@gentbajko/slopify 3.25.9 → 4.1.0

package/dist/edge/remote-access/service.js

@@ -0,0 +1,203 @@
+import { tailscaleCommands } from "./cli.js";
+import { freePort, isProblem, machineOf, parseServeStatus, portTakenProblem, portUse, problemOf, sameTarget, serveRefusedProblem, } from "./rules.js";
+import { remoteAccessStore } from "./store.js";
+import { remoteAccessViews } from "./views.js";
+// ceiling: a view is a few CLI calls; an open Settings tab and agents reading it together
+// share one answer for this long.
+const cacheMs = 5_000;
+export function createRemoteAccessService(deps) {
+    const store = remoteAccessStore(deps.db);
+    const { saved, record } = store;
+    const { loopbackTarget, base, fromProblem, dockerView, offView, funnelProblem, onView } = remoteAccessViews(deps, saved);
+    const diagnose = async () => {
+        const status = await deps.run(tailscaleCommands.status());
+        // `status --json` exits 1 while signed out but still prints the state.
+        const machine = status.stdout.trim().startsWith("{") && !status.missing
+            ? machineOf(status.stdout)
+            : problemOf(status, deps.platform);
+        if (isProblem(machine))
+            return machine;
+        const serveStatus = await deps.run(tailscaleCommands.serveStatus());
+        if (serveStatus.code !== 0)
+            return problemOf(serveStatus, deps.platform);
+        const serve = parseServeStatus(serveStatus.stdout);
+        if (serve === undefined)
+            return {
+                state: "failed",
+                summary: "Slopify couldn't read tailscale serve status --json.",
+                fix: "Update Tailscale to a current version (tailscale.com/download), then press Check again.",
+                link: "https://tailscale.com/download",
+            };
+        return { machine, serve };
+    };
+    const ready = (value) => !("state" in value);
+    const ownerOf = (machine) => machine.owner === undefined ? {} : { owner: machine.owner };
+    // Removes the handler Slopify added, only while it is still exactly that.
+    const removeOurs = async (now) => {
+        const ours = store.applied();
+        if (ours === undefined)
+            return undefined;
+        if (ours.dnsName === now.machine.dnsName) {
+            const use = portUse(now.serve, ours.dnsName, ours.httpsPort);
+            if (use.kind === "proxy" && sameTarget(use.target, ours.target)) {
+                const off = await deps.run(tailscaleCommands.serveOff(ours.httpsPort));
+                if (off.code !== 0)
+                    return problemOf(off, deps.platform);
+            }
+            else if (use.kind !== "free")
+                deps.log.write("info", "remote-access.left", {
+                    detail: `port ${ours.httpsPort} was changed outside Slopify, so it is left as it is`,
+                });
+        }
+        record(undefined);
+        return undefined;
+    };
+    const apply = async () => {
+        const want = saved();
+        const target = loopbackTarget();
+        let now = await diagnose();
+        if (!ready(now))
+            return fromProblem(now);
+        const ours = store.applied();
+        if (ours !== undefined &&
+            (ours.httpsPort !== want.httpsPort ||
+                !sameTarget(ours.target, target) ||
+                ours.dnsName !== now.machine.dnsName)) {
+            const removed = await removeOurs(now);
+            if (removed !== undefined)
+                return fromProblem(removed);
+            now = await diagnose();
+            if (!ready(now))
+                return fromProblem(now);
+        }
+        const { dnsName } = now.machine;
+        const use = portUse(now.serve, dnsName, want.httpsPort);
+        const before = store.applied();
+        const mine = before !== undefined && use.kind === "proxy" && sameTarget(use.target, before.target);
+        if (!mine && use.kind !== "free")
+            return fromProblem(portTakenProblem(want.httpsPort, use, target, freePort(now.serve, dnsName, want.httpsPort)), { suggestedPort: freePort(now.serve, dnsName, want.httpsPort) });
+        if (!mine) {
+            const on = await deps.run(tailscaleCommands.serveOn(want.httpsPort, target));
+            if (on.code !== 0)
+                return fromProblem(serveRefusedProblem(on, deps.platform));
+            record({ dnsName, httpsPort: want.httpsPort, target, ...ownerOf(now.machine) });
+        }
+        else if (before !== undefined &&
+            before.owner === undefined &&
+            now.machine.owner !== undefined)
+            record({ ...before, owner: now.machine.owner });
+        const after = await diagnose();
+        if (!ready(after))
