@cleocode/core 2026.3.76 → 2026.4.2

package/src/store/signaldock-sqlite.ts

@@ -13,11 +13,10 @@
  * @task T223
  */
 
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import type { DatabaseSync } from 'node:sqlite';
-import { fileURLToPath } from 'node:url';
 import { getCleoDirAbsolute } from '../paths.js';
 
 const _require = createRequire(import.meta.url);
@@ -39,45 +38,245 @@ export function getSignaldockDbPath(cwd?: string): string {
   return join(cleoDir, DB_FILENAME);
 }
 
+// ---------------------------------------------------------------------------
+// Embedded migration SQL — bundled so signaldock.db works in ANY project,
+// not just the monorepo where crates/signaldock-storage/ exists.
+// Source: crates/signaldock-storage/migrations/
+// ---------------------------------------------------------------------------
+
 /**
- * Resolve the path to the consolidated migration SQL.
- *
- * The migration lives in the signaldock-storage crate at:
- * crates/signaldock-storage/migrations/2026-03-28-000000_initial/up.sql
- *
- * We resolve it relative to the project root (monorepo layout).
+ * Ordered migration entries. Each has a name (for tracking) and SQL.
+ * Add new migrations to the END of this array.
  */
-function resolveMigrationSql(cwd?: string): string | null {
-  // Try monorepo layout first (development)
-  const projectRoot = cwd ?? process.cwd();
-  const monorepoPath = join(
-    projectRoot,
-    'crates',
-    'signaldock-storage',
-    'migrations',
-    '2026-03-28-000000_initial',
-    'up.sql',
-  );
-  if (existsSync(monorepoPath)) return monorepoPath;
-
-  // Try relative to this file (installed package)
-  const thisDir = dirname(fileURLToPath(import.meta.url));
-  const installedPath = join(
-    thisDir,
-    '..',
-    '..',
-    '..',
-    '..',
-    'crates',
-    'signaldock-storage',
-    'migrations',
-    '2026-03-28-000000_initial',
-    'up.sql',
-  );
-  if (existsSync(installedPath)) return installedPath;
-
-  return null;
-}
+const EMBEDDED_MIGRATIONS: Array<{ name: string; sql: string }> = [
+  {
+    name: '2026-03-28-000000_initial',
+    sql: `-- Consolidated initial migration for SignalDock storage (19 sqlx migrations merged).
+CREATE TABLE IF NOT EXISTS users (
+    id TEXT PRIMARY KEY, email TEXT NOT NULL UNIQUE, password_hash TEXT NOT NULL,
+    name TEXT, slug TEXT, default_agent_id TEXT, username TEXT, display_username TEXT,
+    email_verified INTEGER NOT NULL DEFAULT 0, image TEXT, role TEXT NOT NULL DEFAULT 'user',
+    banned INTEGER NOT NULL DEFAULT 0, ban_reason TEXT, ban_expires TEXT,
+    two_factor_enabled INTEGER NOT NULL DEFAULT 0, metadata TEXT,
+    created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_users_slug ON users(slug);
+
+CREATE TABLE IF NOT EXISTS organization (
+    id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, slug TEXT, logo TEXT, metadata TEXT,
+    owner_id TEXT, created_at INTEGER NOT NULL DEFAULT (strftime('%s','now')),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s','now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_organization_slug ON organization(slug);
+
+CREATE TABLE IF NOT EXISTS agents (
+    id TEXT PRIMARY KEY, agent_id TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
+    description TEXT, class TEXT NOT NULL DEFAULT 'custom',
+    privacy_tier TEXT NOT NULL DEFAULT 'public', owner_id TEXT REFERENCES users(id),
+    endpoint TEXT, webhook_secret TEXT, capabilities TEXT NOT NULL DEFAULT '[]',
+    skills TEXT NOT NULL DEFAULT '[]', avatar TEXT, messages_sent INTEGER NOT NULL DEFAULT 0,
+    messages_received INTEGER NOT NULL DEFAULT 0, conversation_count INTEGER NOT NULL DEFAULT 0,
+    friend_count INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL DEFAULT 'online',
