@co0ontty/wand 4.102.0 → 4.103.0

package/dist/storage/dingtalk-repository.js

@@ -0,0 +1,75 @@
+/** Additive domain records. Secrets belong to the existing encrypted connector vault, never this table. */
+export const DINGTALK_SCHEMA = `CREATE TABLE IF NOT EXISTS dingtalk_records (
+  kind TEXT NOT NULL, id TEXT NOT NULL, data TEXT NOT NULL, updated_at TEXT NOT NULL,
+  PRIMARY KEY(kind, id)
+); CREATE INDEX IF NOT EXISTS dingtalk_records_kind_updated ON dingtalk_records(kind, updated_at);
+CREATE INDEX IF NOT EXISTS dingtalk_records_state ON dingtalk_records(kind, json_extract(data, '$.state'), id);
+CREATE INDEX IF NOT EXISTS dingtalk_records_delivery ON dingtalk_records(kind, json_extract(data, '$.delivery'), updated_at, id);
+CREATE INDEX IF NOT EXISTS dingtalk_records_binding_delivery ON dingtalk_records(kind, json_extract(data, '$.bindingId'), json_extract(data, '$.delivery'));`;
+export class DingTalkRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    getDingTalkRecord(kind, id) {
+        const row = this.db.prepare("SELECT data FROM dingtalk_records WHERE kind = ? AND id = ?").get(kind, id);
+        return row ? JSON.parse(row.data) : null;
+    }
+    listDingTalkRecords(kind) {
+        return this.db.prepare("SELECT data FROM dingtalk_records WHERE kind = ? ORDER BY updated_at, id LIMIT 10000").all(kind).map(row => JSON.parse(row.data));
+    }
+    saveDingTalkRecord(kind, id, value) {
+        const data = JSON.stringify(value);
+        if (Buffer.byteLength(data) > 512 * 1024)
+            throw new Error("钉钉记录过大。");
+        this.db.prepare(`INSERT INTO dingtalk_records(kind,id,data,updated_at) VALUES(?,?,?,?)
+      ON CONFLICT(kind,id) DO UPDATE SET data=excluded.data,updated_at=excluded.updated_at`).run(kind, id, data, new Date().toISOString());
+    }
+    /** Explicit mirror deletion removes body copies but retains content-free admission tombstones. */
+    clearDingTalkGroupHistory(groupId) {
+        this.db.prepare(`UPDATE dingtalk_records SET data = json_remove(json_set(data, '$.state', 'unknown', '$.delivery', 'none'), '$.text', '$.error'), updated_at = ?
+      WHERE kind = 'run' AND json_extract(data, '$.groupId') = ?`).run(new Date().toISOString(), groupId);
+    }
+    countDingTalkRecords(kind) {
+        return this.db.prepare("SELECT COUNT(*) AS n FROM dingtalk_records WHERE kind = ?").get(kind).n;
+    }
+    pendingDingTalkDeliveries() {
+        return this.db.prepare(`SELECT data FROM dingtalk_records WHERE kind = 'run'
+      AND json_extract(data, '$.delivery') = 'pending' ORDER BY updated_at, id LIMIT 4`).all()
+            .map(row => JSON.parse(row.data));
+    }
+    runningDingTalkPage(after) {
+        return this.db.prepare(`SELECT data FROM dingtalk_records WHERE kind = 'run'
+      AND json_extract(data, '$.state') = 'running' AND id > ? ORDER BY id LIMIT 100`).all(after)
+            .map(row => JSON.parse(row.data));
+    }
+    /** Recovery never replays a model or a resource write. A request claim is the boundary before sending. */
+    recoverDingTalkIntents() {
+        this.db.exec(`UPDATE dingtalk_records SET data = json_set(data, '$.state', 'unknown')
+      WHERE kind = 'job' AND json_extract(data, '$.state') = 'running';
+      UPDATE dingtalk_records SET data = json_set(data, '$.state', 'unknown', '$.error', '服务重启，原接入步骤待核实；请继续原任务，不会重复创建资源。')
+      WHERE kind = 'binding' AND json_extract(data, '$.state') IN ('creating', 'configuring', 'joining');
+      UPDATE dingtalk_records SET data = json_set(data, '$.state', 'unknown', '$.error', '服务重启前已接受，请核对原执行，不会重复执行。')
+      WHERE kind = 'run' AND json_extract(data, '$.state') = 'accepted';
+      UPDATE dingtalk_records AS r SET data = json_set(data,
+        '$.delivery', CASE
+          WHEN EXISTS(SELECT 1 FROM dingtalk_records q WHERE q.kind = 'request' AND q.id = 'final:' || r.id AND json_extract(q.data, '$.state') = 'sent') THEN 'sent'
+          WHEN EXISTS(SELECT 1 FROM dingtalk_records q WHERE q.kind = 'request' AND q.id = 'final:' || r.id) THEN 'unknown'
+          ELSE 'pending' END,
+        '$.state', CASE
+          WHEN EXISTS(SELECT 1 FROM dingtalk_records q WHERE q.kind = 'request' AND q.id = 'final:' || r.id AND json_extract(q.data, '$.state') = 'sent') THEN CASE WHEN json_extract(r.data, '$.state') = 'failed' THEN 'failed' ELSE 'delivered' END
+          WHEN EXISTS(SELECT 1 FROM dingtalk_records q WHERE q.kind = 'request' AND q.id = 'final:' || r.id) THEN 'unknown'
+          ELSE CASE WHEN json_extract(r.data, '$.state') = 'failed' THEN 'failed' ELSE 'completed' END END)
+      WHERE kind = 'run' AND json_extract(data, '$.delivery') = 'sending';
+      UPDATE dingtalk_records AS b SET data = json_set(data, '$.state', 'unknown', '$.error', '此前回复送达未确认，请核实原群消息后恢复，不会重放旧任务。')
+      WHERE kind = 'binding' AND json_extract(data, '$.state') != 'paused' AND json_extract(data, '$.removedAt') IS NULL
+        AND EXISTS(SELECT 1 FROM dingtalk_records r WHERE r.kind = 'run' AND json_extract(r.data, '$.bindingId') = b.id
+          AND json_extract(r.data, '$.delivery') = 'unknown'
+          AND coalesce(json_extract(r.data, '$.bindingGeneration'), 'legacy') = coalesce(json_extract(b.data, '$.generation'), 'legacy'));`);
+    }
+    /** Claim before any I/O. An unknown outcome is retained across restarts, never automatically replayed. */
+    claimDingTalkRecord(kind, id, value) {
+        return this.db.prepare("INSERT OR IGNORE INTO dingtalk_records(kind,id,data,updated_at) VALUES(?,?,?,?)")
+            .run(kind, id, JSON.stringify(value), new Date().toISOString()).changes > 0;
+    }
+}