+            return fromProblem(after);
+        const check = portUse(after.serve, dnsName, want.httpsPort);
+        if (check.kind !== "proxy" || !sameTarget(check.target, target))
+            return base("not-applied", "Tailscale accepted the command, but Slopify's address isn't in its serve settings.", {
+                fix: "Run tailscale serve status in a terminal to see what Tailscale has, then press Check again.",
+            });
+        if (check.funnel) {
+            await removeOurs(after);
+            return fromProblem(funnelProblem(want.httpsPort));
+        }
+        return onView(dnsName, want.httpsPort);
+    };
+    // A read: what is true now, without changing Tailscale.
+    const read = async () => {
+        if (deps.container)
+            return dockerView();
+        const want = saved();
+        if (!want.enabled)
+            return offView();
+        const now = await diagnose();
+        if (!ready(now))
+            return fromProblem(now);
+        const { dnsName } = now.machine;
+        const use = portUse(now.serve, dnsName, want.httpsPort);
+        const ours = store.applied();
+        if (ours !== undefined &&
+            ours.httpsPort === want.httpsPort &&
+            use.kind === "proxy" &&
+            sameTarget(use.target, ours.target))
+            return use.funnel
+                ? fromProblem(funnelProblem(want.httpsPort))
+                : onView(dnsName, want.httpsPort);
+        if (use.kind !== "free") {
+            const suggested = freePort(now.serve, dnsName, want.httpsPort);
+            return fromProblem(portTakenProblem(want.httpsPort, use, loopbackTarget(), suggested), {
+                suggestedPort: suggested,
+            });
+        }
+        return base("not-applied", "The switch is on, but Slopify's address isn't in Tailscale right now.", {
+            fix: "Press Check again to set it up again.",
+        });
+    };
+    // One change to Tailscale at a time.
+    let queue = Promise.resolve();
+    const serial = (work) => {
+        const next = queue.then(work, work);
+        queue = next.catch(() => undefined);
+        return next;
+    };
+    let cached;
+    const fresh = (view) => {
+        cached = { at: deps.now(), view };
+        view.catch(() => {
+            cached = undefined;
+        });
+        return view;
+    };
+    const turnOff = async () => {
+        if (store.applied() === undefined)
+            return offView();
+        const now = await diagnose();
+        const problem = ready(now) ? await removeOurs(now) : now;
+        if (problem === undefined)
+            return offView();
+        const port = store.applied()?.httpsPort ?? saved().httpsPort;
+        return fromProblem(problem, {
+            state: problem.state,
+            summary: `The switch is off, but Slopify couldn't remove its address from Tailscale yet: ${problem.summary} Slopify tries again at every start.`,
+            fix: `${problem.fix} Or remove it yourself with tailscale serve --https=${port} off.`,
+        });
+    };
+    return {
+        view: () => {
+            if (cached !== undefined && deps.now() - cached.at < cacheMs)
+                return cached.view;
+            return fresh(serial(read));
+        },
+        set: (enabled, httpsPort) => fresh(serial(async () => {
+            if (deps.container)
+                return dockerView();
+            store.save({ enabled, httpsPort: httpsPort ?? saved().httpsPort });
+            return enabled ? apply() : turnOff();
+        })),
+        start: () => serial(async () => {
+            cached = undefined;
+            if (deps.container)
+                return;
+            const view = saved().enabled ? await apply() : await turnOff();
+            if (view.state !== "on" && view.state !== "off")
+                deps.log.write("warn", "remote-access.start", {
+                    detail: `${view.summary} ${view.fix ?? ""}`,
+                });
+        }),
+        stop: () => serial(async () => {
+            cached = undefined;
+            if (deps.container || store.applied() === undefined)
+                return;
+            const now = await diagnose();
+            const problem = ready(now) ? await removeOurs(now) : now;
+            if (problem !== undefined)
+                deps.log.write("warn", "remote-access.stop", { detail: problem.summary });
+        }),
+        owner: () => store.applied()?.owner,
+        remoteHost: () => {
+            const ours = store.applied();
+            return ours === undefined
+                ? undefined
+                : ours.httpsPort === 443
+                    ? ours.dnsName
+                    : `${ours.dnsName}:${ours.httpsPort}`;
+        },
+    };
+}

