@lmctl-ai/lmctl 0.1.342 → 0.2.3

package/dist/cli/infra.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Thin adapter mounting lmt + lmauto as `lmctl` subcommands, gated behind
+ * `LMCTL_INFRA_CLI`. Off by default — see
+ * ~/repos/infraqa/lmctl-thin-merge-design.md (§2.2 "the seam") for the
+ * original design; this was P2 of that design's phasing.
+ *
+ * STATUS (2026-09-10, lmauto.lmctl): `lmt` (the target this adapter was built
+ * against) is now RETIRED — see ~/repos/tools/lmt/RETIRED.md. Its command
+ * surface was absorbed natively into `@lmctl-ai/lmbee` (the renamed
+ * `lmauto`), but lmbee does NOT export the `InfraLmtModule` contract this
+ * file expects (`INFRA_CLI_CONTRACT`/`createRuntime`/a raw-exit-code
+ * `dispatch(argv, runtime)`) — lmbee's own `dispatch(context, argv)` has a
+ * different signature and return shape (`Promise<{output, exitCode}>`,
+ * requires a `CliContext` built via `buildContext()`, not a bare
+ * `runtime`), and it has no concept of a frozen `INFRA_CLI_CONTRACT` version
+ * number at all (that was an lmt-specific, this-adapter-specific concept).
+ * Blindly swapping the import target from `@lmctl-ai/lmt` to
+ * `@lmctl-ai/lmbee` would NOT make this adapter work — it would still throw,
+ * just for a different reason (shape mismatch, not MODULE_NOT_FOUND), while
+ * looking superficially "fixed." `defaultLoadInfraModule` below has been
+ * changed to throw directly instead of importing a package that no longer
+ * has any plausible target, so the previously-accurate-but-now-stale
+ * "private repo, no CI credential" reasoning doesn't linger as a misleading
+ * TODO. Reviving `LMCTL_INFRA_CLI` needs a real design pass against lmbee's
+ * actual `dispatch()`/`buildContext()` shape (coordinate with lmauto.lmctl,
+ * lmbee's owner) — not a mechanical rename, and out of scope for this
+ * cleanup. Still safely inert either way: `runInfraCommand`'s catch below
+ * already handles the throw as the correct "not available" remediation
+ * case, and the feature stays off by default.
+ *
+ * lmauto's own P1 landed first (lmauto-cli-v0.2.21, verified against
+ * ~/repos/lmauto/src/cli/dispatch.ts): its `dispatch()` never throws for
+ * ordinary usage/validation misuse (every malformed argv returns
+ * `{output, exitCode: 1}`; only a genuine internal failure — DB/fs error —
+ * still propagates), and it now exports `COMMANDS` (its 16 routable verbs,
+ * as of the lmbee migration's Stage 2) + `PROCESS_ONLY_COMMANDS`
+ * (`whoami`/`migrate-home`/`serve`/`peers`/`tell`/`sites`/`exec`/`fleet`/the
+ * 6 cloud-service adapters, reachable only through lmbee's own bin, never
+ * through `dispatch()`). Neither changes anything HERE: `InfraLmtModule.
+ * dispatch`'s return shape below was lmt's own contract, one layer above
+ * lmauto's/lmbee's own — with lmt retired, that specific contract has no
+ * living implementation to target at all anymore, lmbee's own `dispatch()`
+ * shape included. Also confirmed with lmauto/lmbee directly: its DB
+ * resolution (`buildContext()`/`resolveLmautoDbPath()`) has no concept of
+ * lmctl's `--db` anywhere in the chain, so the `--db` firewall correctly
+ * lives only in `src/cli/index.ts` (already shipped), not here.
+ */
+import type { CliIo } from './common.js';
+/** Design §2.2: lmt's embedding contract version this lmctl build expects. */
+export declare const INFRA_CLI_CONTRACT_EXPECTED = 1;
+/**
+ * Flat command names + the `auto` namespace, per the design's §2.1
+ * command-surface mapping. This list is pinned by the design doc itself,
+ * not derived from lmt's export — so it can be wired into `COMMANDS` and
+ * collision-checked before lmt exports anything.
+ */
+export declare const INFRA_FLAT_COMMANDS: readonly ["lmchat", "lmmail", "lmnote", "lmsheet", "lmtext", "lmsound", "login", "whoami", "exec", "tell", "peers", "site"];
+export declare const INFRA_NAMESPACE_COMMAND = "auto";
+export declare function infraCliEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function isInfraCommand(command: string): boolean;
+interface InfraLmtModule {
+    INFRA_CLI_CONTRACT: number;
+    createRuntime: (...args: unknown[]) => unknown;
+    dispatch: (argv: string[], runtime: unknown) => Promise<number> | number;
+}
+/** Test seam — production always uses {@link defaultLoadInfraModule}. */
+export type InfraModuleLoader = () => Promise<InfraLmtModule>;
+/**
+ * Design §2.6 acceptance criteria, implemented ahead of the real module:
+ * - optional-absent → exit 1 + the exact remediation string (never throws
+ *   up through the CLI dispatcher).
+ * - contract-version skew → refuse rather than dispatch into a mismatched
+ *   manifest.
+ * - pass-through parity → argv forwarded verbatim (minus the `auto`
+ *   prefix), no re-parsing here.
+ */
+export declare function runInfraCommand(command: string, args: string[], io: CliIo, loadModule?: InfraModuleLoader): Promise<number>;
+export {};