package/dist/storage/live-activity-repository.d.ts

@@ -0,0 +1,68 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { WandStorage } from "../storage.js";
+import type { ApnsEnvironment } from "../apns-client.js";
+import type { LiveActivityCachedEntry } from "../live-activity-state.js";
+export declare const LIVE_ACTIVITY_SCHEMA = "\n  CREATE TABLE IF NOT EXISTS apns_live_activities (\n    id TEXT PRIMARY KEY, activity_id TEXT NOT NULL, token TEXT NOT NULL,\n    server_id TEXT NOT NULL, credential_digest TEXT NOT NULL, topic TEXT NOT NULL, environment TEXT NOT NULL,\n    generation INTEGER NOT NULL DEFAULT 1, enabled INTEGER NOT NULL DEFAULT 1, blocked INTEGER NOT NULL DEFAULT 0,\n    fact_revision INTEGER NOT NULL DEFAULT 0, prepared_revision INTEGER NOT NULL DEFAULT 0,\n    created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,\n    content_json TEXT NOT NULL DEFAULT '[]', signature TEXT NOT NULL DEFAULT '', last_timestamp INTEGER NOT NULL DEFAULT 0,\n    last_sent_at INTEGER NOT NULL DEFAULT 0, next_at INTEGER NOT NULL,\n    pending_id TEXT, pending_payload TEXT, pending_signature TEXT, pending_event TEXT, pending_priority INTEGER,\n    pending_next_at INTEGER, attempts INTEGER NOT NULL DEFAULT 0, outcome TEXT, reason TEXT\n  );\n  CREATE INDEX IF NOT EXISTS apns_live_due ON apns_live_activities(enabled, blocked, next_at);\n";
+export interface LiveActivityRecord {
+    id: string;
+    activity_id: string;
+    token: string;
+    server_id: string;
+    credential_digest: string;
+    topic: string;
+    environment: ApnsEnvironment;
+    generation: number;
+    enabled: number;
+    blocked: number;
+    fact_revision: number;
+    prepared_revision: number;
+    created_at: number;
+    expires_at: number;
+    content_json: string;
+    signature: string;
+    last_timestamp: number;
+    last_sent_at: number;
+    next_at: number;
+    pending_id: string | null;
+    pending_payload: string | null;
+    pending_signature: string | null;
+    pending_event: "update" | "end" | null;
+    pending_priority: 5 | 10 | null;
+    pending_next_at: number | null;
+    attempts: number;
+    outcome: string | null;
+    reason: string | null;
+}
+export declare class LiveActivityRepository {
+    private readonly db;
+    private readonly storage;
+    constructor(db: DatabaseSync, storage: WandStorage);
+    register(input: {
+        secret: string;
+        activityId: string;
+        token: string;
+        serverId: string;
+        credentialDigest: string;
+        topic: string;
+        environment: ApnsEnvironment;
+    }, now: number): void;
+    get(id: string): LiveActivityRecord | null;
+    revoke(secret: string): void;
+    disable(id: string, reason: string, generation?: number): void;
+    wake(now: number): void;
+    dirty(now: number): void;
+    due(now: number): LiveActivityRecord | null;
+    defer(id: string, generation: number, next: number): void;
+    prepare(record: LiveActivityRecord, update: {
+        payload: string;
+        signature: string;
+        entries: LiveActivityCachedEntry[];
+        event: "update" | "end";
+        priority: 5 | 10;
+        timestamp: number;
+        nextAt: number;
+    }, now: number): LiveActivityRecord | null;
+    finish(record: LiveActivityRecord, outcome: "accepted" | "failed" | "rejected", reason: string, now: number): void;
+    retry(record: LiveActivityRecord, reason: string, now: number): void;
+    sweep(now: number): void;
+}