package/dist/edge/remote-access/store.js

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import { deleteSetting, readSetting, writeSetting } from "../../slices/settings/repo.js";
+import { defaultHttpsPort, remoteAccessAppliedKey, remoteAccessKey } from "./model.js";
+// The two settings rows remote access keeps: the switch as the person set it, and the exact
+// serve handler Slopify added (removed again only when it is still exactly that).
+const savedShape = z.object({
+    enabled: z.boolean(),
+    httpsPort: z.number().int().min(1).max(65535),
+});
+const appliedShape = z.object({
+    dnsName: z.string(),
+    httpsPort: z.number().int(),
+    target: z.string(),
+    // The Tailscale account the computer was signed in to when Slopify added its address: the
+    // only one let in over the tailnet. Absent in what older versions saved.
+    owner: z.string().optional(),
+});
+function readJson(db, key, shape) {
+    const raw = readSetting(db, key);
+    if (raw === undefined)
+        return undefined;
+    try {
+        const parsed = shape.safeParse(JSON.parse(raw));
+        return parsed.success ? parsed.data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function remoteAccessStore(db) {
+    let applied = readJson(db, remoteAccessAppliedKey, appliedShape);
+    return {
+        saved: () => readJson(db, remoteAccessKey, savedShape) ?? { enabled: false, httpsPort: defaultHttpsPort },
+        applied: () => applied,
+        record: (next) => {
+            applied = next;
+            if (next === undefined)
+                deleteSetting(db, remoteAccessAppliedKey);
+            else
+                writeSetting(db, remoteAccessAppliedKey, JSON.stringify(next));
+        },
+        save: (next) => writeSetting(db, remoteAccessKey, JSON.stringify(next)),
+    };
+}

package/dist/edge/remote-access/views.js

@@ -0,0 +1,43 @@
+import { addressOf } from "./rules.js";
+export function remoteAccessViews(deps, saved) {
+    const loopbackTarget = () => {
+        const host = deps.listenHost;
+        const name = host === "" || host === "0.0.0.0" || host === "localhost" || host === "127.0.0.1"
+            ? "127.0.0.1"
+            : host === "::" || host === "::1"
+                ? "[::1]"
+                : host.includes(":")
+                    ? `[${host}]`
+                    : host;
+        return `http://${name}:${deps.port()}`;
+    };
+    const local = () => loopbackTarget();
+    const base = (state, summary, rest = {}) => ({
+        available: !deps.container,
+        enabled: saved().enabled,
+        state,
+        address: null,
+        httpsPort: saved().httpsPort,
+        suggestedPort: null,
+        summary,
+        fix: null,
+        link: null,
+        local: local(),
+        changeable: !deps.container,
+        ...rest,
+    });
+    const fromProblem = (problem, rest = {}) => base(problem.state, problem.summary, { fix: problem.fix, link: problem.link, ...rest });
+    const dockerView = () => base("docker", "Slopify runs in Docker here, so it can't set up Tailscale on the computer itself.", {
+        enabled: false,
+        fix: "Remote access needs Slopify started on the computer itself (npx @gentbajko/slopify). Or set Tailscale up yourself on the host: tailscale serve --bg --https=443 http://127.0.0.1:<Slopify's port>.",
+    });
+    const offView = () => base("off", `Off: Slopify answers only on this computer, at ${local()}.`);
+    const funnelProblem = (httpsPort) => ({
+        state: "funnel",
+        summary: "Tailscale Funnel was on for Slopify's address, which would put Slopify on the public internet. Slopify removed its address and refuses every request that comes through Funnel.",
+        fix: `Turn Funnel off with tailscale funnel --https=${httpsPort} off, then press Check again.`,
+        link: null,
+    });
+    const onView = (dnsName, httpsPort) => base("on", "On: any device in your tailnet can open this address, never the public internet. It works while Slopify runs: Slopify removes it when it stops and adds it back when it starts.", { address: addressOf(dnsName, httpsPort) });
+    return { loopbackTarget, base, fromProblem, dockerView, offView, funnelProblem, onView };
+}

