@flame0510/project-aether 1.1.15 → 1.3.0

package/lib/credentials/detect.ts

@@ -1,6 +1,10 @@
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { dockerExecShellNoFail } from '@/lib/docker-exec';
 import { hashToken } from './hash';
 
+const execFileAsync = promisify(execFile);
+
 export interface AgentContainer {
   name: string;
   agentId: string;
@@ -11,14 +15,14 @@ export interface AgentContainer {
  * Shared by the detect API route and the credential delivery layer so both
  * reason over the exact same set of containers.
  */
-export function listAgentContainers(): AgentContainer[] {
+export async function listAgentContainers(): Promise<AgentContainer[]> {
   try {
-    const out = execSync(
-      "docker ps --filter label=AGENT_ID --format '{{.Names}}\t{{.Label \"AGENT_ID\"}}'",
-      { timeout: 5000, encoding: 'utf-8', maxBuffer: 64 * 1024 },
-    ).trim();
-    if (!out) return [];
-    return out.split('\n').filter(Boolean).map((line) => {
+    const { stdout } = await execFileAsync(
+      'docker',
+      ['ps', '--filter', 'label=AGENT_ID', '--format', '{{.Names}}\t{{.Label "AGENT_ID"}}'],
+      { encoding: 'utf-8', timeout: 5000, maxBuffer: 64 * 1024 },
+    );
+    return stdout.trim().split('\n').filter(Boolean).map((line) => {
       const [name, agentId] = line.split('\t');
       return { name: name ?? '', agentId: agentId ?? name ?? '' };
     });
@@ -27,55 +31,164 @@ export function listAgentContainers(): AgentContainer[] {
   }
 }
 
-/** Run a shell snippet inside a container, parsing stdout with a fallback on error. */
-export function execInContainer<T>(
-  container: string,
-  script: string,
-  parse: (raw: string) => T,
-  fallback: T,
-): T {
-  try {
-    const raw = execSync(
-      `docker exec ${container.replace(/[^a-zA-Z0-9_.-]/g, '')} sh -c ${JSON.stringify(script)}`,
-      { timeout: 10000, encoding: 'utf-8', shell: '/bin/bash' },
-    ).trim();
-    return parse(raw);
-  } catch {
-    return fallback;
-  }
-}
+// ── Probing ─────────────────────────────────────────────────────────────────
 
-/** Trello: presence of the config file marks the CLI as authenticated. */
-export function detectTrello(container: string): { loggedIn: boolean } {
-  const hasConfig = execInContainer(
-    container,
-    'test -f /root/.trello-cli/default/config.json && echo yes || echo no',
-    (r) => r.trim(),
-    'no',
-  );
-  return { loggedIn: hasConfig === 'yes' };
+/** Fields the probe script emits, in order. */
+export interface ContainerProbe {
+  cli: Record<'gh' | 'vercel' | 'supabase' | 'trello', boolean>;
+  ghStatus: string;
+  vercelWhoami: string;
+  supabaseProjects: string;
+  /** Exit status of `supabase projects list`. -1 when the probe never got there. */
+  supabaseRc: number;
+  agentName: string;
+  toolsMdMarkers: number;
+  /** Raw file contents, parsed by the caller. '' when absent or unreadable. */
+  files: Record<
+    'ghHosts' | 'vercelAuth' | 'vercelConfig' | 'supabaseToken' | 'supabaseConfig' | 'trelloConfig' | 'notionConfig',
+    string
+  >;
+  /** False when the probe produced nothing at all — container gone, or it hung. */
+  ok: boolean;
 }
 