+    last_seen INTEGER, payment_config TEXT, api_key_hash TEXT,
+    organization_id TEXT REFERENCES organization(id) ON DELETE SET NULL,
+    created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS agents_agent_id_idx ON agents(agent_id);
+CREATE INDEX IF NOT EXISTS agents_owner_idx ON agents(owner_id);
+CREATE INDEX IF NOT EXISTS agents_class_idx ON agents(class);
+CREATE INDEX IF NOT EXISTS agents_privacy_idx ON agents(privacy_tier);
+CREATE INDEX IF NOT EXISTS agents_org_idx ON agents(organization_id);
+
+CREATE TABLE IF NOT EXISTS conversations (
+    id TEXT PRIMARY KEY, participants TEXT NOT NULL,
+    visibility TEXT NOT NULL DEFAULT 'private', message_count INTEGER NOT NULL DEFAULT 0,
+    last_message_at INTEGER, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS messages (
+    id TEXT PRIMARY KEY, conversation_id TEXT NOT NULL REFERENCES conversations(id),
+    from_agent_id TEXT NOT NULL, to_agent_id TEXT NOT NULL, content TEXT NOT NULL,
+    content_type TEXT NOT NULL DEFAULT 'text', status TEXT NOT NULL DEFAULT 'pending',
+    attachments TEXT NOT NULL DEFAULT '[]', group_id TEXT, metadata TEXT DEFAULT '{}',
+    reply_to TEXT, created_at INTEGER NOT NULL, delivered_at INTEGER, read_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS messages_conversation_idx ON messages(conversation_id);
+CREATE INDEX IF NOT EXISTS messages_from_agent_idx ON messages(from_agent_id);
+CREATE INDEX IF NOT EXISTS messages_to_agent_idx ON messages(to_agent_id);
+CREATE INDEX IF NOT EXISTS messages_created_at_idx ON messages(created_at);
+CREATE INDEX IF NOT EXISTS idx_messages_group_id ON messages(group_id) WHERE group_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_messages_reply_to ON messages(reply_to) WHERE reply_to IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS claim_codes (
+    id TEXT PRIMARY KEY, agent_id TEXT NOT NULL REFERENCES agents(id),
+    code TEXT NOT NULL UNIQUE, expires_at INTEGER NOT NULL, used_at INTEGER,
+    used_by TEXT REFERENCES users(id), created_at INTEGER NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS claim_codes_code_idx ON claim_codes(code);
+CREATE INDEX IF NOT EXISTS claim_codes_agent_idx ON claim_codes(agent_id);
+
+CREATE TABLE IF NOT EXISTS connections (
+    id TEXT PRIMARY KEY, agent_a TEXT NOT NULL REFERENCES agents(id),
+    agent_b TEXT NOT NULL REFERENCES agents(id), status TEXT NOT NULL DEFAULT 'pending',
+    initiated_by TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS connections_agent_a_idx ON connections(agent_a);
+CREATE INDEX IF NOT EXISTS connections_agent_b_idx ON connections(agent_b);
+
+CREATE TABLE IF NOT EXISTS delivery_jobs (
+    id TEXT PRIMARY KEY, message_id TEXT NOT NULL, payload TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending', attempts INTEGER NOT NULL DEFAULT 0,
+    max_attempts INTEGER NOT NULL DEFAULT 6, next_attempt_at INTEGER NOT NULL,
+    last_error TEXT, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_delivery_jobs_status ON delivery_jobs(status, next_attempt_at);
+
+CREATE TABLE IF NOT EXISTS dead_letters (
+    id TEXT PRIMARY KEY, message_id TEXT NOT NULL, job_id TEXT NOT NULL,
+    reason TEXT NOT NULL, attempts INTEGER NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_dead_letters_message ON dead_letters(message_id);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(content, from_agent_id, content='messages', content_rowid='rowid');
+INSERT INTO messages_fts(messages_fts) VALUES('rebuild');
+CREATE TRIGGER IF NOT EXISTS messages_ai AFTER INSERT ON messages BEGIN
+    INSERT INTO messages_fts(rowid, content, from_agent_id) VALUES (new.rowid, new.content, new.from_agent_id);
+END;