package/dist/storage/live-activity-repository.js

@@ -0,0 +1,117 @@
+import { randomUUID } from "node:crypto";
+import { apnsDigest } from "./apns-repository.js";
+export const LIVE_ACTIVITY_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS apns_live_activities (
+    id TEXT PRIMARY KEY, activity_id TEXT NOT NULL, token TEXT NOT NULL,
+    server_id TEXT NOT NULL, credential_digest TEXT NOT NULL, topic TEXT NOT NULL, environment TEXT NOT NULL,
+    generation INTEGER NOT NULL DEFAULT 1, enabled INTEGER NOT NULL DEFAULT 1, blocked INTEGER NOT NULL DEFAULT 0,
+    fact_revision INTEGER NOT NULL DEFAULT 0, prepared_revision INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+    content_json TEXT NOT NULL DEFAULT '[]', signature TEXT NOT NULL DEFAULT '', last_timestamp INTEGER NOT NULL DEFAULT 0,
+    last_sent_at INTEGER NOT NULL DEFAULT 0, next_at INTEGER NOT NULL,
+    pending_id TEXT, pending_payload TEXT, pending_signature TEXT, pending_event TEXT, pending_priority INTEGER,
+    pending_next_at INTEGER, attempts INTEGER NOT NULL DEFAULT 0, outcome TEXT, reason TEXT
+  );
+  CREATE INDEX IF NOT EXISTS apns_live_due ON apns_live_activities(enabled, blocked, next_at);
+`;
+export class LiveActivityRepository {
+    db;
+    storage;
+    constructor(db, storage) {
+        this.db = db;
+        this.storage = storage;
+    }
+    register(input, now) {
+        this.storage.transaction(() => {
+            const id = apnsDigest(input.secret);
+            const previous = this.get(id);
+            const aliases = this.db.prepare("SELECT id FROM apns_live_activities WHERE id != ? AND enabled = 1 AND (activity_id = ? OR (token = ? AND topic = ? AND environment = ?))")
+                .all(id, input.activityId, input.token, input.topic, input.environment);
+            for (const alias of aliases)
+                this.disable(alias.id, "Superseded");
+            const count = this.db.prepare("SELECT COUNT(*) AS n FROM apns_live_activities WHERE enabled = 1 AND expires_at > ? AND id != ?").get(now, id);
+            if (count.n >= 64)
+                throw new Error("Live Activity registration limit reached");
+            const changed = !previous || !previous.enabled || previous.activity_id !== input.activityId || previous.token !== input.token
+                || previous.server_id !== input.serverId || previous.credential_digest !== input.credentialDigest
+                || previous.topic !== input.topic || previous.environment !== input.environment;
+            const created = previous?.activity_id === input.activityId ? previous.created_at : now;
+            this.db.prepare(`INSERT INTO apns_live_activities
+        (id, activity_id, token, server_id, credential_digest, topic, environment, created_at, expires_at, next_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET activity_id = excluded.activity_id, token = excluded.token,
+        server_id = excluded.server_id, credential_digest = excluded.credential_digest,
+        topic = excluded.topic, environment = excluded.environment, enabled = 1, blocked = 0,
+        created_at = excluded.created_at, expires_at = excluded.expires_at, next_at = MIN(apns_live_activities.next_at, excluded.next_at),
+        generation = apns_live_activities.generation + ?`)
+                .run(id, input.activityId, input.token, input.serverId, input.credentialDigest, input.topic, input.environment, created, created + 8 * 3_600_000, now, changed ? 1 : 0);
+            if (changed) {
+                this.db.prepare("UPDATE apns_live_activities SET pending_id = NULL, pending_payload = NULL, attempts = 0 WHERE id = ?").run(id);
+                if (previous && (previous.activity_id !== input.activityId || previous.server_id !== input.serverId || previous.credential_digest !== input.credentialDigest)) {
+                    this.db.prepare("UPDATE apns_live_activities SET content_json = '[]', signature = '', last_timestamp = 0, last_sent_at = 0 WHERE id = ?").run(id);
+                }
+            }
+        });
+    }
+    get(id) {
+        return this.db.prepare("SELECT * FROM apns_live_activities WHERE id = ?").get(id) ?? null;
+    }
