@duckcodeailabs/dql-cli 1.12.6 → 1.12.8

package/dist/local-runtime.js

@@ -1,5 +1,6 @@
 import { execFileSync, execSync } from "node:child_process";
 import { createHash } from "node:crypto";
+import { gzipSync } from "node:zlib";
 import { createServer } from "node:http";
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, watch, writeFileSync, } from "node:fs";
 import { createRequire } from "node:module";
@@ -526,6 +527,73 @@ function recordConversationTurn(store, threadId, run) {
         // Conversation persistence is additive; a failed write must not fail the run.
     }
 }
+/**
+ * Presentation projection of a run, for anything that SHIPS it — thread history
+ * and the live SSE stream alike.
+ *
+ * A stored run is dominated by DUPLICATED diagnostics rather than content. On a
+ * real 2.4 MB run: `diagnosticReceipt` is held twice — once top-level and once
+ * inside `artifacts[0].payload`, byte-identical — and each copy embeds its own
+ * full `steps` and `artifacts`, which embed the payload again. The part the UI
+ * actually renders (`payload.result`) was 3 KB.
+ *
+ * Everything the thread view reads is preserved, including
+ * `diagnosticReceipt.failure.message`; only the self-referential nesting and the
+ * unread `considered` block are dropped. The complete record stays available
+ * from the existing `GET /api/agent-runs/:id` run-state route.
+ */
+export function slimAgentRunForTransport(run) {
+    const slimReceipt = (receipt) => {
+        const record = agentRunRecord(receipt);
+        if (!record)
+            return receipt;
+        // `steps`/`artifacts` inside the receipt duplicate the run's own.
+        const { steps: _steps, artifacts: _artifacts, ...rest } = record;
+        return rest;
+    };
+    const artifacts = (run.artifacts ?? []).map((artifact) => {
+        const payload = agentRunRecord(artifact.payload);
+        if (!payload)
+            return artifact;
+        const { considered: _considered, ...restPayload } = payload;
+        return {
+            ...artifact,
+            payload: {
+                ...restPayload,
+                ...(payload.diagnosticReceipt ? { diagnosticReceipt: slimReceipt(payload.diagnosticReceipt) } : {}),
+            },
+        };
+    });
+    // `steps[].artifacts` is a THIRD copy of the run's own artifacts, and one
+    // progress event carries a FOURTH as its payload. Both are dropped rather than
+    // truncated: the data itself is unchanged and still on `run.artifacts`.
+    const MAX_EVENT_PAYLOAD_BYTES = 8 * 1024;
+    const steps = (run.steps ?? []).map((step) => {
+        const record = agentRunRecord(step);
+        if (!record?.artifacts)
+            return step;
+        const { artifacts: _stepArtifacts, ...rest } = record;
+        return rest;
+    });
+    const events = (run.events ?? []).slice(-20).map((event) => {
+        const record = agentRunRecord(event);
+        if (!record?.payload)
+            return event;
+        const encoded = JSON.stringify(record.payload) ?? '';
+        if (encoded.length <= MAX_EVENT_PAYLOAD_BYTES)
+            return event;
+        return { ...record, payload: { omitted: 'oversized', bytes: encoded.length } };
+    });
+    return {
+        ...run,
+        artifacts,
+        steps,
+        events,
+        ...(run.diagnosticReceipt
+            ? { diagnosticReceipt: slimReceipt(run.diagnosticReceipt) }
+            : {}),
+    };
+}
 export function conversationTurnInputFromRun(run) {
     const artifact = run.artifacts.find((candidate) => candidate.kind === 'answer')
         ?? run.artifacts.find((candidate) => candidate.kind === 'research_run')
@@ -1592,6 +1660,37 @@ export async function startLocalServer(opts) {
         }
         return governedAnswer;
     }
+    /**
+     * The user-facing line for a terminal analytical failure.
+     *
+     * `message` is a fixed SAFE_FAILURES headline chosen by failure code — that
+     * redaction is the governance contract and stays. But on its own it says
+     * nothing actionable: "The selected route could not compile its immutable
+     * analytical plan" is the DEFAULT for anything unclassified, so a MetricFlow
+     * compile error and a dialect mismatch read identically and neither tells the
+     * user what to change.