+CREATE TRIGGER IF NOT EXISTS messages_ad AFTER DELETE ON messages BEGIN
+    INSERT INTO messages_fts(messages_fts, rowid, content, from_agent_id) VALUES('delete', old.rowid, old.content, old.from_agent_id);
+END;
+CREATE TRIGGER IF NOT EXISTS messages_au AFTER UPDATE ON messages BEGIN
+    INSERT INTO messages_fts(messages_fts, rowid, content, from_agent_id) VALUES('delete', old.rowid, old.content, old.from_agent_id);
+    INSERT INTO messages_fts(rowid, content, from_agent_id) VALUES (new.rowid, new.content, new.from_agent_id);
+END;
+
+CREATE TABLE IF NOT EXISTS message_pins (
+    id TEXT PRIMARY KEY, message_id TEXT NOT NULL, conversation_id TEXT NOT NULL,
+    pinned_by TEXT NOT NULL, note TEXT, created_at INTEGER NOT NULL, UNIQUE(message_id, pinned_by)
+);
+CREATE INDEX IF NOT EXISTS idx_pins_conversation ON message_pins(conversation_id);
+CREATE INDEX IF NOT EXISTS idx_pins_agent ON message_pins(pinned_by);
+
+CREATE TABLE IF NOT EXISTS attachments (
+    slug TEXT PRIMARY KEY, conversation_id TEXT NOT NULL, from_agent_id TEXT NOT NULL,
+    content BLOB NOT NULL, original_size INTEGER NOT NULL, compressed_size INTEGER NOT NULL,
+    content_hash TEXT NOT NULL, format TEXT NOT NULL DEFAULT 'text', title TEXT,
+    tokens INTEGER NOT NULL DEFAULT 0, expires_at INTEGER NOT NULL DEFAULT 0,
+    storage_key TEXT, mode TEXT NOT NULL DEFAULT 'draft',
+    version_count INTEGER NOT NULL DEFAULT 1, current_version INTEGER NOT NULL DEFAULT 1,
+    created_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS attachments_conversation_idx ON attachments(conversation_id);
+CREATE INDEX IF NOT EXISTS attachments_agent_idx ON attachments(from_agent_id);
+
+CREATE TABLE IF NOT EXISTS capabilities (
+    id TEXT PRIMARY KEY, slug TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
+    description TEXT NOT NULL, category TEXT NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS skills (
+    id TEXT PRIMARY KEY, slug TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
+    description TEXT NOT NULL, category TEXT NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS agent_capabilities (
+    agent_id TEXT NOT NULL REFERENCES agents(id), capability_id TEXT NOT NULL REFERENCES capabilities(id),
+    PRIMARY KEY (agent_id, capability_id)
+);
+CREATE TABLE IF NOT EXISTS agent_skills (
+    agent_id TEXT NOT NULL REFERENCES agents(id), skill_id TEXT NOT NULL REFERENCES skills(id),
+    PRIMARY KEY (agent_id, skill_id)
+);
+
+CREATE TABLE IF NOT EXISTS accounts (
+    id TEXT PRIMARY KEY NOT NULL, user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL, provider_id TEXT NOT NULL, access_token TEXT, refresh_token TEXT,
+    id_token TEXT, access_token_expires_at TEXT, refresh_token_expires_at TEXT, scope TEXT,
+    password TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_accounts_user_id ON accounts(user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_provider ON accounts(provider_id, account_id);
+
+CREATE TABLE IF NOT EXISTS sessions (
+    id TEXT PRIMARY KEY NOT NULL, user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    token TEXT NOT NULL UNIQUE, ip_address TEXT, user_agent TEXT, expires_at TEXT NOT NULL,
+    active_organization_id TEXT, impersonated_by TEXT, active INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_token ON sessions(token);
+CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
+
+CREATE TABLE IF NOT EXISTS verifications (
+    id TEXT PRIMARY KEY NOT NULL, identifier TEXT NOT NULL, value TEXT NOT NULL,
+    expires_at TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_verifications_identifier ON verifications(identifier);
+
+CREATE TABLE IF NOT EXISTS org_agent_keys (