-/** Notion: no CLI — just check if the config file exists (same pattern as Trello). */
-export function detectNotion(container: string): { loggedIn: boolean } {
-  const hasConfig = execInContainer(
-    container,
-    'test -f /root/.config/notion/config.json && echo yes || echo no',
-    (r) => r.trim(),
-    'no',
-  );
-  return { loggedIn: hasConfig === 'yes' };
-}
-export function cliInstalled(container: string, name: string): boolean {
-  const raw = execInContainer(
-    container,
-    `command -v ${name} >/dev/null 2>&1 && echo yes || echo no`,
-    (r) => r.trim(),
-    'no',
-  );
-  return raw === 'yes';
+/**
+ * One `docker exec` per container instead of twenty-one.
+ *
+ * Every probe used to be its own process, ~21 per container, each paying the
+ * cost of starting `docker exec` — measured here at ~90ms, so roughly 1.9s of
+ * pure process startup before any probe did work.
+ *
+ * The point of collapsing them is not the probe's own wall time. Measured on
+ * Docker Desktop, this script costs ~6.5s per container, and ~6.4s of that is
+ * the three CLI calls at the end reaching the network from inside the container
+ * — which no amount of restructuring here makes faster. The gain is that the
+ * twenty-one were `execSync`: each one blocked Node's single thread, so every
+ * other request on the dashboard stopped for the duration. That is what this
+ * removed. Compare figures only within one host; the network share dominates
+ * and moves with the machine.
+ *
+ * Two properties of the script are load-bearing, and breaking either one loses
+ * far more than it saves:
+ *
+ * - **No command may leave a non-zero status standing, and the script ends in
+ *   `exit 0`.** `dockerExecShellNoFail` returns '' for the *entire* script on
+ *   any non-zero exit, so a single command failing — and `gh auth status` exits
+ *   non-zero simply when logged out — would discard all the other fields with
+ *   it. Most commands satisfy this with a trailing `|| true`; `supabase
+ *   projects list` instead assigns into a variable, which both neutralises the
+ *   status and preserves it in `$?` for the caller to read.
+ * - **NUL delimits the records.** A shell variable cannot hold a NUL byte, and
+ *   none of the sources here (YAML, JSON, TOML, CLI stdout, ANSI escapes) emit
+ *   one, so no value can forge a record boundary. This mirrors `readSkillsBulk`
+ *   in `app/api/skills/route.js`, which has carried the same guarantee in
+ *   production.
+ *
+ * What this does *not* preserve is per-probe timeout isolation: previously each
+ * command had its own 10s budget, and now one hung CLI costs the whole
+ * container's read. That is the deliberate trade — with `…NoFail` the damage
+ * stops at that container instead of blanking the fleet.
+ */
+const PROBE_SCRIPT = [
+  'k(){ printf "%s\\0" "$1"; }',
+  'e(){ printf "\\0"; }',
+  'for t in gh vercel supabase trello; do',
+  '  k "cli:$t"; if command -v "$t" >/dev/null 2>&1; then printf yes; else printf no; fi; e',
+  'done',
+  // Local reads first. They are what decides whether a stored credential is
+  // installed, and they cost nothing. The three CLI calls below reach the
+  // network from inside the container and are the only plausible cause of a
+  // timeout — putting them last means a truncated run loses only the "logged
+  // in" niceties and keeps the token matching, instead of the other way round.
+  'k file:ghHosts;       cat /root/.config/gh/hosts.yml 2>/dev/null || true; e',
+  'k file:vercelAuth;    cat /root/.local/share/com.vercel.cli/auth.json 2>/dev/null || true; e',
+  'k file:vercelConfig;  cat /root/.local/share/com.vercel.cli/config.json 2>/dev/null || true; e',
+  'k file:supabaseToken; cat /root/.supabase/access-token 2>/dev/null || true; e',
+  'k file:supabaseConfig; cat /data/supabase/config.toml 2>/dev/null || true; e',
+  'k file:trelloConfig;  cat /root/.config/trello/config.json 2>/dev/null || true; e',