+    revoke(secret) { this.disable(apnsDigest(secret), "ClientRevoked"); }
+    disable(id, reason, generation) {
+        this.db.prepare(`UPDATE apns_live_activities SET enabled = 0, token = '', pending_id = NULL, pending_payload = NULL,
+      outcome = 'closed', reason = ? WHERE id = ? ${generation === undefined ? "" : "AND generation = ?"}`)
+            .run(reason, id, ...(generation === undefined ? [] : [generation]));
+    }
+    wake(now) {
+        this.db.prepare("UPDATE apns_live_activities SET blocked = 0, next_at = MIN(next_at, ?) WHERE enabled = 1").run(now);
+    }
+    dirty(now) {
+        // Coalesce facts, not deliveries. A redundant status heartbeat must not reset a transport retry budget.
+        this.db.prepare(`UPDATE apns_live_activities SET next_at = CASE WHEN pending_id IS NULL THEN MIN(next_at, ?) ELSE next_at END, fact_revision = fact_revision + 1
+      WHERE enabled = 1 AND blocked = 0`).run(now + 2000);
+    }
+    due(now) {
+        return this.db.prepare("SELECT * FROM apns_live_activities WHERE enabled = 1 AND blocked = 0 AND next_at <= ? ORDER BY next_at, rowid LIMIT 1")
+            .get(now) ?? null;
+    }
+    defer(id, generation, next) {
+        this.db.prepare("UPDATE apns_live_activities SET next_at = ? WHERE id = ? AND generation = ? AND enabled = 1").run(next, id, generation);
+    }
+    prepare(record, update, now) {
+        const id = randomUUID();
+        const result = this.db.prepare(`UPDATE apns_live_activities SET content_json = ?, last_timestamp = ?,
+      pending_id = ?, pending_payload = ?, pending_signature = ?, pending_event = ?, pending_priority = ?, pending_next_at = ?,
+      attempts = 0, prepared_revision = fact_revision, next_at = ? WHERE id = ? AND generation = ? AND enabled = 1`)
+            .run(JSON.stringify(update.entries), update.timestamp, id, update.payload, update.signature, update.event, update.priority, update.nextAt, now, record.id, record.generation);
+        return result.changes ? this.get(record.id) : null;
+    }
+    finish(record, outcome, reason, now) {
+        this.storage.transaction(() => {
+            // A route revoke/token rotation/new state may have superseded this HTTP/2 request while it was in flight.
+            const current = this.get(record.id);
+            if (!current?.enabled || current.generation !== record.generation || current.pending_id !== record.pending_id)
+                return;
+            if (outcome === "accepted" && record.pending_event === "end") {
+                this.db.prepare("UPDATE apns_live_activities SET enabled = 0, token = '', pending_id = NULL, pending_payload = NULL, outcome = 'accepted', reason = 'EndedByAPNs' WHERE id = ?").run(record.id);
+                return;
+            }
+            const next = outcome === "accepted" ? record.pending_next_at ?? now + 60_000 : now + 60_000;
+            const nextWithFacts = current.fact_revision > record.prepared_revision ? Math.min(next, now + 2000) : next;
+            this.db.prepare(`UPDATE apns_live_activities SET signature = ?, last_sent_at = ?,
+        next_at = ?, pending_id = NULL, pending_payload = NULL, outcome = ?, reason = ?, blocked = ?
+        WHERE id = ? AND generation = ? AND pending_id = ?`)
+                .run(record.pending_signature ?? "", now, nextWithFacts, outcome, reason, outcome === "rejected" ? 1 : 0, record.id, record.generation, record.pending_id);
+        });
+    }
+    retry(record, reason, now) {
+        this.db.prepare(`UPDATE apns_live_activities SET attempts = attempts + 1, next_at = ?, outcome = 'retry', reason = ?
+      WHERE id = ? AND generation = ? AND enabled = 1 AND pending_id = ?`)
+            .run(now + Math.min(60_000, 2000 * 2 ** record.attempts), reason, record.id, record.generation, record.pending_id);
+    }
+    sweep(now) {
+        this.storage.transaction(() => {
+            this.db.prepare("UPDATE apns_live_activities SET enabled = 0, token = '', pending_payload = NULL, pending_id = NULL, reason = 'Expired' WHERE expires_at <= ?").run(now);
+            this.db.prepare("DELETE FROM apns_live_activities WHERE expires_at < ?").run(now - 7 * 86_400_000);
+        });
+    }
+}