+    id TEXT PRIMARY KEY NOT NULL, organization_id TEXT NOT NULL REFERENCES organization(id) ON DELETE CASCADE,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    created_by TEXT NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS org_agent_keys_org_idx ON org_agent_keys(organization_id);
+CREATE INDEX IF NOT EXISTS org_agent_keys_agent_idx ON org_agent_keys(agent_id);
+
+CREATE TABLE IF NOT EXISTS attachment_versions (
+    id TEXT PRIMARY KEY, slug TEXT NOT NULL REFERENCES attachments(slug) ON DELETE CASCADE,
+    version_number INTEGER NOT NULL, author_agent_id TEXT NOT NULL,
+    change_type TEXT NOT NULL DEFAULT 'patch', patch_text TEXT, storage_key TEXT NOT NULL,
+    content_hash TEXT NOT NULL, original_size INTEGER NOT NULL, compressed_size INTEGER NOT NULL,
+    tokens INTEGER NOT NULL, change_summary TEXT, sections_modified TEXT NOT NULL DEFAULT '[]',
+    tokens_added INTEGER NOT NULL DEFAULT 0, tokens_removed INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL, UNIQUE(slug, version_number)
+);
+CREATE INDEX IF NOT EXISTS idx_attachment_versions_slug ON attachment_versions(slug);
+CREATE INDEX IF NOT EXISTS idx_attachment_versions_author ON attachment_versions(author_agent_id);
+
+CREATE TABLE IF NOT EXISTS attachment_approvals (
+    id TEXT PRIMARY KEY, slug TEXT NOT NULL REFERENCES attachments(slug) ON DELETE CASCADE,
+    reviewer_agent_id TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'pending', comment TEXT,
+    version_reviewed INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL,
+    UNIQUE(slug, reviewer_agent_id)
+);
+CREATE INDEX IF NOT EXISTS idx_attachment_approvals_slug ON attachment_approvals(slug);
+
+CREATE TABLE IF NOT EXISTS attachment_contributors (
+    slug TEXT NOT NULL REFERENCES attachments(slug) ON DELETE CASCADE,
+    agent_id TEXT NOT NULL, version_count INTEGER NOT NULL DEFAULT 0,
+    total_tokens_added INTEGER NOT NULL DEFAULT 0, total_tokens_removed INTEGER NOT NULL DEFAULT 0,
+    first_contribution_at INTEGER NOT NULL, last_contribution_at INTEGER NOT NULL,
+    PRIMARY KEY (slug, agent_id)
+);`,
+  },
+  {
+    name: '2026-03-30-000001_agent_connections',
+    sql: `-- Add transport_type to agents table for connection mode classification.
+ALTER TABLE agents ADD COLUMN transport_type TEXT NOT NULL DEFAULT 'http';
+CREATE INDEX idx_agents_transport_type ON agents(transport_type);
+
+CREATE TABLE agent_connections (
+    id TEXT PRIMARY KEY NOT NULL, agent_id TEXT NOT NULL,
+    transport_type TEXT NOT NULL DEFAULT 'http', connection_id TEXT,
+    connected_at BIGINT NOT NULL, last_heartbeat BIGINT NOT NULL,
+    connection_metadata TEXT, created_at BIGINT NOT NULL,
+    FOREIGN KEY (agent_id) REFERENCES agents(agent_id) ON DELETE CASCADE,
+    UNIQUE(agent_id, connection_id)
+);
+CREATE INDEX idx_agent_connections_agent ON agent_connections(agent_id);
+CREATE INDEX idx_agent_connections_transport ON agent_connections(transport_type);
+CREATE INDEX idx_agent_connections_heartbeat ON agent_connections(last_heartbeat);`,
+  },
+  {
+    name: '2026-03-31-000001_agent_credentials',
+    sql: `-- Move agent credentials into signaldock.db agents table (T234 clean-cut).
+ALTER TABLE agents ADD COLUMN api_key_encrypted TEXT;
+ALTER TABLE agents ADD COLUMN api_base_url TEXT NOT NULL DEFAULT 'https://api.signaldock.io';
+ALTER TABLE agents ADD COLUMN classification TEXT;
+ALTER TABLE agents ADD COLUMN transport_config TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE agents ADD COLUMN is_active INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE agents ADD COLUMN last_used_at INTEGER;
+CREATE INDEX IF NOT EXISTS idx_agents_is_active ON agents(is_active);
+CREATE INDEX IF NOT EXISTS idx_agents_last_used ON agents(last_used_at);`,
+  },
+];
 