package/dist/host-cli/install.js

@@ -2,9 +2,9 @@ import { execFile } from "node:child_process";
 import { access, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { z } from "zod";
+import { hasErrnoCode } from "../kernel/errors.js";
 import { isStableVersion, updatePackage } from "../updater/model.js";
 import { installArgs, npmCommand } from "../updater/plan.js";
-import { hasCode } from "./paths.js";
 export const nodeHostSetupRunner = {
     exec: (file, args, signal) => new Promise((resolve, reject) => {
         execFile(file, [...args], { signal, timeout: 15 * 60_000, maxBuffer: 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => {
@@ -55,7 +55,7 @@ export async function installHostPackage(options) {
         return { entry: await entryAt(directory, version) };
     }
     catch (error) {
-        if (!hasCode(error, "ENOENT"))
+        if (!hasErrnoCode(error, "ENOENT"))
             throw new Error(`The installed host helper in ${directory} is damaged. Delete that folder and run the launcher again. Nothing else was changed.`);
     }
     await mkdir(versions, { recursive: true, mode: 0o700 });

package/dist/host-cli/open-folder.js

@@ -2,8 +2,8 @@ import { spawn } from "node:child_process";
 import { lstat, readdir } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
 import { installSchema, readState } from "../edge/docker-install/state.js";
+import { hasErrnoCode } from "../kernel/errors.js";
 import { HostFolderRefused } from "../kernel/ports/host-cli.js";
-import { hasCode } from "./paths.js";
 const again = "run the Docker install again (npx @gentbajko/slopify@latest --docker)";
 /** Starts the desktop's opener and returns once it is running; the file manager is not awaited. */
 export function launchXdgOpen(directory) {
@@ -14,7 +14,7 @@ export function launchXdgOpen(directory) {
             stdio: "ignore",
         });
         child.once("error", (error) => {
-            reject(new Error(hasCode(error, "ENOENT")
+            reject(new Error(hasErrnoCode(error, "ENOENT")
                 ? "xdg-open isn't installed on this machine, so the Slopify host helper can't open a file manager. Install xdg-utils (for example sudo pacman -S xdg-utils or sudo apt install xdg-utils), then use Open folder again."
                 : `The Slopify host helper could not start xdg-open to open ${directory}. Check that you are signed in to this computer's desktop, then use Open folder again.`));
         });

package/dist/host-cli/paths.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { constants } from "node:fs";
 import { chmod, lstat, mkdir, open } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
+import { hasErrnoCode } from "../kernel/errors.js";
 export async function prepareHostPaths(root) {
     if (!isAbsolute(root) || /[\p{Cc}]/u.test(root))
         throw new Error(`Unsafe host helper directory ${JSON.stringify(root)}: it must be a full path. Check XDG_DATA_HOME and HOME, then run the launcher again.`);
@@ -55,7 +56,7 @@ export async function ensureBridgeToken(path) {
         }
     }
     catch (error) {
-        if (!hasCode(error, "EEXIST"))
+        if (!hasErrnoCode(error, "EEXIST"))
             throw error;
     }
     const entry = await lstat(path);
@@ -63,6 +64,3 @@ export async function ensureBridgeToken(path) {
         throw new Error(`The host helper token file ${path} is a link or belongs to another user. Delete it and run the launcher again.`);
     return readBridgeToken(path);
 }
-export function hasCode(error, code) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}