package/dist/storage/migrations.js

@@ -1,4 +1,6 @@
 import crypto from "node:crypto";
+import { APNS_SCHEMA } from "./apns-repository.js";
+import { LIVE_ACTIVITY_SCHEMA } from "./live-activity-repository.js";
 import { mkdirSync } from "node:fs";
 import path from "node:path";
 import { isUnnamedWorkspaceTaskName } from "../wand-task-sync.js";
@@ -330,4 +332,24 @@ export const STORAGE_MIGRATIONS = [
     { version: 17, name: "employee-task-concurrency-default", up: db => {
             db.exec("UPDATE silicon_employees SET max_concurrent_tasks = 2 WHERE max_concurrent_tasks IS NULL");
         } },
+    { version: 18, name: "pi-cli-parsed-checkpoints", up: db => db.exec(`
+    CREATE TABLE IF NOT EXISTS pi_cli_checkpoints (
+      session_id TEXT PRIMARY KEY,
+      checkpoint TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      FOREIGN KEY(session_id) REFERENCES command_sessions(id) ON DELETE CASCADE
+    )
+  `) },
+    { version: 19, name: "dingtalk-group-mirrors", up: db => db.exec(`
+    CREATE TABLE IF NOT EXISTS dingtalk_records (
+      kind TEXT NOT NULL, id TEXT NOT NULL, data TEXT NOT NULL, updated_at TEXT NOT NULL,
+      PRIMARY KEY(kind, id)
+    );
+    CREATE INDEX IF NOT EXISTS dingtalk_records_kind_updated ON dingtalk_records(kind, updated_at);
+    CREATE INDEX IF NOT EXISTS dingtalk_records_state ON dingtalk_records(kind, json_extract(data, '$.state'), id);
+    CREATE INDEX IF NOT EXISTS dingtalk_records_delivery ON dingtalk_records(kind, json_extract(data, '$.delivery'), updated_at, id);
+    CREATE INDEX IF NOT EXISTS dingtalk_records_binding_delivery ON dingtalk_records(kind, json_extract(data, '$.bindingId'), json_extract(data, '$.delivery'));
+  `) },
+    { version: 20, name: "apns-device-subscriptions-and-outbox", up: db => db.exec(APNS_SCHEMA) },
+    { version: 21, name: "apns-live-activity-updates", up: db => db.exec(LIVE_ACTIVITY_SCHEMA) },
 ];

package/dist/storage/sessions-repository.d.ts

@@ -2,6 +2,7 @@ import { DatabaseSync } from "node:sqlite";
 import { ConversationTurn, SessionSnapshot, StructuredSessionState } from "../types.js";
 import { SessionRow } from "./mappers.js";
 import type { WandStorage } from "../storage.js";
+import { type PiCliCheckpoint } from "../pi-cli-checkpoint.js";
 /** Session storage: one domain of the WandStorage facade. Shares the connection and the facade's transaction. */
 export declare class SessionRepository {
     private readonly db;
@@ -56,5 +57,9 @@ export declare class SessionRepository {
     mapSessionRow(row: SessionRow): SessionSnapshot;
     /** Metadata-only indexed scan. Running or ambiguous records never count toward the history cap. */
     excessSystemAiSessionIds(employeeId: string, keep: number): string[];
+    /** Cursor and parsed state are a single atomic value. A crash can only leave
+     * an older complete checkpoint, never a newer cursor with missing content. */
+    savePiCliCheckpoint(sessionId: string, checkpoint: PiCliCheckpoint): boolean;
+    getPiCliCheckpoint(sessionId: string): PiCliCheckpoint | null;
     deleteSession(id: string): void;
 }