 /**
  * Ensure signaldock.db exists and has the full schema applied.
@@ -119,23 +318,33 @@ export async function ensureSignaldockDb(
       }
     })();
 
-    if (!hasSchema) {
-      // Run the consolidated migration
-      const migrationPath = resolveMigrationSql(cwd);
-      if (!migrationPath) {
-        throw new Error(
-          'signaldock-storage migration SQL not found. Ensure crates/signaldock-storage/ exists.',
-        );
-      }
+    // Ensure migration tracking tables exist
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS _signaldock_meta (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL,
+        updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+      )
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS _signaldock_migrations (
+        name TEXT PRIMARY KEY,
+        applied_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+      )
+    `);
 
-      const migrationSql = readFileSync(migrationPath, 'utf-8');
+    // Apply embedded migrations (works in ANY project, not just monorepo)
+    for (const migration of EMBEDDED_MIGRATIONS) {
+      // Skip already-applied migrations
+      const applied = db
+        .prepare('SELECT name FROM _signaldock_migrations WHERE name = ?')
+        .get(migration.name) as { name: string } | undefined;
+      if (applied) continue;
 
-      // Execute the full migration SQL in one shot.
-      // node:sqlite's exec() handles multiple statements natively.
-      // We wrap in a transaction for atomicity.
       db.exec('BEGIN TRANSACTION');
       try {
-        db.exec(migrationSql);
+        db.exec(migration.sql);
+        db.prepare('INSERT INTO _signaldock_migrations (name) VALUES (?)').run(migration.name);
         db.exec('COMMIT');
       } catch (err) {
         db.exec('ROLLBACK');
@@ -143,14 +352,7 @@ export async function ensureSignaldockDb(
       }
     }
 
-    // Record schema version in a metadata table
-    db.exec(`
-      CREATE TABLE IF NOT EXISTS _signaldock_meta (
-        key TEXT PRIMARY KEY,
-        value TEXT NOT NULL,
-        updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
-      )
-    `);
+    // Record schema version
     db.exec(`
       INSERT OR REPLACE INTO _signaldock_meta (key, value, updated_at)
       VALUES ('schema_version', '${SIGNALDOCK_SCHEMA_VERSION}', strftime('%s', 'now'))

package/src/store/sqlite-data-accessor.ts

@@ -14,6 +14,7 @@
 import type { Session, Task, TaskStatus } from '@cleocode/contracts';
 import { and, eq, inArray, isNull, like, ne, notInArray, or, sql } from 'drizzle-orm';
 import { archivedTaskToRow, rowToSession, rowToTask, taskToRow } from './converters.js';
+import { cleanupBrainRefsOnSessionDelete } from './cross-db-cleanup.js';
 import type {
   ArchiveFile,
   DataAccessor,
@@ -380,6 +381,8 @@ export async function createSqliteDataAccessor(cwd?: string): Promise<DataAccess
     async removeSingleSession(sessionId: string): Promise<void> {
       const db = await getDb(cwd);
       await db.delete(schema.sessions).where(eq(schema.sessions.id, sessionId)).run();
+      // Best-effort cross-db cleanup: nullify brain.db references to this session
+      void cleanupBrainRefsOnSessionDelete(sessionId, cwd);
     },
 