+  'k file:notionConfig;  cat /root/.config/notion/config.json 2>/dev/null || true; e',
+  'k agent:name;        printenv AGENT_NAME || true; e',
+  'k tools:markers;     grep -c "REV4A:INTEGRATIONS:START" /root/.openclaw/workspace/TOOLS.md 2>/dev/null || true; e',
+  // Sentinel, placed here rather than at the very end. A killed `docker exec`
+  // does not necessarily reject: verified directly against a real container,
+  // `dockerExecShellNoFail` resolves with whatever the script had already
+  // printed when the process is killed for running past its timeout — so a
+  // sentinel after the network calls discarded genuinely-captured local data
+  // whenever only those calls hung. Putting it here means the token-matching
+  // data survives a hang in any of the three CLI calls below; only their
+  // "logged in as" niceties are lost, and every consumer of `ghStatus` /
+  // `vercelWhoami` / `supabaseProjects` already treats an empty string as
+  // "not logged in", not as a crash or a false positive.
+  'k probe:complete;    printf ok; e',
+  'k gh:status;         gh auth status 2>&1 || true; e',
+  'k vercel:whoami;     vercel whoami 2>&1 || true; e',
+  // Captured into a variable so the exit status survives: `|| true` discarded it,
+  // and the only thing left to judge by was the text on stdout. Every failure
+  // whose wording did not happen to contain "Unauthorized" — no token at all, a
+  // container with no route to the network — then read as a successful listing,
+  // and the agent was reported as logged in to Supabase when it held nothing.
+  'sbout=$(supabase projects list --output json 2>&1); sbrc=$?',
+  'k supabase:projects; printf %s "$sbout"; e',
+  'k supabase:rc;       printf %s "$sbrc"; e',
+  'exit 0',
+].join('\n');
+
+const EMPTY_PROBE: ContainerProbe = {
+  cli: { gh: false, vercel: false, supabase: false, trello: false },
+  ghStatus: '', vercelWhoami: '', supabaseProjects: '', supabaseRc: -1, agentName: '',
+  toolsMdMarkers: 0,
+  files: {
+    ghHosts: '', vercelAuth: '', vercelConfig: '',
+    supabaseToken: '', supabaseConfig: '', trelloConfig: '', notionConfig: '',
+  },
+  ok: false,
+};
+
+export async function probeContainer(container: string): Promise<ContainerProbe> {
+  const raw = await dockerExecShellNoFail(container, PROBE_SCRIPT, {
+    timeoutMs: 25_000,
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  if (!raw) return { ...EMPTY_PROBE, files: { ...EMPTY_PROBE.files }, cli: { ...EMPTY_PROBE.cli } };
+
+  const parts = raw.split('\0');
+  const map = new Map<string, string>();
+  for (let i = 0; i + 1 < parts.length; i += 2) map.set(parts[i], parts[i + 1]);
+
+  const g = (k: string) => map.get(k) ?? '';
+  if (g('probe:complete').trim() !== 'ok') {
+    return { ...EMPTY_PROBE, files: { ...EMPTY_PROBE.files }, cli: { ...EMPTY_PROBE.cli } };
+  }
+  return {
+    cli: {
+      gh: g('cli:gh').trim() === 'yes',
+      vercel: g('cli:vercel').trim() === 'yes',
+      supabase: g('cli:supabase').trim() === 'yes',
+      trello: g('cli:trello').trim() === 'yes',
+    },
+    ghStatus: g('gh:status'),
+    vercelWhoami: g('vercel:whoami'),
+    supabaseProjects: g('supabase:projects'),
+    // A hang in the call kills the script before either key is emitted, so an
+    // unparseable status has to mean failure — never success by default.
+    supabaseRc: /^\d+$/.test(g('supabase:rc').trim()) ? parseInt(g('supabase:rc').trim(), 10) : -1,
+    agentName: g('agent:name').trim(),
+    toolsMdMarkers: parseInt(g('tools:markers').trim(), 10) || 0,
+    files: {
+      ghHosts: g('file:ghHosts'),
+      vercelAuth: g('file:vercelAuth'),
+      vercelConfig: g('file:vercelConfig'),
+      supabaseToken: g('file:supabaseToken'),
+      supabaseConfig: g('file:supabaseConfig'),
+      trelloConfig: g('file:trelloConfig'),
+      notionConfig: g('file:notionConfig'),
+    },
+    ok: true,
+  };
 }
 