package/dist/host-cli/server.js

@@ -4,7 +4,7 @@ import { connect } from "node:net";
 import { join } from "node:path";
 import { createAdaptorServer } from "@hono/node-server";
 import { hostCliRoutes, hostGate } from "../edge/http/host-cli.js";
-import { hasCode } from "./paths.js";
+import { hasErrnoCode } from "../kernel/errors.js";
 export async function startHostServer(options) {
     const socket = join(options.directory, "cli.sock");
     if (Buffer.byteLength(socket) > 100)
@@ -23,7 +23,7 @@ export async function startHostServer(options) {
         await unlink(socket);
     }
     catch (error) {
-        if (!hasCode(error, "ENOENT"))
+        if (!hasErrnoCode(error, "ENOENT"))
             throw error;
     }
     const gate = hostGate();
@@ -67,7 +67,7 @@ export async function startHostServer(options) {
                         await unlink(socket);
                 }
                 catch (error) {
-                    if (!hasCode(error, "ENOENT"))
+                    if (!hasErrnoCode(error, "ENOENT"))
                         throw error;
                 }
             })();
@@ -89,7 +89,7 @@ function listening(path) {
         });
         socket.once("error", (error) => {
             socket.destroy();
-            if (hasCode(error, "ECONNREFUSED"))
+            if (hasErrnoCode(error, "ECONNREFUSED"))
                 resolve(false);
             else
                 reject(new Error("Could not verify existing host socket."));

package/dist/host-cli/service.js

@@ -3,9 +3,9 @@ import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { hostRequest, readHostBytes } from "../adapters/host-cli/transport.js";
+import { hasErrnoCode } from "../kernel/errors.js";
 import { bridgeLimits, hostHealthSchema } from "../kernel/ports/host-cli.js";
 import { hostEnvironment } from "./environment.js";
-import { hasCode } from "./paths.js";
 const marker = "# Managed by Slopify host CLI bridge, protocol 1";
 export const hostUnit = "slopify-cli-bridge.service";
 function unitArg(value) {
@@ -51,7 +51,7 @@ export async function privateRead(path, uid) {
         }
     }
     catch (error) {
-        if (hasCode(error, "ENOENT"))
+        if (hasErrnoCode(error, "ENOENT"))
             return undefined;
         throw error;
     }
@@ -71,7 +71,7 @@ export async function privateWrite(path, text) {
     }
     finally {
         await unlink(temporary).catch((error) => {
-            if (!hasCode(error, "ENOENT"))
+            if (!hasErrnoCode(error, "ENOENT"))
                 throw error;
         });
     }

package/dist/host-cli/status.js

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { parseAntigravityModels } from "../adapters/llm/antigravity-models.js";
 import { cliLoginError } from "../adapters/llm/cli-login-error.js";
 import { cliCommand } from "../kernel/cli-command.js";
+import { errorText, hasErrnoCode } from "../kernel/errors.js";
 import { cliProbeTimeoutMs, readinessFromProbe, } from "../slices/settings/cli-status.js";
 export function hostCommandName(id) {
     if (id === "claude-code")
@@ -25,7 +26,9 @@ export async function resolveHostCommand(id, env) {
                 return path;
         }
         catch (error) {
-            if (!isCode(error, "ENOENT") && !isCode(error, "ENOTDIR") && !isCode(error, "EACCES"))
+            if (!hasErrnoCode(error, "ENOENT") &&
+                !hasErrnoCode(error, "ENOTDIR") &&
+                !hasErrnoCode(error, "EACCES"))
                 throw error;
         }
     }
@@ -89,10 +92,10 @@ export function createHostStatus(deps) {
                 command: hostCommandName(id),
                 installed: false,
                 login: "unknown",
-                issueKind: isCode(error, "ENOENT") ? "missing" : "bridge",
-                issue: isCode(error, "ENOENT")
+                issueKind: hasErrnoCode(error, "ENOENT") ? "missing" : "bridge",
+                issue: hasErrnoCode(error, "ENOENT")
                     ? `${hostCommandName(id)} was not found on this machine. Install it and sign in there, then run the launcher again: npx @gentbajko/slopify --docker`
-                    : `Slopify could not check for ${hostCommandName(id)} on this machine (${error instanceof Error ? error.message : String(error)}). Fix the problem, then run the launcher again: npx @gentbajko/slopify --docker`,
+                    : `Slopify could not check for ${hostCommandName(id)} on this machine (${errorText(error)}). Fix the problem, then run the launcher again: npx @gentbajko/slopify --docker`,
             };
         }
         const readiness = readinessFromProbe(await deps.probe(command, ["--version"], cliProbeTimeoutMs), {
@@ -149,6 +152,3 @@ export function createHostStatus(deps) {
         return { ...(await entry.value), id };
     };
 }
-function isCode(error, code) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}