package/dist/cli/ls.d.ts

@@ -0,0 +1,2 @@
+import { type CliIo } from './common.js';
+export declare function runLs(args: string[], io?: CliIo): Promise<number>;

package/dist/cli/mailbox-cli.d.ts

@@ -0,0 +1,6 @@
+export interface AgentIdentity {
+    teamfile: string;
+    alias: string;
+    value: string;
+}
+export declare function splitCanonicalIdentity(identity: string): AgentIdentity;

package/dist/cli/managed.d.ts

@@ -0,0 +1,62 @@
+/**
+ * P3 (briefs/lmctl0-verbs-native-port-design.md §2.4 / §2.5) — managed
+ * mode shared helpers. Consumed by terminal/chat/tail/info/ls when the
+ * P0 classifier returns `{mode:'managed'}`. The §2.4 precedence is
+ * kind-keyed (verbatim from the design):
+ *
+ *   • workflow_escalation     → attention payload is context-only; resolve
+ *                              the agent via the latest `agent_call`
+ *                              session_event for the RUN (never via
+ *                              interactive_session; never via a
+ *                              payload.step_id == session_event.step_id
+ *                              join — see Dal.latestAgentCall doc-comment).
+ *   • interactive_waiting_op  → interactive_session is authoritative for
+ *                              the paused step + resumeInteractive.
+ *                              Agent identity still via latestAgentCall.
+ *   • running (no attention)  → latestAgentCall only.
+ *   • none resolves           → clear error (no DAL write).
+ *
+ * All helpers are read-only; spawn nothing. They take `Dal` so callers
+ * can inject a memory DAL in tests.
+ */
+import type { Dal } from '../db/index.js';
+export interface ManagedAgent {
+    /** Resolved provider for the agent session. */
+    provider: string;
+    /** Native session id (the provider's id). */
+    sessionid: string;
+    /** Working directory for the provider TUI. */
+    sessiondir: string;
+    /** Team-member alias the run's latest agent_call drove. */
+    alias: string;
+    /** Optional model override. */
+    model?: string;
+}
+/**
+ * Resolve a run-id to its agent provider session (§2.4 precedence). Uses
+ * `Dal.latestAgentCall` — RUN-keyed, ORDER BY id DESC — and falls back to
+ * the single-member team rule (§2.5) when no agent_call has been written
+ * yet. NEVER joins `session_event` by `payload.step_id`, NEVER consults
+ * `interactive_session`.
+ *
+ * `aliasOverride` (optional) — if provided, looks up that specific member
+ * (skipping latestAgentCall). Used by callers that surface `--alias A`
+ * alongside `--run <id>` per the §3 grammar / §2.5 disambiguation.
+ *
+ * Returns `{ok:<ManagedAgent>}` on success or `{err:<message>}` on any
+ * resolution failure (caller surfaces as a clear user-error).
+ */
+export declare function resolveManagedAgent(dal: Dal, run_id: number, aliasOverride?: string): {
+    ok: ManagedAgent;
+} | {
+    err: string;
+};
+/**
+ * Find the run's pending operator-answerable attention (if any).
+ * Returns the unacked `requires_user=1` attention row's `{kind, attention_id}`
+ * or null. Read-only.
+ */
+export declare function pendingOperatorAttention(dal: Dal, run_id: number): {
+    kind: string;
+    attention_id: number;
+} | null;