+// ── Token extraction, in JavaScript ─────────────────────────────────────────
+
 /**
  * Secret field that holds the primary token used to match a stored profile
  * against what is installed in a container, per provider.
@@ -95,55 +208,74 @@ export function profileTokenHash(secret: Record<string, string>, providerId: str
   return val ? hashToken(val) : '';
 }
 
+function jsonField(raw: string, key: string): string {
+  if (!raw.trim()) return '';
+  try {
+    const v = (JSON.parse(raw) as Record<string, unknown>)[key];
+    return typeof v === 'string' ? v : '';
+  } catch {
+    return '';
+  }
+}
+
+/** `oauth_token:` out of gh's hosts.yml. Two levels deep, so no YAML parser. */
+function ghToken(raw: string): string {
+  for (const line of raw.split('\n')) {
+    const m = /^\s*oauth_token:\s*(.+?)\s*$/.exec(line);
+    if (m) return m[1];
+  }
+  return '';
+}
+
 /**
- * Read the token currently installed for a provider inside a container and hash it.
- * Returns '' when nothing is installed or the token cannot be read — callers must
- * treat '' as "unknown / no match" and never as a wildcard.
+ * `project_id` out of supabase's config.toml.
+ *
+ * This replaces a `sed` expression that never worked. It was written inside a
+ * single-quoted JS string using backslash-escaped double quotes, which in
+ * JavaScript collapse to bare quotes; those closed the shell's quoting early, so
+ * the semicolon separating the two substitutions was read as a command
+ * separator and the shell tried to execute the second one as a program. Every
+ * detection logged `sh: 1: not found` for it, and the field came back empty.
  */
-export function providerTokenHash(container: string, providerId: string): string {
-  let raw = '';
+function tomlProjectId(raw: string): string {
+  for (const line of raw.split('\n')) {
+    const m = /^\s*project_id\s*=\s*"([^"]*)"/.exec(line);
+    if (m) return m[1];
+  }
+  return '';
+}
+
+/**
+ * Vercel's `currentTeam`.
+ *
+ * The previous `sed 's/.*: *"//'` was greedy: on a single line holding several
+ * key/value pairs it matched up to the *last* `": "` and returned whichever
+ * value came after, not currentTeam's. It went unnoticed only because the real
+ * config.json happens to be pretty-printed — correctness resting on a third
+ * party's formatting choice.
+ */
+export function extractInstalledToken(probe: ContainerProbe, providerId: string): string {
   switch (providerId) {
-    case 'github-pat':
-      raw = execInContainer(
-        container,
-        "cat /root/.config/gh/hosts.yml 2>/dev/null | grep 'oauth_token:' | head -1 | sed 's/.*: *//'",
-        (r) => r.trim(),
-        '',
-      );
-      break;
-    case 'vercel':
-      raw = execInContainer(
-        container,
-        "cat /root/.local/share/com.vercel.cli/auth.json 2>/dev/null | grep -oE '\"token\"[^,}]*' | head -1 | grep -oE '\"[^\"]*\"$' | tr -d '\"'",
-        (r) => r.trim(),
-        '',
-      );
-      break;
-    case 'supabase':
-      raw = execInContainer(
-        container,
-        'cat /root/.supabase/access-token 2>/dev/null | head -1',
-        (r) => r.trim(),
-        '',
-      );
-      break;
-    case 'trello':
-      raw = execInContainer(
-        container,
-        "cat /root/.trello-cli/default/config.json 2>/dev/null | grep -oE '\"token\"[^,}]*' | head -1 | grep -oE '\"[^\"]*\"$' | tr -d '\"'",
-        (r) => r.trim(),
-        '',
-      );
-      break;
-    case 'notion':
-      raw = execInContainer(
-        container,
-        "cat /root/.config/notion/config.json 2>/dev/null | grep -oE '\"token\"[^,}]*' | head -1 | grep -oE '\"[^\"]*\"$' | tr -d '\"'",
-        (r) => r.trim(),
-        '',
-      );
-      break;
+    case 'github-pat': return ghToken(probe.files.ghHosts);
+    case 'vercel':     return jsonField(probe.files.vercelAuth, 'token');
+    case 'supabase':   return probe.files.supabaseToken.split('\n')[0]?.trim() ?? '';
+    case 'trello':     return jsonField(probe.files.trelloConfig, 'token');
+    case 'notion':     return jsonField(probe.files.notionConfig, 'token');
+    default:           return '';
   }
+}
+
+/** Hash of the token currently installed for a provider ('' when unreadable). */
+export function providerTokenHash(probe: ContainerProbe, providerId: string): string {
+  const raw = extractInstalledToken(probe, providerId);
   if (!raw || raw.length < 10) return '';
   return hashToken(raw);
 }
+
+export function vercelCurrentTeam(probe: ContainerProbe): string {
+  return jsonField(probe.files.vercelConfig, 'currentTeam');
+}
+
+export function supabaseProjectRef(probe: ContainerProbe): string {
+  return tomlProjectId(probe.files.supabaseConfig);
+}