package/dist/kernel/db/migrations/0063-model-checks.sql

@@ -0,0 +1,20 @@
+-- What Settings → Models and the pickers know about each model for the person's own key or
+-- CLI login (`slices/model-checks`): whether the key's live list names it, and the last check
+-- or real run's verdict. Only pickers read it; no run does. `account` is the key generation or
+-- the CLI's id, so a new key starts every row over.
+CREATE TABLE model_checks (
+ provider TEXT NOT NULL,
+ family TEXT NOT NULL CHECK (family IN ('llm','tts','image')),
+ model TEXT NOT NULL,
+ account TEXT NOT NULL,
+ listed INTEGER CHECK (listed IN (0,1)),
+ listed_at TEXT,
+ verdict TEXT CHECK (verdict IN ('works','no-access','failed')),
+ verdict_source TEXT CHECK (verdict_source IN ('check','run')),
+ sentence TEXT,
+ checked_at TEXT,
+ cost REAL NOT NULL DEFAULT 0,
+ first_works_at TEXT,
+ notice_seen INTEGER NOT NULL DEFAULT 0 CHECK (notice_seen IN (0,1)),
+ PRIMARY KEY(provider, family, model)
+);

package/dist/kernel/db/migrations/0064-template-studio.sql

@@ -0,0 +1,46 @@
+-- Template studio (4.0, `slices/template-studio`). A version is runnable by schedules when its
+-- gate is ready, carried (a system writer copied a runnable gate) or legacy (saved before the
+-- studio). A version with no row was never checked.
+CREATE TABLE template_gates (
+ template_id TEXT NOT NULL,
+ version INTEGER NOT NULL CHECK(version >= 1),
+ state TEXT NOT NULL CHECK(state IN ('legacy','ready','carried')),
+ carried_from INTEGER CHECK(carried_from IS NULL OR carried_from >= 1),
+ checks_json TEXT CHECK(checks_json IS NULL OR json_valid(checks_json)),
+ marked_at TEXT,
+ PRIMARY KEY(template_id, version),
+ FOREIGN KEY(template_id, version) REFERENCES project_template_revisions(template_id, version) ON DELETE CASCADE
+);
+INSERT INTO template_gates (template_id, version, state)
+ SELECT template_id, version, 'legacy' FROM project_template_revisions;
+-- The hidden project each template's samples are made on. It never appears in a list the user
+-- sees (`notTemplateSample`), and its project may be gone: the next sample makes it again.
+CREATE TABLE template_samples (
+ template_id TEXT PRIMARY KEY REFERENCES project_templates(id) ON DELETE CASCADE,
+ project_id TEXT NOT NULL UNIQUE,
+ topic TEXT NOT NULL CHECK(length(trim(topic)) BETWEEN 1 AND 300),
+ topic_source TEXT NOT NULL CHECK(topic_source IN ('fixed','queued')),
+ full_script INTEGER NOT NULL DEFAULT 0 CHECK(full_script IN (0,1)),
+ created_at TEXT NOT NULL
+);
+CREATE TABLE template_sample_versions (
+ template_id TEXT NOT NULL REFERENCES project_templates(id) ON DELETE CASCADE,
+ template_version INTEGER NOT NULL CHECK(template_version >= 1),
+ revision_id TEXT,
+ state TEXT NOT NULL CHECK(state IN ('queued','making','done','failed','skipped','held')),
+ quoted_high REAL,
+ held_reason TEXT,
+ updated_at TEXT NOT NULL,
+ PRIMARY KEY(template_id, template_version)
+);
+-- At most one queued and one running sample job per template: a newer Save replaces the queued
+-- one and waits behind the running one, which is never stopped.
+CREATE TABLE template_sample_jobs (
+ template_id TEXT NOT NULL REFERENCES project_templates(id) ON DELETE CASCADE,
+ template_version INTEGER NOT NULL CHECK(template_version >= 1),
+ ack_high REAL NOT NULL DEFAULT 0 CHECK(ack_high >= 0),
+ kind TEXT NOT NULL CHECK(kind IN ('save','topic','full-script','bakeoff','free')),
+ requested_at TEXT NOT NULL,
+ state TEXT NOT NULL CHECK(state IN ('queued','running')),
+ PRIMARY KEY(template_id, state)
+);