+     *
+     * `diagnostic` carries the producer's own words, already stripped of
+     * credentials, connection strings, and quoted literals by
+     * `redactAnalyticalDiagnostic`. Appending it costs nothing and is the
+     * difference between a dead end and a fixable error.
+     */
+    function analyticalFailureSummary(failure) {
+        if (!failure)
+            return undefined;
+        const headline = failure.message?.trim();
+        const diagnostic = failure.diagnostic?.trim();
+        if (!headline)
+            return diagnostic || undefined;
+        if (!diagnostic)
+            return headline;
+        // Avoid saying the same thing twice when the producer text is already the
+        // headline (or is contained in it).
+        const normalize = (value) => value.toLowerCase().replace(/\s+/g, ' ');
+        if (normalize(headline).includes(normalize(diagnostic)))
+            return headline;
+        return `${headline} ${diagnostic}`;
+    }
     function resolvedRunRouteFromAnswer(governedAnswer) {
         return routeForCascadeAnswerTier(governedAnswer.route?.tier);
     }
@@ -2125,7 +2224,7 @@ export async function startLocalServer(opts) {
             answerRefusalCode: governedAnswer.kind === 'no_answer' ? governedAnswer.refusalCode : undefined,
             answerTier: governedAnswer.route?.tier,
             summary: isTerminalFailure
-                ? governedAnswer.analyticalFailure?.message
+                ? analyticalFailureSummary(governedAnswer.analyticalFailure)
                     ?? governedAnswer.executionError
                     ?? governedAnswer.answer
                     ?? governedAnswer.text
@@ -4671,7 +4770,97 @@ export async function startLocalServer(opts) {
         response.write(`event: ${event}\n`);
         response.write(`data: ${serializeJSON(data)}\n\n`);
     };
+    /**
+     * Gzip text responses.
+     *
+     * Nothing was compressed before: the main bundle went out at 592 KB where gzip
+     * makes it 154 KB (73% smaller), and JSON API responses — which compress even
+     * better — were also sent raw. One wrapper here rather than a change at
+     * hundreds of `res.end(...)` call sites.
+     *
+     * STREAMING IS EXEMPT. Buffering an SSE response in order to compress it would
+     * defeat streaming entirely, so any response that calls `res.write()` opts
+     * itself out permanently, as does `text/event-stream`.
+     */
+    const MIN_COMPRESS_BYTES = 1024;
+    const COMPRESSIBLE = /^(?:text\/(?!event-stream)|application\/(?:json|javascript|xml|wasm)|image\/svg)/i;
+    const withCompression = (request, response) => {
+        if (!/\bgzip\b/i.test(String(request.headers['accept-encoding'] ?? '')))
+            return response;
+        const writeHead = response.writeHead.bind(response);
+        const end = response.end.bind(response);
+        const write = response.write.bind(response);
+        let status = 200;
+        let headers = {};
+        let captured = false;
+        let streaming = false;
+        response.writeHead = ((code, hdrs) => {
+            status = code;
+            headers = hdrs ?? {};
+            captured = true;
+            return response;
+        });
+        response.write = ((...args) => {
+            if (captured && !streaming) {
+                streaming = true;
+                writeHead(status, headers);
+            }
+            return write(...args);
+        });
+        response.end = ((...args) => {
+            const body = args[0];
+            const contentType = String(headers['Content-Type'] ?? '');
+            const encodable = captured
+                && !streaming
+                && (typeof body === 'string' || Buffer.isBuffer(body))
+                && COMPRESSIBLE.test(contentType);
+            if (!encodable) {
+                if (captured && !streaming) {
+                    streaming = true;
+                    writeHead(status, headers);
+                }
+                return end(...args);
+            }
+            const raw = Buffer.isBuffer(body) ? body : Buffer.from(body, 'utf8');
+            streaming = true;
+            // VALIDATOR CACHING. API responses carried no ETag or Last-Modified, so a
+            // browser could never revalidate: every panel switch re-downloaded every
+            // read in full. An ETag with `Cache-Control: no-cache` means the browser
+            // always ASKS but the server answers 304 with no body when nothing
+            // changed — freshness is unchanged, the bytes are not re-sent.