     // ---- Targeted query methods (Phase 2 modernization) ----

package/src/store/sqlite.ts

@@ -50,7 +50,7 @@ import * as schema from './tasks-schema.js';
  *
  * CRITICAL: WAL mode is verified, not just requested. If another process holds
  * an EXCLUSIVE lock in DELETE mode, PRAGMA journal_mode=WAL silently returns
- * 'delete'. This caused data loss (T5173) when concurrent MCP servers opened
+ * 'delete'. This caused data loss (T5173) when concurrent processes opened
  * the same database — writes were silently dropped under lock contention.
  */
 export function openNativeDatabase(
@@ -112,7 +112,7 @@ export function openNativeDatabase(
           `CRITICAL: Failed to set WAL journal mode after ${MAX_WAL_RETRIES} attempts. ` +
             `Database is in '${finalMode}' mode. Another process likely holds an EXCLUSIVE lock ` +
             `on ${path}. Refusing to open — concurrent writes in DELETE mode cause data loss. ` +
-            `Kill other cleo/MCP processes and retry. (T5173)`,
+            `Kill other cleo processes and retry. (T5173)`,
         );
       }
     }

package/src/store/task-store.ts

@@ -78,7 +78,14 @@ export async function updateTask(
 
   if (updates.title !== undefined) updateRow.title = updates.title;
   if (updates.description !== undefined) updateRow.description = updates.description;
-  if (updates.status !== undefined) updateRow.status = updates.status;
+  if (updates.status !== undefined) {
+    updateRow.status = updates.status;
+    // Clear stale timestamps when status resets to non-terminal state
+    if (updates.status === 'pending' || updates.status === 'active') {
+      if (updates.cancelledAt === undefined) updateRow.cancelledAt = null;
+      if (updates.completedAt === undefined) updateRow.completedAt = null;
+    }
+  }
   if (updates.priority !== undefined) updateRow.priority = updates.priority;
   if (updates.type !== undefined) updateRow.type = updates.type;
   if (updates.parentId !== undefined) updateRow.parentId = updates.parentId;

package/src/store/tasks-schema.ts

@@ -110,7 +110,7 @@ export const TOKEN_USAGE_METHODS = ['otel', 'provider_api', 'tokenizer', 'heuris
 export const TOKEN_USAGE_CONFIDENCE = ['real', 'high', 'estimated', 'coarse'] as const;
 
 /** Transport types for token telemetry. */
-export const TOKEN_USAGE_TRANSPORTS = ['cli', 'mcp', 'api', 'agent', 'unknown'] as const;
+export const TOKEN_USAGE_TRANSPORTS = ['cli', 'api', 'agent', 'unknown'] as const;
 
 /** Task relation types matching DB CHECK constraint on task_relations.relation_type. */
 export const TASK_RELATION_TYPES = [
@@ -608,7 +608,7 @@ export const auditLog = sqliteTable(
 // === TOKEN USAGE ===
 
 /**
- * Central provider-aware token telemetry for CLI, MCP, and external adapters.
+ * Central provider-aware token telemetry for CLI and external adapters.
  * Stores measured request/response token counts plus method/confidence metadata.
  */
 export const tokenUsage = sqliteTable(
@@ -854,41 +854,6 @@ export type NewReleaseManifestRow = typeof releaseManifests.$inferInsert;
 export type ExternalTaskLinkRow = typeof externalTaskLinks.$inferSelect;
 export type NewExternalTaskLinkRow = typeof externalTaskLinks.$inferInsert;
 