package/dist/kernel/db/migrations/0065-promise-and-assistant-reviews.sql

@@ -0,0 +1,58 @@
+-- The promise check is a review stage of its own (`reviews/model.ts`), and the in-app assistant
+-- acts on and answers reviews as itself rather than as an agent. SQLite cannot change a CHECK in
+-- place, so both tables are copied, as 0055 and 0059 did.
+CREATE TABLE review_verdicts_promise_upgrade (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ revision_id TEXT NOT NULL,
+ item_key TEXT NOT NULL,
+ stage TEXT NOT NULL CHECK(stage IN ('article','images','narration','thumbnail','shorts','promise')),
+ item_fingerprint TEXT NOT NULL,
+ review_fingerprint TEXT NOT NULL,
+ passed INTEGER NOT NULL CHECK(passed IN (0,1)),
+ reasons TEXT NOT NULL,
+ outcome TEXT NOT NULL CHECK(outcome IN ('passed','flagged','redo','auto-passed')),
+ attempt INTEGER NOT NULL CHECK(attempt >= 1),
+ action TEXT CHECK(action IN ('overruled','redone')),
+ action_at TEXT,
+ action_by TEXT CHECK(action_by IN ('person','agent','assistant')),
+ redo_state TEXT CHECK(redo_state IN ('pending','started','failed')),
+ redo_error TEXT,
+ answered_by TEXT NOT NULL DEFAULT 'model' CHECK(answered_by IN ('model','agent','person','nobody')),
+ created_at TEXT NOT NULL,
+ UNIQUE(project_id,review_fingerprint)
+);
+INSERT INTO review_verdicts_promise_upgrade (id,project_id,revision_id,item_key,stage,item_fingerprint,review_fingerprint,passed,reasons,outcome,attempt,action,action_at,action_by,redo_state,redo_error,answered_by,created_at)
+  SELECT id,project_id,revision_id,item_key,stage,item_fingerprint,review_fingerprint,passed,reasons,outcome,attempt,action,action_at,action_by,redo_state,redo_error,answered_by,created_at
+  FROM review_verdicts ORDER BY rowid;
+DROP TABLE review_verdicts;
+ALTER TABLE review_verdicts_promise_upgrade RENAME TO review_verdicts;
+CREATE INDEX review_verdicts_item ON review_verdicts(project_id,item_key);
+CREATE INDEX review_verdicts_redo ON review_verdicts(redo_state);
+
+CREATE TABLE external_reviews_promise_upgrade (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ revision_id TEXT NOT NULL,
+ work_id TEXT NOT NULL,
+ piece_id TEXT NOT NULL,
+ work_key TEXT NOT NULL,
+ item_key TEXT NOT NULL,
+ stage TEXT NOT NULL CHECK(stage IN ('article','images','narration','thumbnail','shorts','promise')),
+ item_fingerprint TEXT NOT NULL,
+ review_fingerprint TEXT NOT NULL,
+ material TEXT NOT NULL CHECK(json_valid(material)),
+ state TEXT NOT NULL CHECK(state IN ('waiting','answered','auto-passed','superseded','canceled')),
+ waiting_since TEXT NOT NULL,
+ deadline_at TEXT NOT NULL,
+ verdict TEXT CHECK(verdict IS NULL OR json_valid(verdict)),
+ answered_by TEXT CHECK(answered_by IN ('person','agent','assistant')),
+ answered_at TEXT,
+ UNIQUE(project_id,review_fingerprint)
+);
+INSERT INTO external_reviews_promise_upgrade (id,project_id,revision_id,work_id,piece_id,work_key,item_key,stage,item_fingerprint,review_fingerprint,material,state,waiting_since,deadline_at,verdict,answered_by,answered_at)
+  SELECT id,project_id,revision_id,work_id,piece_id,work_key,item_key,stage,item_fingerprint,review_fingerprint,material,state,waiting_since,deadline_at,verdict,answered_by,answered_at
+  FROM external_reviews ORDER BY rowid;
+DROP TABLE external_reviews;
+ALTER TABLE external_reviews_promise_upgrade RENAME TO external_reviews;
+CREATE INDEX external_reviews_waiting ON external_reviews(state, deadline_at);

package/dist/kernel/db/migrations/0066-assistant.sql

@@ -0,0 +1,44 @@
+-- The in-app assistant acts through the same API as an agent but is told apart: its changes
+-- show "by assistant", and it can start a project's work. Its chat is kept per session, each
+-- turn replayed to a fresh CLI, and what it asked the person first ("Ask first") is kept with
+-- the person's answer, which a later call may use once. SQLite cannot change a CHECK in place,
+-- so project_starts is copied, as 0055 did.
+ALTER TABLE agent_actions ADD COLUMN actor TEXT NOT NULL DEFAULT 'agent' CHECK(actor IN ('agent','assistant'));
+
+CREATE TABLE project_starts_assistant_upgrade (
+ project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+ actor TEXT NOT NULL CHECK(actor IN ('person','agent','assistant')),
+ started_at TEXT NOT NULL
+);
+INSERT INTO project_starts_assistant_upgrade (project_id,actor,started_at)
+  SELECT project_id,actor,started_at FROM project_starts ORDER BY rowid;
+DROP TABLE project_starts;
+ALTER TABLE project_starts_assistant_upgrade RENAME TO project_starts;
+
+CREATE TABLE assistant_sessions (
+ id TEXT PRIMARY KEY,
+ cli TEXT NOT NULL,
+ created_at TEXT NOT NULL,
+ updated_at TEXT NOT NULL
+);
+CREATE TABLE assistant_messages (
+ id TEXT PRIMARY KEY,
+ session_id TEXT NOT NULL REFERENCES assistant_sessions(id) ON DELETE CASCADE,
+ turn_id TEXT NOT NULL,
+ role TEXT NOT NULL CHECK(role IN ('person','assistant','tool','ask','error')),
+ text TEXT NOT NULL,
+ meta TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(meta)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX assistant_messages_session ON assistant_messages(session_id, created_at);
+CREATE TABLE assistant_asks (
+ id TEXT PRIMARY KEY,
+ session_id TEXT NOT NULL REFERENCES assistant_sessions(id) ON DELETE CASCADE,
+ tool TEXT NOT NULL,
+ args_hash TEXT NOT NULL,
+ text TEXT NOT NULL,
+ state TEXT NOT NULL CHECK(state IN ('asked','allowed','denied','used','expired')),
+ created_at TEXT NOT NULL,
+ decided_at TEXT
+);
+CREATE INDEX assistant_asks_session ON assistant_asks(session_id, state);

package/dist/kernel/db/migrations/0067-autopilot.sql

@@ -0,0 +1,6 @@
+-- Autopilot warnings the person hid on Home (`slices/autopilot/repo.ts`), each until its week is
+-- up; a warning that changes has a new key and shows again.
+CREATE TABLE autopilot_snoozes (
+ warning_key TEXT PRIMARY KEY,
+ until TEXT NOT NULL
+);