+            const cacheableRead = request.method === 'GET' && status === 200;
+            const etag = cacheableRead
+                ? `W/"${createHash('sha1').update(raw).digest('base64url')}"`
+                : undefined;
+            if (etag && String(request.headers['if-none-match'] ?? '') === etag) {
+                writeHead(304, {
+                    ETag: etag,
+                    'Cache-Control': headers['Cache-Control'] ?? 'no-cache',
+                    Vary: 'Accept-Encoding, Origin',
+                });
+                return end();
+            }
+            const validatorHeaders = etag
+                ? { ETag: etag, 'Cache-Control': headers['Cache-Control'] ?? 'no-cache' }
+                : {};
+            if (raw.byteLength < MIN_COMPRESS_BYTES) {
+                writeHead(status, { ...headers, ...validatorHeaders });
+                return end(raw);
+            }
+            const gz = gzipSync(raw);
+            writeHead(status, {
+                ...headers,
+                ...validatorHeaders,
+                'Content-Encoding': 'gzip',
+                'Content-Length': gz.byteLength,
+                Vary: 'Accept-Encoding, Origin',
+            });
+            return end(gz);
+        });
+        return response;
+    };
     const server = createServer((req, res) => {
+        res = withCompression(req, res);
         const requestUrl = req.url || '/';
         const url = new URL(requestUrl, 'http://127.0.0.1');
         const path = url.pathname || '/';
@@ -5662,7 +5851,12 @@ export async function startLocalServer(opts) {
                                 writeAgentRunSse(res, 'agent-run-answer-delta', { runId: parsed.request.runId, delta });
                             });
                             recordConversationTurn(conversationStore, parsed.request.threadId, run);
-                            writeAgentRunSse(res, 'agent-run-complete', run);
+                            // The terminal frame carried the whole stored run — 2.4 MB on a real
+                            // question, of which the renderable part was ~3 KB. The rest was the
+                            // same artifacts repeated four times over. The client renders from
+                            // the projection and fetches the full record from the run-state
+                            // route only if something needs it.
+                            writeAgentRunSse(res, 'agent-run-complete', slimAgentRunForTransport(run));
                             res.end();
                             return;
                         }
@@ -6834,6 +7028,26 @@ export async function startLocalServer(opts) {
                             res.end(serializeJSON({ ok: true }));
                             return;
                         }
+                        // Rename / pin. Both are housekeeping on an existing conversation, so
+                        // neither moves `updated_at` — see the store methods.
+                        if (req.method === 'PATCH' && !action) {
+                            const body = await readJSON(req).catch(() => null);
+                            const record = agentRunRecord(body) ?? {};
+                            const title = agentRunString(record.title);
+                            const favorite = typeof record.favorite === 'boolean' ? record.favorite : undefined;
+                            if (title === undefined && favorite === undefined) {
+                                res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+                                res.end(serializeJSON({ error: 'Provide a title or a favorite flag.' }));
+                                return;
+                            }
+                            if (title !== undefined)
+                                store.renameThread(threadId, title);
+                            if (favorite !== undefined)
+                                store.setThreadFavorite(threadId, favorite);
+                            res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+                            res.end(serializeJSON({ thread: store.getThread(threadId) }));
+                            return;
+                        }
                         if (req.method === 'DELETE' && !action) {
                             store.deleteThread(threadId);
                             res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
@@ -6883,7 +7097,13 @@ export async function startLocalServer(opts) {
                                 if (!turn.agentRunId)
                                     return [];
                                 const run = agentRunStore.get(turn.agentRunId);
-                                return run ? [run] : [];
+                                // Thread history is a PRESENTATION payload. A stored run averages
+                                // ~700 KB and can exceed 2 MB, almost none of it renderable, so
+                                // fetching 50 of them meant tens of megabytes to read, parse,
+                                // re-serialize and ship before the sidebar could draw — the
+                                // reported ~10s load. `GET /api/agent-runs/:id` serves the full
+                                // record when the inspector actually needs it.
+                                return run ? [slimAgentRunForTransport(run)] : [];
                             });
                             res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
                             res.end(serializeJSON({
@@ -16554,14 +16774,73 @@ export function openBlockStudioDocument(projectRoot, relativePath, semanticLayer
         validation: validateBlockStudioSource(source, semanticLayer),
     };
 }
-function parseBlockStudioArrayField(source, key) {
-    const match = source.match(new RegExp(`\\b${key}\\s*=\\s*\\[([\\s\\S]*?)\\]`, 'i'));
-    if (!match)
+/**
+ * Replace the CONTENTS of every string literal with same-length filler, keeping
+ * the quotes and every offset intact.