package/lib/credentials/providers.ts

@@ -4,6 +4,15 @@ export interface CredentialField {
   placeholder: string;
   type: 'text' | 'password';
   hint?: string;
+  /**
+   * Where this specific value is created. Rendered as a link next to the field
+   * in the add/edit modal. The provider-level `docsUrl` sits on the card
+   * outside the modal, so without this the form itself offers no way out to go
+   * and fetch the value it is asking for.
+   */
+  docsUrl?: string;
+  /** Link text, minus the trailing arrow the UI adds. Defaults to `docs`. */
+  docsLabel?: string;
 }
 
 export interface CredentialProviderDef {
@@ -30,7 +39,9 @@ export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
         label: 'Personal Access Token',
         placeholder: 'ghp_...',
         type: 'password',
-        hint: 'Requires repo, read:org scopes at minimum',
+        hint: 'Requires repo, read:org scopes at minimum.',
+        docsUrl: 'https://github.com/settings/tokens',
+        docsLabel: 'Create token',
       },
     ],
     deliveryMethod: 'gh auth login --with-token',
@@ -43,10 +54,24 @@ export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
     description: 'API Key and Token for Trello board access',
     authType: 'api-key-pair',
     fields: [
-      { key: 'apiKey', label: 'API Key', placeholder: 'd3c4a0fee...', type: 'password' },
-      { key: 'token', label: 'Token', placeholder: 'ATTA...', type: 'password', hint: 'Click "Generate Trello Token" below to authorize' },
+      {
+        key: 'apiKey',
+        label: 'API Key',
+        placeholder: 'd3c4a0fee...',
+        type: 'password',
+        hint: 'Create a Power-Up, then copy its API key.',
+        docsUrl: 'https://trello.com/power-ups/admin',
+        docsLabel: 'Create API key',
+      },
+      {
+        key: 'token',
+        label: 'Token',
+        placeholder: 'ATTA...',
+        type: 'password',
+        hint: 'Authorize Rev4a with the button below, then paste the token Trello returns.',
+      },
     ],
-    deliveryMethod: 'writes ~/.trello-cli/default/config.json',
+    deliveryMethod: 'writes ~/.config/trello/config.json',
     docsUrl: 'https://trello.com/power-ups/admin',
   },
   {
@@ -61,7 +86,9 @@ export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
         label: 'Access Token',
         placeholder: 'vcp_...',
         type: 'password',
-        hint: 'Create in Vercel Settings → Tokens',
+        hint: 'Create in Vercel Settings → Tokens.',
+        docsUrl: 'https://vercel.com/account/tokens',
+        docsLabel: 'Create token',
       },
     ],
     deliveryMethod: 'writes ~/.local/share/com.vercel.cli/auth.json',
@@ -79,7 +106,9 @@ export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
         label: 'Access Token',
         placeholder: 'sbp_...',
         type: 'password',
-        hint: 'Supabase CLI personal access token. Create at supabase.com/dashboard/account/tokens. Grants access to all your projects for migrations, edge functions, and database management.',
+        hint: 'Grants access to every project on the account — migrations, edge functions, database management.',
+        docsUrl: 'https://supabase.com/dashboard/account/tokens',
+        docsLabel: 'Create token',
       },
     ],
     deliveryMethod: 'supabase login --token *** --no-browser',
@@ -97,7 +126,9 @@ export const CREDENTIAL_PROVIDERS: CredentialProviderDef[] = [
         label: 'API Token (Internal Integration)',
         placeholder: 'ntn_... or secret_...',
         type: 'password',
-        hint: 'Create at notion.so/my-integrations. Grant Read + Insert + Update capabilities.',
+        hint: 'Grant Read + Insert + Update capabilities.',
+        docsUrl: 'https://www.notion.so/my-integrations',
+        docsLabel: 'Create integration',
       },
     ],
     deliveryMethod: 'writes ~/.config/notion/config.json',

package/lib/credentials/vault.ts

@@ -125,19 +125,47 @@ export function updateProfile(
   const now = Date.now();
   const db = openDb(false);
   try {
-    // Only update secret fields if at least one field has a non-empty value
-    const hasValues = Object.values(secret).some((v) => v && v.trim().length > 0);
+    // Only the fields the form actually filled in. The edit modal opens with
+    // every secret input blank — it never prefills a stored secret — so a blank
+    // field means "leave this one alone", not "clear it".
+    const provided = Object.entries(secret)
+      .filter(([, v]) => v && v.trim().length > 0)
+      .reduce<CredentialSecret>((acc, [k, v]) => { acc[k] = v; return acc; }, {});
 