-// === AGENT CREDENTIALS (Unified Agent Registry — T170/T173) ===
-
-/**
- * Agent credentials for the unified agent registry.
- * Stores encrypted API keys and transport configuration for registered agents.
- * Replaces loose clawmsgr-*.json config files.
- *
- * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3.1
- */
-export const agentCredentials = sqliteTable(
-  'agent_credentials',
-  {
-    agentId: text('agent_id').primaryKey(),
-    displayName: text('display_name').notNull(),
-    /** API key encrypted at rest using AES-256-GCM with machine-bound key. */
-    apiKeyEncrypted: text('api_key_encrypted').notNull(),
-    apiBaseUrl: text('api_base_url').notNull().default('https://api.signaldock.io'),
-    classification: text('classification'),
-    privacyTier: text('privacy_tier').notNull().default('public'),
-    /** JSON array of capability slugs. */
-    capabilities: text('capabilities').notNull().default('[]'),
-    /** JSON array of skill slugs. */
-    skills: text('skills').notNull().default('[]'),
-    /** JSON object with transport-specific settings. */
-    transportConfig: text('transport_config').notNull().default('{}'),
-    isActive: integer('is_active', { mode: 'boolean' }).notNull().default(true),
-    lastUsedAt: integer('last_used_at'),
-    createdAt: integer('created_at').notNull(),
-    updatedAt: integer('updated_at').notNull(),
-  },
-  (table) => [
-    index('idx_agent_credentials_active').on(table.isActive),
-    index('idx_agent_credentials_last_used').on(table.lastUsedAt),
-  ],
-);
-
-export type AgentCredentialRow = typeof agentCredentials.$inferSelect;
-export type NewAgentCredentialRow = typeof agentCredentials.$inferInsert;
+// agent_credentials REMOVED from tasks.db — T234 clean-cut.
+// Agent data (identity, credentials, capabilities, skills) now lives
+// exclusively in signaldock.db. See AgentRegistryAccessor.

package/src/system/__tests__/health.test.js

@@ -21,7 +21,7 @@ describe('system health audit_log checks', () => {
         const { getDb, closeDb } = await import('../../store/sqlite.js');
         await getDb(projectRoot);
         closeDb();
-        const result = getSystemHealth(projectRoot);
+        const result = await getSystemHealth(projectRoot);
         const auditLog = result.checks.find((c) => c.name === 'audit_log');
         expect(auditLog).toBeDefined();
         expect(auditLog?.status).toBe('pass');
@@ -35,7 +35,7 @@ describe('system health audit_log checks', () => {
         db.exec('CREATE TABLE tasks(id TEXT PRIMARY KEY)');
         db.close();
         expect(existsSync(dbPath)).toBe(true);
-        const result = getSystemHealth(projectRoot);
+        const result = await getSystemHealth(projectRoot);
         const auditLog = result.checks.find((c) => c.name === 'audit_log');
         expect(auditLog).toBeDefined();
         expect(auditLog?.status).toBe('fail');

package/src/system/__tests__/health.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.test.js","sourceRoot":"","sources":["health.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAiC,CAAC;AAEjF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC;QAEV,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEzC,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACnD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QAEpE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"health.test.js","sourceRoot":"","sources":["health.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAiC,CAAC;AAEjF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEzC,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACnD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QAEpE,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/src/system/__tests__/health.test.ts

@@ -27,7 +27,7 @@ describe('system health audit_log checks', () => {
     await getDb(projectRoot);
     closeDb();
 
-    const result = getSystemHealth(projectRoot);
+    const result = await getSystemHealth(projectRoot);
     const auditLog = result.checks.find((c) => c.name === 'audit_log');
 
     expect(auditLog).toBeDefined();
@@ -45,7 +45,7 @@ describe('system health audit_log checks', () => {
     db.close();
     expect(existsSync(dbPath)).toBe(true);
 
-    const result = getSystemHealth(projectRoot);
+    const result = await getSystemHealth(projectRoot);
     const auditLog = result.checks.find((c) => c.name === 'audit_log');
 
     expect(auditLog).toBeDefined();

package/src/system/archive-analytics.ts

@@ -2,7 +2,7 @@
  * Archive analytics — rich reporting and insights from archived tasks.
  *
  * Moved from CLI archive-stats command to core for reuse across
- * MCP, CLI, and programmatic consumers.
+ * CLI and programmatic consumers.
  *
  * @task T4555
  * @epic T4545

package/src/system/health.ts

@@ -145,7 +145,10 @@ export interface DiagnosticsResult {
 }
 
 /** Run system health checks (SQLite-first per ADR-006). */
-export function getSystemHealth(projectRoot: string, opts?: { detailed?: boolean }): HealthResult {
+export async function getSystemHealth(
+  projectRoot: string,
+  opts?: { detailed?: boolean },
+): Promise<HealthResult> {
   const cleoDir = join(projectRoot, '.cleo');
   const checks: HealthCheck[] = [];
 