+ *
+ * Field lookups below scan the whole block source for `key = ...`. A block's
+ * `description` is free text — on an AI-generated block it is literally the
+ * user's question — so a description mentioning `granularity = "day"` or
+ * `dimensions = [...]` was matched as if it were the field itself and silently
+ * replaced the real one. Masking first means a match can only ever land on a
+ * real assignment; reading the value back from the ORIGINAL at the same offsets
+ * keeps it exact.
+ */
+export function maskDqlStringContents(source) {
+    const chars = source.split('');
+    let index = 0;
+    while (index < chars.length) {
+        if (source.startsWith('\"\"\"', index)) {
+            const end = source.indexOf('\"\"\"', index + 3);
+            const contentEnd = end === -1 ? chars.length : end;
+            for (let cursor = index + 3; cursor < contentEnd; cursor += 1) {
+                if (chars[cursor] !== '\n')
+                    chars[cursor] = 'x';
+            }
+            index = end === -1 ? chars.length : end + 3;
+            continue;
+        }
+        if (chars[index] === '"') {
+            let cursor = index + 1;
+            while (cursor < chars.length && chars[cursor] !== '"') {
+                if (chars[cursor] === '\\') {
+                    cursor += 2;
+                    continue;
+                }
+                cursor += 1;
+            }
+            for (let inner = index + 1; inner < Math.min(cursor, chars.length); inner += 1) {
+                if (chars[inner] !== '\n')
+                    chars[inner] = 'x';
+            }
+            index = cursor + 1;
+            continue;
+        }
+        index += 1;
+    }
+    return chars.join('');
+}
+export function parseBlockStudioArrayField(source, key) {
+    const masked = maskDqlStringContents(source);
+    const match = masked.match(new RegExp(`\\b${key}\\s*=\\s*\\[`, 'i'));
+    if (!match || match.index === undefined)
         return [];
-    return (match[1].match(/"([^"]*)"/g) ?? []).map((value) => value.slice(1, -1)).filter(Boolean);
+    const start = match.index + match[0].length;
+    const end = masked.indexOf(']', start);
+    if (end === -1)
+        return [];
+    return (source.slice(start, end).match(/"([^"]*)"/g) ?? [])
+        .map((value) => value.slice(1, -1))
+        .filter(Boolean);
 }
-function parseBlockStudioStringField(source, key) {
-    return source.match(new RegExp(`\\b${key}\\s*=\\s*"([^"]*)"`, 'i'))?.[1] ?? undefined;
+export function parseBlockStudioStringField(source, key) {
+    const masked = maskDqlStringContents(source);
+    const match = masked.match(new RegExp(`\\b${key}\\s*=\\s*"`, 'i'));
+    if (!match || match.index === undefined)
+        return undefined;
+    const start = match.index + match[0].length;
+    const end = masked.indexOf('"', start);
+    return end === -1 ? undefined : source.slice(start, end);
 }
 function parseSemanticRequestedFilters(source) {
     return parseBlockStudioArrayField(source, 'requested_filters')
@@ -19595,9 +19874,16 @@ function extractBlockStudioChartConfig(source) {
     };
 }
 export function extractBlockStudioSql(source) {
-    const tripleQuoteMatch = source.match(/query\s*=\s*"""([\s\S]*?)"""/i);
-    if (tripleQuoteMatch)
-        return tripleQuoteMatch[1].trim() || null;
+    // Masked lookup for the same reason the field parsers use one: a `description`
+    // is free text and must never be able to present itself as the query.
+    const masked = maskDqlStringContents(source);
+    const tripleQuoteMatch = masked.match(/query\s*=\s*"""/i);
+    if (tripleQuoteMatch && tripleQuoteMatch.index !== undefined) {
+        const start = tripleQuoteMatch.index + tripleQuoteMatch[0].length;
+        const end = masked.indexOf('"""', start);
+        if (end !== -1)
+            return source.slice(start, end).trim() || null;
+    }
     const bareTripleMatch = source.match(/"""([\s\S]*?)"""/);
     if (bareTripleMatch)
         return bareTripleMatch[1].trim() || null;