package/dist/storage/sessions-repository.js

@@ -3,6 +3,7 @@ import { sessionRuntimeMetadataValues } from "./mappers.js";
 import { nowIso } from "../password-manager.js";
 import { sessionSelectFields, sessionPersistFields, sessionPersistAssignments, sessionRuntimeMetadataAssignments, mapSessionCore, sessionRowQuery } from "./mappers.js";
 import { SYSTEM_AI_AUXILIARY_PURPOSES, SYSTEM_AI_CALL_PREFIX } from "../system-ai-call.js";
+import { validPiCliCheckpoint } from "../pi-cli-checkpoint.js";
 const AUXILIARY_HISTORY_PATTERNS = SYSTEM_AI_AUXILIARY_PURPOSES.map(purpose => `${SYSTEM_AI_CALL_PREFIX}${purpose}:?*`);
 /** Session storage: one domain of the WandStorage facade. Shares the connection and the facade's transaction. */
 export class SessionRepository {
@@ -229,7 +230,48 @@ export class SessionRepository {
       ORDER BY started_at DESC, rowid DESC LIMIT -1 OFFSET ?`).all(...AUXILIARY_HISTORY_PATTERNS, employeeId, keep);
         return rows.map(row => row.id);
     }
+    /** Cursor and parsed state are a single atomic value. A crash can only leave
+     * an older complete checkpoint, never a newer cursor with missing content. */
+    savePiCliCheckpoint(sessionId, checkpoint) {
+        if (!validPiCliCheckpoint(checkpoint))
+            return false;
+        const json = JSON.stringify(checkpoint);
+        // Optional acceleration only: an unusually large turn safely replays from
+        // its original journal rather than doubling that payload in SQLite.
+        if (Buffer.byteLength(json) > 16 * 1024 * 1024)
+            return false;
+        return this.db.prepare(`INSERT INTO pi_cli_checkpoints (session_id, checkpoint, updated_at)
+      SELECT id, ?, ? FROM command_sessions WHERE id = ? AND provider = 'pi'
+        AND json_extract(structured_state, '$.activeRequestId') = ?
+        AND json_extract(structured_state, '$.inFlight') = 1
+      ON CONFLICT(session_id) DO UPDATE SET checkpoint = excluded.checkpoint, updated_at = excluded.updated_at
+      WHERE NOT json_valid(pi_cli_checkpoints.checkpoint)
+        OR CASE WHEN json_valid(pi_cli_checkpoints.checkpoint) THEN
+          json_extract(pi_cli_checkpoints.checkpoint, '$.incarnationId') != json_extract(excluded.checkpoint, '$.incarnationId')
+          OR json_extract(pi_cli_checkpoints.checkpoint, '$.offset') <= json_extract(excluded.checkpoint, '$.offset')
+        ELSE 1 END`)
+            .run(json, nowIso(), sessionId, checkpoint.requestId).changes > 0;
+    }
+    getPiCliCheckpoint(sessionId) {
+        const row = this.db.prepare(`SELECT p.checkpoint, json_extract(s.structured_state, '$.activeRequestId') AS requestId
+      FROM pi_cli_checkpoints p JOIN command_sessions s ON s.id = p.session_id
+      WHERE p.session_id = ? AND s.provider = 'pi'
+        AND json_extract(s.structured_state, '$.inFlight') = 1`)
+            .get(sessionId);
+        if (!row)
+            return null;
+        try {
+            const value = JSON.parse(row.checkpoint);
+            return validPiCliCheckpoint(value) && value.requestId === row.requestId ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
     deleteSession(id) {
-        this.db.prepare("DELETE FROM command_sessions WHERE id = ?").run(id);
+        this.s.transaction(() => {
+            this.db.prepare("DELETE FROM pi_cli_checkpoints WHERE session_id = ?").run(id);
+            this.db.prepare("DELETE FROM command_sessions WHERE id = ?").run(id);
+        });
     }
 }

package/dist/storage-schema.js

@@ -5,8 +5,10 @@ import { DatabaseSync } from "node:sqlite";
 import { STORAGE_MIGRATIONS } from "./storage/migrations.js";
 import { pruneMigrationBackups } from "./migration-backup-retention.js";
 import { SCHEDULED_CLAIM_DATE_SQL } from "./storage-schedules.js";
+import { DINGTALK_SCHEMA } from "./storage/dingtalk-repository.js";
 /** Additive schema only. Domain migrations and transactions remain owned by WandStorage. */
 const INIT_SQL = `
+  ${DINGTALK_SCHEMA}
   CREATE TABLE IF NOT EXISTS auth_sessions (
     token TEXT PRIMARY KEY,
     expires_at INTEGER NOT NULL,

package/dist/storage.d.ts

@@ -3,6 +3,9 @@ import type { ConnectorMeta } from "./storage/mappers.js";
 import { parseWandTaskAgent } from "./storage/mappers.js";
 export * from "./storage/internal.js";
 import { ConversationRepository } from "./storage/conversations-repository.js";
+import { DingTalkRepository } from "./storage/dingtalk-repository.js";
+import { ApnsRepository } from "./storage/apns-repository.js";
+import { LiveActivityRepository } from "./storage/live-activity-repository.js";
 import { ConversationOrganizationRepository } from "./storage/conversation-organization-repository.js";
 import { PreferencesRepository } from "./storage/preferences-repository.js";
 import { WorkspaceRepository } from "./storage/workspaces-repository.js";
@@ -22,9 +25,12 @@ export { ensureDatabaseFile } from "./storage-schema.js";
 type RepositoryMethods<T> = Pick<T, {
     [K in keyof T]: T[K] extends (...args: never[]) => unknown ? K : never;
 }[keyof T]>;
-export interface WandStorage extends RepositoryMethods<ConversationRepository>, RepositoryMethods<ConversationOrganizationRepository>, RepositoryMethods<PreferencesRepository>, RepositoryMethods<WorkspaceRepository>, RepositoryMethods<TaskRepository>, RepositoryMethods<SecretsRepository>, RepositoryMethods<EmployeeRepository>, RepositoryMethods<UserMemoryRepository>, RepositoryMethods<AiTeamRepository>, RepositoryMethods<MissionRepository>, RepositoryMethods<SessionRepository>, RepositoryMethods<UploadRepository>, RepositoryMethods<FeedbackRepository> {
+export interface WandStorage extends RepositoryMethods<DingTalkRepository>, RepositoryMethods<ConversationRepository>, RepositoryMethods<ConversationOrganizationRepository>, RepositoryMethods<PreferencesRepository>, RepositoryMethods<WorkspaceRepository>, RepositoryMethods<TaskRepository>, RepositoryMethods<SecretsRepository>, RepositoryMethods<EmployeeRepository>, RepositoryMethods<UserMemoryRepository>, RepositoryMethods<AiTeamRepository>, RepositoryMethods<MissionRepository>, RepositoryMethods<SessionRepository>, RepositoryMethods<UploadRepository>, RepositoryMethods<FeedbackRepository> {
 }
 export declare class WandStorage {
+    readonly dingtalk: DingTalkRepository;
+    readonly apns: ApnsRepository;
+    readonly liveActivities: LiveActivityRepository;
     readonly conversations: ConversationRepository;
     readonly conversationOrganizations: ConversationOrganizationRepository;
     readonly preferences: PreferencesRepository;

