Number.isInteger(status) && status >= 400 && status <= 599
+                ? status
+                : undefined;
+            rec = this.updateRecord(rec, {
+                state: controller.signal.aborted ? "cancelled" : "failed",
+                error: redactSecrets(err instanceof Error ? err.message : String(err)),
+                ...(typeof code === "string" && code ? { errorCode: code } : {}),
+                ...(typedStatus !== undefined ? { errorStatus: typedStatus } : {}),
+                finishedAt: nowIso(),
+            });
         }
         finally {
-            rec.finishedAt = nowIso();
             this.controllers.delete(id);
             this.active -= 1;
             if (rec.runId) {
                 try {
-                    this.opts.onRunTerminal?.(rec.runId);
+                    this.opts.onRunTerminal?.(rec.runId, this.threadIdOf(rec));
                 }
                 catch {
                     /* observer failure must not corrupt terminal bookkeeping */
@@ -434,8 +440,8 @@ export class DaemonServer {
                 }
             }
             this.pruneHistory();
-            this.persist();
-            this.drain();
+            if (!this.stopping)
+                this.drain();
         }
     }
 }
@@ -457,7 +463,9 @@ function jobStateFromResult(result, aborted) {
         case "cancelled":
             return "cancelled";
         case "exhausted":
-            return "exhausted";
+        case "exhausted_overshoot":
+        case "cost_unverifiable":
+            return status;
         case "not_converged":
             return "not_converged";
         case "stuck_no_progress":
@@ -478,7 +486,6 @@ function tokenMatches(candidate, expected) {
         return false;
     return timingSafeEqual(a, b);
 }
-/** True when something is actively accepting connections on the socket path. */
 /** Is a daemon already listening on this socket? Exported so the claudexord
  * entrypoint can refuse BEFORE running crash GC — a second daemon must never
  * reap the live daemon's children or sweep envelopes its jobs still own. */
@@ -513,21 +520,6 @@ function publicJobRecord(rec) {
         params: redactParams(rec.params),
     };
 }
-function persistedJobRecord(rec) {
-    return {
-        id: rec.id,
-        state: rec.state,
-        params: redactParams(rec.params),
-        error: rec.error ? redactSecrets(rec.error) : undefined,
-        errorCode: rec.errorCode,
-        createdAt: rec.createdAt,
-        runId: rec.runId,
-        taskId: rec.taskId,
-        runDir: rec.runDir,
-        startedAt: rec.startedAt,
-        finishedAt: rec.finishedAt,
-    };
-}
 function redactParams(value) {
     if (typeof value === "string")
         return redactSecrets(value);
@@ -537,7 +529,8 @@ function redactParams(value) {
         return value;
     const out = {};
     for (const [key, child] of Object.entries(value)) {
-        out[key] = key === "prompt" && typeof child === "string" ? redactSecrets(child) : redactParams(child);
+        out[key] =
+            key === "prompt" && typeof child === "string" ? redactSecrets(child) : redactParams(child);
     }
     return out;
 }