package/dist/cli/mcp-install.d.ts

@@ -0,0 +1,23 @@
+import type { CliIo } from './common.js';
+import type { TeamConfig } from '../providers/config/team-config.js';
+interface McpInstallFileOps {
+    existsSync(path: string): boolean;
+    mkdirSync(path: string, opts: {
+        recursive: true;
+    }): unknown;
+    readFileSync(path: string, encoding: 'utf8'): string;
+    writeFileSync(path: string, data: string, encoding: 'utf8'): unknown;
+    renameSync(oldPath: string, newPath: string): unknown;
+    unlinkSync(path: string): unknown;
+}
+export type CopilotMcpServerConfig = Record<string, unknown>;
+export declare function _setMcpInstallTestHooksForTests(input: {
+    homeDir?: string;
+    fileOps?: Partial<McpInstallFileOps>;
+} | null): void;
+export declare function cleanupStaleMcpForTeam(io: CliIo, config: TeamConfig, teamfilePath: string): void;
+export declare function copilotMcpConfigPath(homeDir?: string): string;
+export declare function mergeCopilotMcpServers(path: string, desiredServers: Record<string, CopilotMcpServerConfig>): {
+    changed: boolean;
+};
+export {};

package/dist/cli/mcp.d.ts

@@ -0,0 +1,2 @@
+import type { CliIo } from './common.js';
+export declare function runMcp(args: string[], io?: CliIo, stdin?: NodeJS.ReadableStream): Promise<number>;

package/dist/cli/paths.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ~/.lmctl root directory (or override via `LMCTL_HOME`).
+ *
+ * `LMCTL_HOME` is the absolute path TO `.lmctl` (i.e. the directory that
+ * contains `state.db`) — not the parent. Used by tests to redirect the entire
+ * state tree.
+ *
+ * Without an override we use `os.homedir()` + `.lmctl`. Note: on POSIX, libuv
+ * resolves `homedir` from /etc/passwd rather than `$HOME`, which is why we
+ * expose a dedicated env override instead of relying on `$HOME` for test
+ * isolation.
+ */
+export declare function lmctlNextHome(): string;
+/** The default DB path: ~/.lmctl/state.db (under `LMCTL_HOME`). */
+export declare function defaultDbPath(): string;
+/**
+ * Single source of truth for the state.db path.
+ *
+ * Priority order (highest first):
+ *   1. dbFlag arg (passed via top-level `--db PATH` flag)
+ *   2. process.env.LMCTL_DB
+ *   3. ~/.lmctl/state.db (under `LMCTL_HOME`)
+ *
+ * Parent directories are created on first DB open by migrate().
+ */
+export declare function resolveDbPath(dbFlag?: string): string;
+/**
+ * One-line human rendering of the resolved state location, shared by
+ * `lmctl status`'s footer and the stale-SELF-marker error so both name the DB
+ * the same way. When the path came from an explicit `--db`/`LMCTL_DB` override,
+ * the label says so.
+ */
+export declare function describeStateLocation(dbPath: string): string;
+/**
+ * Detect whether `dbPath` lives on a WSL `/mnt/c` Windows-mounted volume.
+ * WSL Windows-mount IO is ~5-10x slower than the native ext4 home volume,
+ * which surfaces as flaky locks + slow migrations. We emit a one-line
+ * stderr hint at startup so operators can move the DB if they hit it.
+ *
+ * Exposed for tests; production callers should use `warnIfSlowDbPath`.
+ */
+export declare function isSlowWslMount(dbPath: string, plat?: NodeJS.Platform): boolean;
+/**
+ * Print a one-line stderr warning if `dbPath` is on `/mnt/c`. No-op on
+ * non-Linux platforms and on non-`/mnt/c` paths. Idempotent — safe to call
+ * once at startup.
+ */
+export declare function warnIfSlowDbPath(dbPath: string, stderr?: {
+    write: (chunk: string) => unknown;
+}, plat?: NodeJS.Platform): void;