package/dist/storage.js

@@ -6,6 +6,9 @@ import { openStorageDatabase } from "./storage-schema.js";
 import { parseWandTaskAgent } from "./storage/mappers.js";
 export * from "./storage/internal.js";
 import { ConversationRepository } from "./storage/conversations-repository.js";
+import { DingTalkRepository } from "./storage/dingtalk-repository.js";
+import { ApnsRepository } from "./storage/apns-repository.js";
+import { LiveActivityRepository } from "./storage/live-activity-repository.js";
 import { ConversationOrganizationRepository } from "./storage/conversation-organization-repository.js";
 import { PreferencesRepository } from "./storage/preferences-repository.js";
 import { WorkspaceRepository } from "./storage/workspaces-repository.js";
@@ -21,6 +24,9 @@ import { FeedbackRepository } from "./storage/feedback-repository.js";
 export { parseWandTaskAgent };
 export { ensureDatabaseFile } from "./storage-schema.js";
 export class WandStorage {
+    dingtalk;
+    apns;
+    liveActivities;
     conversations;
     conversationOrganizations;
     preferences;
@@ -84,6 +90,9 @@ export class WandStorage {
         chmodSync(dir, 0o700);
         this.dbPath = dbPath;
         this.db = openStorageDatabase(dbPath);
+        this.dingtalk = new DingTalkRepository(this.db);
+        this.apns = new ApnsRepository(this.db, this);
+        this.liveActivities = new LiveActivityRepository(this.db, this);
         this.conversations = new ConversationRepository(this.db, this);
         this.conversationOrganizations = new ConversationOrganizationRepository(this.db);
         this.preferences = new PreferencesRepository(this.db, this);
@@ -238,6 +247,7 @@ export class WandStorage {
     }
 }
 const REPOSITORY_FORWARDS = [
+    ["dingtalk", DingTalkRepository],
     ["conversations", ConversationRepository],
     ["conversationOrganizations", ConversationOrganizationRepository],
     ["preferences", PreferencesRepository],

package/dist/structured-exec-host.d.ts

@@ -35,6 +35,8 @@ export interface StructuredRunState {
     stderrTruncated: boolean;
     /** Already-file-backed native output; no Server-side stdout capture copy is required. */
     nativeFile?: string;
+    /** Validated native replay starts after this durable parsed checkpoint. */
+    stdoutFrom?: number;
 }
 export interface StructuredStreamEvent {
     stream: "stdout" | "stderr";
@@ -51,6 +53,12 @@ export interface StructuredExecProcess {
     readonly runId: string;
     readonly incarnationId: string;
     readonly pid: number;
+    /** Immutable identity of the native journal, used only by internal checkpoints. */
+    readonly protocolSource?: {
+        file: string;
+        dev: number;
+        ino: number;
+    };
     interrupt(signal?: string): void;
     onStream(listener: (event: StructuredStreamEvent) => void): {
         dispose(): void;
@@ -73,7 +81,7 @@ export interface StructuredExecHost {
     };
     spawnStructured(request: StructuredSpawnRequest): Promise<StructuredExecProcess>;
     /** Full state incl. replay logs; null when the host does not know the run. */
-    attachRun(runId: string): Promise<StructuredRunState | null>;
+    attachRun(runId: string, checkpoint?: import("./pi-cli-checkpoint.js").PiCliCheckpoint): Promise<StructuredRunState | null>;
     /** Subscribe to a known running run without spawning anything. */
     adoptRun(runId: string): Promise<StructuredExecProcess | null>;
     listRuns(): Promise<StructuredRunState[]>;

package/dist/structured-exec-pump.d.ts

@@ -36,7 +36,18 @@ export interface StructuredCliPumpOptions<S extends StructuredRunnerTurnState> {
     createProtocolReader?(onLine: (line: string) => void): {
         push(text: string): void;
         finish(): void;
+        readonly atBoundary?: boolean;
     };
+    /** Called only at native-file chunk boundaries after complete parsed events. */
+    checkpoint?(source: {
+        incarnationId: string;
+        source: {
+            file: string;
+            dev: number;
+            ino: number;
+        };
+        offset: number;
+    }): void;
     /** Fresh per-run state (or reducer-owned state) for the pump context. */
     createState(): S;
     processLine(line: string, ctx: StructuredCliPumpContext<S>): void;