@@ -181,29 +184,50 @@ export function getSystemHealth(projectRoot: string, opts?: { detailed?: boolean
     checks.push(checkAuditLogAvailability(dbPath));
   }
 
-  // Check signaldock.db (local agent messaging per T225)
+  // Check signaldock.db with schema health (local agent messaging per T225)
   const sdDbPath = join(cleoDir, 'signaldock.db');
   if (existsSync(sdDbPath)) {
     try {
-      const sdSize = statSync(sdDbPath).size;
-      if (sdSize > 0) {
-        checks.push({
-          name: 'signaldock_db',
-          status: 'pass',
-          message: `signaldock.db: ${sdSize} bytes`,
-        });
-      } else {
+      const { DatabaseSync: SdDb } = _require('node:sqlite') as {
+        DatabaseSync: new (
+          path: string,
+        ) => {
+          prepare(sql: string): { get(...args: unknown[]): unknown };
+          close(): void;
+        };
+      };
+      const sdDb = new SdDb(sdDbPath);
+      try {
+        const tables = sdDb
+          .prepare(
+            "SELECT COUNT(*) as count FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_signaldock%'",
+          )
+          .get() as { count: number };
+        const journalMode = sdDb.prepare('PRAGMA journal_mode').get() as {
+          journal_mode: string;
+        };
+        let schemaVersion = 'unknown';
+        try {
+          const meta = sdDb
+            .prepare("SELECT value FROM _signaldock_meta WHERE key = 'schema_version'")
+            .get() as { value: string } | undefined;
+          schemaVersion = meta?.value ?? 'unknown';
+        } catch {
+          /* meta table may not exist */
+        }
         checks.push({
           name: 'signaldock_db',
-          status: 'warn',
-          message: 'signaldock.db exists but is empty',
+          status: tables.count >= 20 ? 'pass' : 'warn',
+          message: `signaldock.db: ${tables.count} tables, ${journalMode.journal_mode}, v${schemaVersion}`,
         });
+      } finally {
+        sdDb.close();
       }
     } catch {
       checks.push({
         name: 'signaldock_db',
-        status: 'fail',
-        message: 'signaldock.db exists but is not readable',
+        status: 'pass',
+        message: `signaldock.db: ${statSync(sdDbPath).size} bytes`,
       });
     }
   } else {
@@ -297,7 +321,7 @@ export async function getSystemDiagnostics(
   projectRoot: string,
   opts?: { checks?: string[] },
 ): Promise<DiagnosticsResult> {
-  const healthResult = getSystemHealth(projectRoot, { detailed: true });
+  const healthResult = await getSystemHealth(projectRoot, { detailed: true });
 
   const diagChecks: DiagnosticsCheck[] = healthResult.checks.map((c) => ({
     name: c.name,
@@ -901,8 +925,8 @@ export async function runDoctorFixes(projectRoot: string): Promise<FixResult[]>
       };
     },
     contributor_channel: async () => {
-      const { ensureContributorMcp } = await import('../scaffold.js');
-      const r = await ensureContributorMcp(projectRoot);
+      const { ensureContributorMcp: ensureContributorDev } = await import('../scaffold.js');
+      const r = await ensureContributorDev(projectRoot);
       return {
         check: 'contributor_channel',
         action: r.action === 'skipped' ? 'skipped' : 'fixed',
@@ -989,7 +1013,7 @@ export async function runDoctorFixes(projectRoot: string): Promise<FixResult[]>
 }
 
 // ============================================================================
-// Startup Health Check (MCP + CLI unified entry point)
+// Startup Health Check (CLI unified entry point)
 // ============================================================================
 
 /**
@@ -1021,7 +1045,7 @@ export interface StartupHealthResult {
 }
 
 /**
- * Unified startup health check for MCP server and CLI entry points.
+ * Unified startup health check for CLI entry points.
  *
  * This is the single entry point for startup diagnostics. It follows a
  * three-phase approach: