@lelouchhe/webagent 0.7.0 → 0.9.0

package/lib/session-state.js

@@ -1,12 +1,14 @@
 /**
  * Per-session runtime state: single source of truth for "what state is this
- * session in right now" (busy / streaming / pending permissions).
+ * session in right now" (busy / streaming / pending permissions / plan).
  *
  * The frontend fetches a full snapshot on connect / reconnect / after long
  * backgrounding, then applies incremental `state_patch` SSE events. This
  * replaces the old "replay history + reconcile" approach which repeatedly
  * grew one-off sync paths per state field.
  */
+import { log } from "./log.js";
+const clog = log.scope("cancel");
 function defaultState() {
     return {
         seq: 0,
@@ -14,6 +16,8 @@ function defaultState() {
             busy: null,
             pendingPermissions: [],
             streaming: { assistant: false, thinking: false },
+            plan: null,
+            contextUsage: null,
         },
     };
 }
@@ -22,7 +26,10 @@ function busyEqual(a, b) {
         return true;
     if (a === null || b === null)
         return false;
-    return a.kind === b.kind && a.since === b.since && a.promptId === b.promptId;
+    return (a.kind === b.kind &&
+        a.since === b.since &&
+        a.promptId === b.promptId &&
+        (a.cancelStatus ?? null) === (b.cancelStatus ?? null));
 }
 function permsEqual(a, b) {
     if (a.length !== b.length)
@@ -43,6 +50,21 @@ function permsEqual(a, b) {
     }
     return true;
 }
+function plansEqual(a, b) {
+    if (a === null || b === null)
+        return a === b;
+    if (a.length !== b.length)
+        return false;
+    return a.every((entry, index) => entry.status === b[index].status && entry.content === b[index].content);
+}
+function contextUsageEqual(a, b) {
+    if (a === null || b === null)
+        return a === b;
+    return (a.used === b.used &&
+        a.size === b.size &&
+        (a.cost?.amount ?? null) === (b.cost?.amount ?? null) &&
+        (a.cost?.currency ?? null) === (b.cost?.currency ?? null));
+}
 /** True when the patch would change the current runtime state. */
 function hasRuntimeChanges(current, patch) {
     if (!patch)
@@ -53,6 +75,11 @@ function hasRuntimeChanges(current, patch) {
         patch.pendingPermissions &&
         !permsEqual(current.pendingPermissions, patch.pendingPermissions))
         return true;
+    if ("plan" in patch && !plansEqual(current.plan, patch.plan ?? null))
+        return true;
+    if ("contextUsage" in patch &&
+        !contextUsageEqual(current.contextUsage, patch.contextUsage ?? null))
+        return true;
     if ("streaming" in patch && patch.streaming) {
         const s = patch.streaming;
         if (s.assistant !== undefined &&
@@ -76,6 +103,11 @@ export class SessionStateManager {
         }
         return s;
     }
+    /** Read streaming state without creating runtime state for an unseen session. */
+    peekStreaming(sessionId) {
+        const streaming = this.states.get(sessionId)?.runtime.streaming;
+        return streaming ? { ...streaming } : { assistant: false, thinking: false };
+    }
     /**
      * Merge a patch into the session's runtime state. Bumps seq and notifies
      * listeners only when the patch actually changes something (no-op patches
@@ -95,6 +127,19 @@ export class SessionStateManager {
                 state.runtime.pendingPermissions =
                     patch.runtime.pendingPermissions.slice();
             }
+            if ("plan" in patch.runtime) {
+                state.runtime.plan =
+                    patch.runtime.plan?.map((entry) => ({ ...entry })) ?? null;
+            }
+            if ("contextUsage" in patch.runtime) {
+                const usage = patch.runtime.contextUsage;
+                state.runtime.contextUsage = usage
+                    ? {
+                        ...usage,
+                        ...(usage.cost ? { cost: { ...usage.cost } } : {}),
+                    }
+                    : null;
+            }
             if ("streaming" in patch.runtime && patch.runtime.streaming) {
                 if (patch.runtime.streaming.assistant !== undefined) {
                     state.runtime.streaming.assistant = patch.runtime.streaming.assistant;
@@ -130,9 +175,38 @@ export class SessionStateManager {
             this.cancelTimers.delete(sessionId);
         }
     }
+    /** Clear current plans for every known session (used on bridge reload). */
+    clearPlans() {
+        for (const [sessionId, state] of this.states) {
+            if (state.runtime.plan !== null) {
+                this.patch(sessionId, { runtime: { plan: null } });
+            }
+        }
+    }
+    /** Clear context usage for every known session on bridge teardown. */
+    clearContextUsage() {
+        for (const [sessionId, state] of this.states) {
+            if (state.runtime.contextUsage !== null) {
+                this.patch(sessionId, { runtime: { contextUsage: null } });
+            }
+        }
+    }
+    /** Clear active stream markers for every known session on bridge teardown. */
+    clearStreaming() {
+        for (const [sessionId, state] of this.states) {
+            if (state.runtime.streaming.assistant ||
+                state.runtime.streaming.thinking) {
+                this.patch(sessionId, {
+                    runtime: {
+                        streaming: { assistant: false, thinking: false },
+                    },
+                });
+            }
+        }
+    }
     /**
-     * Backend safety net for cancel: if busy is still set after `timeoutMs`,
-     * force-clear it. Replaces the old frontend cancel timer.
+     * Backend acknowledgement timer for cancel: if the same agent prompt is
+     * still pending after `timeoutMs`, mark the request unconfirmed.
      * A second arm on the same session replaces the existing timer.
      */
     armCancelSafety(sessionId, timeoutMs) {
@@ -143,12 +217,32 @@ export class SessionStateManager {
             clearTimeout(existing);
         const t = setTimeout(() => {
             this.cancelTimers.delete(sessionId);
-            this.patch(sessionId, { runtime: { busy: null } });
+            const busy = this.getState(sessionId).runtime.busy;
+            if (busy?.kind === "agent" && busy.cancelStatus === "requested") {
+                clog.warn("agent did not acknowledge", {
+                    sessionId: sessionId.slice(0, 8),
+                    promptId: busy.promptId,
+                });
+                this.patch(sessionId, {
+                    runtime: {
+                        busy: { ...busy, cancelStatus: "unconfirmed" },
+                    },
+                });
+            }
         }, timeoutMs);
         if (typeof t === "object" && "unref" in t)
             t.unref();
         this.cancelTimers.set(sessionId, t);
     }
+    /** Mark that a cancel notification was sent for the active agent prompt. */
+    markCancelRequested(sessionId) {
+        const busy = this.getState(sessionId).runtime.busy;
+        if (busy?.kind !== "agent")
+            return;
+        this.patch(sessionId, {
+            runtime: { busy: { ...busy, cancelStatus: "requested" } },
+        });
+    }
     /** Cancel the safety net timer (e.g. when prompt_done arrives naturally). */
     clearCancelSafety(sessionId) {
         const t = this.cancelTimers.get(sessionId);

package/lib/share/routes.js

@@ -444,6 +444,10 @@ async function handlePublish(req, res, deps, sessionId) {
         json(res, HTTP_STATUS.BAD_REQUEST, { error: "token required" });
         return;
     }
+    if (!deps.store.ownsSession(sessionId)) {
+        json(res, HTTP_STATUS.NOT_FOUND, { error: "share not found" });
+        return;
+    }
     const row = deps.store.getShareByToken(body.token);
     if (!row) {
         json(res, HTTP_STATUS.NOT_FOUND, { error: "share not found" });
@@ -849,6 +853,10 @@ async function handleRevoke(req, res, deps, sessionId) {
         json(res, HTTP_STATUS.BAD_REQUEST, { error: "token required" });
         return;
     }
+    if (!deps.store.ownsSession(sessionId)) {
+        json(res, HTTP_STATUS.NOT_FOUND, { error: "share not found" });
+        return;
+    }
     const row = deps.store.getShareByToken(body.token);
     if (!row) {
         // Idempotent DELETE: row already gone (revoked or never existed).
@@ -910,6 +918,10 @@ async function handlePatchLabel(req, res, deps, sessionId) {
         json(res, HTTP_STATUS.BAD_REQUEST, { error: "token required" });
         return;
     }
+    if (!deps.store.ownsSession(sessionId)) {
+        json(res, HTTP_STATUS.NOT_FOUND, { error: "share not found" });
+        return;
+    }
     const row = deps.store.getShareByToken(body.token);
     if (!row) {
         json(res, HTTP_STATUS.NOT_FOUND, { error: "share not found" });

package/lib/sse-manager.js

@@ -1,6 +1,8 @@
 import { randomBytes } from "node:crypto";
 import { reSignAttachmentUrlsInJson } from "./auth.js";
 import { enrichEventForDisplay } from "./attachment-labels.js";
+import { log } from "./log.js";
+const slog = log.scope("sse");
 /**
  * SSE heartbeat frame — a NAMED event so the frontend can hook
  * `es.addEventListener("heartbeat", ...)` and refresh its per-session
@@ -69,7 +71,7 @@ export class SseManager {
                     catch {
                         /* already torn down */
                     }
-                    this.remove(client.id);
+                    this.remove(client.id, "token-revoked");
                     continue;
                 }
                 client.res.write(SSE_HEARTBEAT_FRAME);
@@ -91,8 +93,13 @@ export class SseManager {
     /** Register a new SSE client connection. */
     add(client) {
         this.clients.set(client.id, client);
+        slog.info("connected", {
+            clientId: client.id,
+            sessionId: client.sessionId ?? "*",
+            clients: this.clients.size,
+        });
         client.res.on("close", () => {
-            this.remove(client.id);
+            this.remove(client.id, "closed");
         });
     }
     /** Write a single heartbeat frame to the given client. Used right after
@@ -109,9 +116,16 @@ export class SseManager {
             // socket already dead; res.on("close") will clean up
         }
     }
-    /** Remove a client by ID. */
-    remove(id) {
-        this.clients.delete(id);
+    /** Remove a client by ID. `reason` is recorded so an operator can tell an
+     *  ordinary disconnect apart from a write failure or a revoked token. */
+    remove(id, reason = "closed") {
+        if (this.clients.delete(id)) {
+            slog.info("disconnected", {
+                clientId: id,
+                reason,
+                clients: this.clients.size,
+            });
+        }
         this.onRemoveCallback?.(id);
     }
     /** Send an SSE event to a single client. */
@@ -138,10 +152,11 @@ export class SseManager {
         try {
             client.res.write(msg);
         }
-        catch {
+        catch (err) {
             // Socket torn down between writableEnded check and write.
             // Drop the client so we stop writing to it on every broadcast.
-            this.remove(client.id);
+            slog.warn("write failed", { clientId: client.id, err: String(err) });
+            this.remove(client.id, "write-failed");
         }
     }
     /**
@@ -159,6 +174,15 @@ export class SseManager {
             this.sendEvent(client, event);
         }
     }
+    /** Broadcast global application state regardless of a client's session filter. */
+    broadcastGlobal(event) {
+        const snapshot = [...this.clients.values()];
+        for (const client of snapshot) {
+            if (client.res.writableEnded)
+                continue;
+            this.sendEvent(client, event);
+        }
+    }
     /** Get count of connected clients. */
     get size() {
         return this.clients.size;

package/lib/store.js

@@ -1,9 +1,19 @@
 import Database from "better-sqlite3";
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
+export class MessageNotFoundError extends Error {
+    constructor(messageId) {
+        super(`Message not found: ${messageId}`);
+        this.name = "MessageNotFoundError";
+    }
+}
 export class Store {
     db;
-    constructor(dataDir) {
+    agentKey;
+    constructor(dataDir, agentKey) {
+        if (!agentKey)
+            throw new Error("agentKey is required");
+        this.agentKey = agentKey;
         mkdirSync(dataDir, { recursive: true });
         this.db = new Database(join(dataDir, "webagent.db"));
         this.db.pragma("journal_mode = WAL");
@@ -21,6 +31,16 @@ export class Store {
         created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f', 'now')),
         last_active_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f', 'now'))
       );
+      CREATE TABLE IF NOT EXISTS agent_sessions (
+        agent_key TEXT NOT NULL,
+        agent_session_id TEXT NOT NULL,
+        web_session_id TEXT REFERENCES sessions(id) ON DELETE CASCADE,
+        created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f', 'now')),
+        PRIMARY KEY (agent_key, agent_session_id)
+      );
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_sessions_web
+        ON agent_sessions(web_session_id)
+        WHERE web_session_id IS NOT NULL;
       CREATE TABLE IF NOT EXISTS events (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         session_id TEXT NOT NULL REFERENCES sessions(id),
@@ -64,11 +84,26 @@ export class Store {
         if (!colNames.has("deleted_at")) {
             this.db.exec("ALTER TABLE sessions ADD COLUMN deleted_at INTEGER");
         }
+        // One-time dual-ID migration. Existing WebAgent session IDs were also the
+        // ACP agent's IDs, so preserve the public IDs and record that identity
+        // mapping under the agent command active during the upgrade.
+        this.db
+            .prepare(`
+        INSERT INTO agent_sessions (
+          agent_key, agent_session_id, web_session_id, created_at
+        )
+        SELECT ?, s.id, s.id, s.created_at
+        FROM sessions s
+        WHERE NOT EXISTS (
+          SELECT 1 FROM agent_sessions a WHERE a.web_session_id = s.id
+        )
+      `)
+            .run(this.agentKey);
         // messages — pending unbound notifications. POST /api/v1/messages with
         // `to = "user"` lands here; consumeMessageTx transactionally moves the
-        // content into a new session's events and deletes the row. Bound
-        // messages (to = session id) skip this table entirely and go straight
-        // to `events`.
+        // content into an existing ACP-backed session's events and deletes the
+        // row. Bound messages (to = session id) skip this table entirely and go
+        // straight to `events`.
         this.db.exec(`
       CREATE TABLE IF NOT EXISTS messages (
         id              TEXT PRIMARY KEY,
@@ -241,29 +276,72 @@ export class Store {
       );
     `);
     }
-    createSession(id, cwd, source = "auto") {
-        this.db
-            .prepare("INSERT INTO sessions (id, cwd, source) VALUES (?, ?, ?)")
-            .run(id, cwd, source);
-        return this.db
-            .prepare("SELECT * FROM sessions WHERE id = ?")
-            .get(id);
+    createSession(id, cwd, source = "auto", agentSessionId = id) {
+        return this.db.transaction(() => {
+            this.db
+                .prepare("INSERT INTO sessions (id, cwd, source) VALUES (?, ?, ?)")
+                .run(id, cwd, source);
+            this.db
+                .prepare("INSERT INTO agent_sessions (agent_key, agent_session_id, web_session_id) VALUES (?, ?, ?)")
+                .run(this.agentKey, agentSessionId, id);
+            return this.db
+                .prepare("SELECT * FROM sessions WHERE id = ?")
+                .get(id);
+        })();
     }
     listSessions(opts) {
         if (opts?.source) {
             return this.db
-                .prepare("SELECT * FROM sessions WHERE source = ? AND deleted_at IS NULL ORDER BY COALESCE(last_active_at, created_at) DESC")
-                .all(opts.source);
+                .prepare(`SELECT s.* FROM sessions s
+           JOIN agent_sessions a ON a.web_session_id = s.id
+           WHERE a.agent_key = ? AND s.source = ? AND s.deleted_at IS NULL
+           ORDER BY COALESCE(s.last_active_at, s.created_at) DESC`)
+                .all(this.agentKey, opts.source);
         }
         return this.db
-            .prepare("SELECT * FROM sessions WHERE deleted_at IS NULL ORDER BY COALESCE(last_active_at, created_at) DESC")
-            .all();
+            .prepare(`SELECT s.* FROM sessions s
+         JOIN agent_sessions a ON a.web_session_id = s.id
+         WHERE a.agent_key = ? AND s.deleted_at IS NULL
+         ORDER BY COALESCE(s.last_active_at, s.created_at) DESC`)
+            .all(this.agentKey);
     }
     /** Returns live sessions only. Soft-deleted (tombstone) rows are hidden. */
     getSession(id) {
         return this.db
-            .prepare("SELECT * FROM sessions WHERE id = ? AND deleted_at IS NULL")
-            .get(id);
+            .prepare(`SELECT s.* FROM sessions s
+         JOIN agent_sessions a ON a.web_session_id = s.id
+         WHERE s.id = ? AND a.agent_key = ? AND s.deleted_at IS NULL`)
+            .get(id, this.agentKey);
+    }
+    registerInternalAgentSession(agentSessionId) {
+        this.db
+            .prepare("INSERT OR IGNORE INTO agent_sessions (agent_key, agent_session_id, web_session_id) VALUES (?, ?, NULL)")
+            .run(this.agentKey, agentSessionId);
+        const row = this.db
+            .prepare("SELECT * FROM agent_sessions WHERE agent_key = ? AND agent_session_id = ?")
+            .get(this.agentKey, agentSessionId);
+        if (row.web_session_id) {
+            throw new Error("Agent reused a user-visible session ID internally");
+        }
+        return row;
+    }
+    getAgentSessionId(webSessionId) {
+        return this.db
+            .prepare("SELECT agent_session_id FROM agent_sessions WHERE agent_key = ? AND web_session_id = ?")
+            .get(this.agentKey, webSessionId)?.agent_session_id;
+    }
+    getWebSessionId(agentSessionId) {
+        return this.db
+            .prepare("SELECT web_session_id FROM agent_sessions WHERE agent_key = ? AND agent_session_id = ? AND web_session_id IS NOT NULL")
+            .get(this.agentKey, agentSessionId)?.web_session_id;
+    }
+    getAgentSessionBinding(webSessionId) {
+        return this.db
+            .prepare("SELECT * FROM agent_sessions WHERE agent_key = ? AND web_session_id = ?")
+            .get(this.agentKey, webSessionId);
+    }
+    ownsSession(webSessionId) {
+        return this.getAgentSessionBinding(webSessionId) !== undefined;
     }
     /**
      * Returns a session row even if soft-deleted. Used by the public share
@@ -333,11 +411,14 @@ export class Store {
         const empties = this.db
             .prepare(`
       SELECT s.id FROM sessions s
+      JOIN agent_sessions a ON a.web_session_id = s.id
       LEFT JOIN events e ON e.session_id = s.id
       WHERE e.id IS NULL
+        AND a.agent_key = ?
+        AND s.deleted_at IS NULL
         AND strftime('%s', 'now') - strftime('%s', s.created_at) >= ?
     `)
-            .all(minAgeS);
+            .all(this.agentKey, minAgeS);
         if (empties.length === 0)
             return [];
         const del = this.db.prepare("DELETE FROM sessions WHERE id = ?");
@@ -361,6 +442,7 @@ export class Store {
             model: "model",
             mode: "mode",
             reasoning_effort: "reasoning_effort",
+            thought_level: "reasoning_effort",
         }[configId];
         if (!column)
             return;
@@ -429,14 +511,17 @@ export class Store {
             .get(sessionId);
         return row.seq;
     }
-    /** Check if the most recent agent turn was interrupted (user_message without a following prompt_done). */
+    /** Check if the most recent agent turn lacks a completion or error terminal event. */
     hasInterruptedTurn(sessionId) {
         const row = this.db
             .prepare(`
       SELECT 1 FROM events
       WHERE session_id = ? AND type = 'user_message'
         AND seq > COALESCE(
-          (SELECT MAX(seq) FROM events WHERE session_id = ? AND type = 'prompt_done'),
+          (
+            SELECT MAX(seq) FROM events
+            WHERE session_id = ? AND type IN ('prompt_done', 'error')
+          ),
           0
         )
       LIMIT 1
@@ -506,6 +591,12 @@ export class Store {
             .prepare("SELECT * FROM messages ORDER BY created_at DESC")
             .all();
     }
+    countUnprocessed() {
+        const row = this.db
+            .prepare("SELECT COUNT(*) AS count FROM messages")
+            .get();
+        return row.count;
+    }
     deleteMessage(id) {
         const info = this.db.prepare("DELETE FROM messages WHERE id = ?").run(id);
         return info.changes;
@@ -529,29 +620,21 @@ export class Store {
             .get(to_ref, dedup_key);
     }
     /**
-     * Atomic consume: create a session, append a `message` event whose data
-     * includes `message_id`, and delete the messages row -- all in a single
-     * transaction. If the row is already gone, returns the prior session id
-     * by looking up the historic `message` event; callers can treat this as
-     * idempotent.
+     * Atomically move a pending message into an existing session. Session
+     * lifecycle belongs to SessionManager because ACP creation is asynchronous
+     * and cannot participate in this SQLite transaction.
      */
-    consumeMessageTx(messageId, opts) {
-        // Fast idempotency pre-check outside the tx to avoid the cost of
-        // opening one for an already-resolved message.
-        const existing = this.findMessageEventSession(messageId);
+    consumeMessageTx(messageId, sessionId) {
+        const existing = this.findConsumedMessageSession(messageId);
         if (existing) {
             return { sessionId: existing, alreadyConsumed: true };
         }
         const row = this.getMessage(messageId);
         if (!row) {
-            throw new Error(`consumeMessageTx: message not found (id=${messageId})`);
+            throw new MessageNotFoundError(messageId);
         }
         const tx = this.db.transaction(() => {
-            this.db
-                .prepare("INSERT INTO sessions (id, cwd, source) VALUES (?, ?, ?)")
-                .run(opts.sessionId, opts.cwd ?? row.cwd ?? "", "message");
-            // Append message event via saveEvent so seq logic applies.
-            this.saveEvent(opts.sessionId, "message", {
+            this.saveEvent(sessionId, "message", {
                 message_id: row.id,
                 from_ref: row.from_ref,
                 from_label: row.from_label,
@@ -563,15 +646,13 @@ export class Store {
                 .prepare("DELETE FROM messages WHERE id = ?")
                 .run(messageId);
             if (del.changes === 0) {
-                // Should never happen -- we just fetched the row above. If it does,
-                // roll back via throw.
-                throw new Error(`consumeMessageTx: row vanished mid-tx (id=${messageId})`);
+                throw new MessageNotFoundError(messageId);
             }
         });
         tx();
-        return { sessionId: opts.sessionId, alreadyConsumed: false };
+        return { sessionId, alreadyConsumed: false };
     }
-    findMessageEventSession(messageId) {
+    findConsumedMessageSession(messageId) {
         const row = this.db
             .prepare(`SELECT session_id FROM events
          WHERE type = 'message'
@@ -769,9 +850,11 @@ export class Store {
          s.ttl_hours AS ttl_hours,
          s.last_accessed_at AS last_accessed_at
        FROM shares s
+       JOIN agent_sessions a ON a.web_session_id = s.session_id
        LEFT JOIN sessions sess ON sess.id = s.session_id
+       WHERE a.agent_key = ?
        ORDER BY s.created_at DESC`)
-            .all();
+            .all(this.agentKey);
     }
     /**
      * One-time write of last_accessed_at (share-plan §4.1 R2 ENG-6a +

package/lib/title-service.js

@@ -64,7 +64,7 @@ export class TitleService {
         this.cancelledSourceSessions.add(sessionId);
         if (!this.titleSessionId || !this.activeSourceSessions.has(sessionId))
             return;
-        await bridge.cancel(this.titleSessionId);
+        await bridge.cancelAgentSession(this.titleSessionId);
     }
     /** Clear the cached title session ID (e.g. after agent reload). */
     invalidate() {
@@ -76,14 +76,14 @@ export class TitleService {
             return this.titleSessionId;
         try {
             const { sessionId: id, configOptions } = await bridge.newSession(this.defaultCwd, { silent: true });
-            this.sessions.liveSessions.add(id);
+            this.store.registerInternalAgentSession(id);
             // Pick the cheapest available model by matching id substrings against
             // the agent's reported availableModels (`configOptions[id=model].options`).
             // Empty pattern list, no model option, or no match → skip the call and
             // inherit the agent's default model (`currentModelId`).
             const picked = pickModelByPatterns(configOptions, this.modelPatterns);
             if (picked) {
-                await bridge.setConfigOption(id, "model", picked).catch(() => []);
+                await bridge.setAgentConfigOption(id, "model", picked).catch(() => []);
             }
             this.titleSessionId = id;
             return id;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lelouchhe/webagent",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "A terminal-style web UI for ACP-compatible agents",
   "type": "module",
   "license": "MIT",
@@ -64,6 +64,7 @@
     "@types/web-push": "^3.6.4",
     "better-sqlite3": "^12.6.2",
     "busboy": "^1.6.0",
+    "diff": "^9.0.0",
     "dompurify": "^3.4.1",
     "file-type": "^22.0.1",
     "highlight.js": "^11.11.1",