package/dist/structured-exec-pump.js

@@ -18,6 +18,9 @@ export function startStructuredCli(options) {
     let lineBuffer = "";
     let lineBytes = 0;
     const protocolReader = options.createProtocolReader?.((line) => options.processLine(line, ctx));
+    // Compact Pi's transport before journaling it: a single image or redundant
+    // history snapshot must not exhaust the raw-file quota before SAX can read it.
+    const captureReader = options.stdoutFile ? options.createProtocolReader?.((line) => stdoutFile?.append(line + "\n")) : undefined;
     let settled = false;
     let stopRequested = false;
     let stopDelivered = false;
@@ -52,18 +55,25 @@ export function startStructuredCli(options) {
             return;
         if (!protocolError) {
             try {
-                stdoutFile?.drain();
-                // File consumption can itself settle a protocol failure.
-                if (settled)
-                    return;
-                protocolReader?.finish();
+                captureReader?.finish();
             }
             catch (error) {
                 protocolError = error instanceof Error ? error : new Error(String(error));
             }
+        }
+        try {
+            // Preserve already validated output even if a later source frame failed.
+            stdoutFile?.drain();
             if (settled)
                 return;
+            if (!protocolError)
+                protocolReader?.finish();
         }
+        catch (error) {
+            protocolError ??= error instanceof Error ? error : new Error(String(error));
+        }
+        if (settled)
+            return;
         settled = true;
         try {
             if (!protocolError && lineBuffer.trim())
@@ -146,7 +156,10 @@ export function startStructuredCli(options) {
             return;
         }
         try {
-            stdoutFile.append(text);
+            if (captureReader)
+                captureReader.push(text);
+            else
+                stdoutFile.append(text);
         }
         catch (error) {
             fileFailure(error instanceof Error ? error : new Error(String(error)));
@@ -196,7 +209,12 @@ export function startStructuredCli(options) {
             void host.spawnStructured(request).then((handle) => {
                 source = { pid: handle.pid, interrupt: () => handle.interrupt() };
                 // Replay and subscribe before applying a pending external cancellation.
-                wireRemoteHandle(handle, captureStdout, handleStderrText, finish, acknowledgeExit);
+                wireRemoteHandle(handle, captureStdout, handleStderrText, finish, acknowledgeExit, (event) => {
+                    if (!settled && options.nativePi && event.stream === "stdout" && handle.protocolSource
+                        && protocolReader?.atBoundary && observer.isActive()) {
+                        options.checkpoint?.({ incarnationId: handle.incarnationId, source: handle.protocolSource, offset: event.seq });
+                    }
+                });
                 if (stopRequested && !settled)
                     interruptSource();
             }, unavailable);
@@ -234,12 +252,13 @@ export function startStructuredCli(options) {
     }
     return execution;
 }
-function wireRemoteHandle(handle, onStdout, onStderr, finish, acknowledgeExit) {
+function wireRemoteHandle(handle, onStdout, onStderr, finish, acknowledgeExit, afterStream) {
     const stream = handle.onStream((event) => {
         if (event.stream === "stdout")
             onStdout(event.data);
         else
             onStderr(event.data);
+        afterStream?.(event);
     });
     let exit;
     let ended = false;

package/dist/structured-pi-adapter.js

@@ -321,6 +321,11 @@ export class PiRunner {
             requestId: context.session.structuredState?.activeRequestId ?? undefined,
             createState: () => state,
             createProtocolReader: (onLine) => new PiProtocolReader(onLine),
+            checkpoint: (checkpoint) => {
+                const requestId = context.session.structuredState?.activeRequestId;
+                if (requestId)
+                    observer.onPiCheckpoint?.({ version: 1, ...checkpoint, requestId, state, primaryError });
+            },
             processLine: (line) => {
                 if (!observer.isActive() || !line.trim())
                     return;

package/dist/structured-runner.d.ts

@@ -57,6 +57,8 @@ export interface StructuredRunnerObserver {
     onStdout?(text: string): void;
     onStderr?(text: string): void;
     onEvent?(event: Record<string, unknown>): void;
+    /** Internal native Pi materialization; never forwarded to clients. */
+    onPiCheckpoint?(checkpoint: import("./pi-cli-checkpoint.js").PiCliCheckpoint): void;
     onUpdate(state: StructuredRunnerTurnState): void;
 }
 export interface StructuredRunnerResult {

package/dist/structured-session-manager.d.ts

@@ -100,6 +100,7 @@ export declare class StructuredSessionManager {
     private inputSequence;
     /** Last wall-clock time (ms) a streaming checkpoint reached SQLite. */
     private readonly lastStreamSaveAt;
+    private readonly lastPiCheckpointAt;
     private readonly streamCheckpointTimers;
     private readonly streamCheckpointDirty;
     /**
@@ -172,6 +173,7 @@ export declare class StructuredSessionManager {
     private finalizeRecoveredRun;
     private trackStreamEmitTimer;
     private clearStreamEmitTimer;
+    private savePiCheckpoint;
     /** Mark streaming payload dirty and enforce both leading and trailing checkpoints. */
     private saveStreamingSnapshot;
     private flushStreamingCheckpoint;