-    if (hasValues) {
+    if (Object.keys(provided).length > 0) {
       const provider = getProvider(profile.providerId);
       if (!provider) throw new Error(`Unknown provider: ${profile.providerId}`);
 
+      const row = db.prepare(
+        'SELECT payload FROM credential_secrets WHERE profile_id = ?',
+      ).get(id) as { payload: string } | undefined;
+
+      let existing: CredentialSecret = {};
+      try {
+        existing = row ? (JSON.parse(row.payload) as CredentialSecret) : {};
+      } catch {
+        existing = {};
+      }
+
+      // Merged onto what is stored, not substituted for it. Rotating only the
+      // Trello `token` used to write a payload holding that one field, dropping
+      // `apiKey` — and every later sync then failed with "Missing Trello API key
+      // or token". Trello is the only two-field provider, and the move to the
+      // REST endpoint made both fields load-bearing.
+      const merged: CredentialSecret = { ...existing, ...provided };
+      const payload = JSON.stringify(merged);
+      const secretChanged = payload !== (row?.payload ?? '');
+
       const maskKey = firstPasswordField(provider);
-      const secretMasked = mask(maskKey ? (secret[maskKey] ?? '') : '');
-      const payload = JSON.stringify(secret);
+      const secretMasked = mask(maskKey ? (merged[maskKey] ?? '') : '');
 
       db.prepare(
-        'UPDATE credential_profiles SET label = ?, secret_masked = ?, updated_at = ? WHERE id = ?',
+        secretChanged
+          // A stored secret the agents no longer hold has not been delivered, so
+          // the row must stop reading "synced 2d ago" the moment it changes.
+          // detect flags those same agents ◆ on its next pass.
+          ? 'UPDATE credential_profiles SET label = ?, secret_masked = ?, updated_at = ?, last_synced_at = NULL WHERE id = ?'
+          : 'UPDATE credential_profiles SET label = ?, secret_masked = ?, updated_at = ? WHERE id = ?',
       ).run(label, secretMasked, now, id);
 
       db.prepare(
@@ -167,6 +195,30 @@ export function deleteProfile(id: string): void {
   }
 }
 
+/**
+ * Record that a credential was removed from one container.
+ *
+ * `last_synced_at` is deliberately left alone: it means "when this credential
+ * was last delivered", and a removal is not a delivery. The de-sync path used
+ * to call markSynced(), which stamped the removal as a fresh sync — so the row
+ * went on showing a green dot and "synced just now" at the exact moment the
+ * credential stopped being there.
+ *
+ * `status` stays 'active' because de-sync targets a single container: with
+ * several agents the credential is still delivered to the others.
+ */
+export function markDesynced(id: string): void {
+  const db = openDb(false);
+  try {
+    db.prepare(
+      "UPDATE credential_profiles SET status = 'active', updated_at = ? WHERE id = ?",
+    ).run(Date.now(), id);
+    appendAudit(db, 'desync', id, 'ok');
+  } finally {
+    db.close();
+  }
+}
+
 export function markSynced(id: string, status: 'active' | 'error'): void {
   const db = openDb(false);
   try {
@@ -184,12 +236,25 @@ export function markSynced(id: string, status: 'active' | 'error'): void {
  * Use sparingly — every call is logged.
  */
 export function revealSecret(profileId: string): CredentialSecret {
-  const db = openDb(true);
+  const secret = getSecret(profileId);
+
+  // The audit handle must be writable: this used to open the database readonly
+  // and then INSERT through it, so SQLite rejected every write, appendAudit
+  // swallowed the error by design, and not one reveal was ever recorded.
+  //
+  // Wrapped because a writable open does more than the readonly one it replaced
+  // — it also runs migrateV1(), whose DDL has a `finally` but no `catch`, so a
+  // failure there propagates. An audit trail must never be able to break the
+  // operation it records: losing one log line beats refusing to return a secret
+  // the caller is entitled to.
   try {
-    const secret = getSecret(profileId);
-    appendAudit(db, 'reveal', profileId, 'ok');
-    return secret;
-  } finally {
-    db.close();
-  }
+    const db = openDb(false);
+    try {
+      appendAudit(db, 'reveal', profileId, 'ok');
+    } finally {
+      db.close();
+    }
+  } catch { /* audit unavailable; the reveal itself still stands */ }
+
+  return secret;
 }