package/dist/cli/plan-wizard.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Interactive fallback for `lmctl plan`: a plain node:readline wizard (no new
+ * dependencies). Every question here has a flag equivalent on `runPlan`; this
+ * module only runs when config flags are absent and stdin is a TTY (or
+ * `--wizard` forced it). It returns the final teamfile text plus where to
+ * write it — plan.ts owns the actual write/lint/seed pipeline so the flags
+ * path and the wizard path behave identically after this point.
+ */
+import { type ProviderBinaryCheck } from '../providers/binary-check.js';
+import type { CliIo } from './common.js';
+import { type MemberSpec } from './teamfile-template.js';
+export interface PlanWizardInitial {
+    provider?: string;
+    model?: string;
+    pattern?: string;
+    members?: MemberSpec[];
+    seed?: boolean;
+    /** Explicit --output destination; skips the directory/name questions. */
+    output?: string;
+}
+export interface PlanWizardResult {
+    destPath: string;
+    text: string;
+    seed: boolean;
+}
+export interface PlanWizardOptions {
+    io: CliIo;
+    /** Line source for readline — real stdin in the CLI, a scripted stream in tests. */
+    input: NodeJS.ReadableStream;
+    cwd: string;
+    /** Preselected directory (positional arg); defaults to cwd. */
+    directory?: string;
+    initial?: PlanWizardInitial;
+    /** Test seam — defaults to probing PATH via checkProviderBinaries. */
+    checkProviders?: () => ProviderBinaryCheck[];
+    /** Test seam — defaults to spawning $EDITOR synchronously on the temp file. */
+    editFile?: (path: string) => void;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function runPlanWizard(opts: PlanWizardOptions): Promise<PlanWizardResult | null>;
+/** Members for reporting after a wizard run — re-parse so `$EDITOR` changes are reflected. */
+export declare function wizardMembers(text: string): MemberSpec[];

package/dist/cli/plan.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `lmctl plan` — flags-first, wizard-fallback teamfile generator.
+ *
+ * Every wizard question has a flag; the wizard fires only when no config
+ * flags are present AND stdin is a TTY (`--wizard` forces it,
+ * `--non-interactive` suppresses it with a missing-params error). Session
+ * ids are never generated here — seeding is `lmctl seed`'s job, chained via
+ * `--seed` (lint first, refuse to seed when lint fails).
+ */
+import type { ProviderBinaryCheck } from '../providers/binary-check.js';
+import type { CliIo } from './common.js';
+/** Test seams — fetch for --from URLs, provider probe + editor for the wizard. */
+export interface PlanDeps {
+    fetchFn?: typeof fetch;
+    checkProviders?: () => ProviderBinaryCheck[];
+    editFile?: (path: string) => void;
+    /** Overrides stdin TTY detection (wizard auto-trigger). */
+    stdinIsTTY?: boolean;
+}
+export declare function runPlan(args: string[], io?: CliIo, deps?: PlanDeps): Promise<number>;

package/dist/cli/queue-delivery.d.ts

@@ -0,0 +1,107 @@
+import { chat as libraryChat, type ProgressEvent } from '../providers/index.js';
+import type { BundleSession } from '../providers/bundle.js';
+import type { CliIo } from './common.js';
+import type { PermissionMode } from '../providers/yolo-contract.js';
+/**
+ * Hold-open predicate for the receiver's provider turn
+ * (BUG-chat-client-death-interrupts-receiver-live-session).
+ *
+ * The stream-json transport closes the provider child's stdin on the first
+ * result event, which makes headless claude exit immediately — orphaning any
+ * `run_in_background` dispatches the receiver fired during its turn. The
+ * durable "this session still has outstanding dispatched work" signal is an
+ * `agent_inflight` row whose SENDER is the receiver's own identity, held by
+ * a live pid: every `lmctl prompt` the receiver dispatched acquires exactly
+ * such a lease (its sender attribution comes from LMCTL_SELF_SESSIONID in
+ * the provider spawn env) and releases it when the dispatched turn
+ * finalizes.
+ *
+ * Predicate scope, deliberately narrow:
+ *   - DIRECT children only (rows where sender = the session being run),
+ *     never the transitive subtree. This is sufficient by recursion, not an
+ *     approximation (operator-confirmed 2026-07-26): a direct child that
+ *     dispatched further work applies this same holdOpen check before ITS
+ *     stdin closes, so it holds its own lease — the one we watch — until
+ *     its children are done. The same fix at every level yields full
+ *     subtree coverage through one-hop checks; walking deeper would be
+ *     redundant, not more correct.
+ *   - live local pid required (`isProcessAlive`): dead-pid and null-pid rows
+ *     are orphans for the reclaim machinery, not outstanding work — waiting
+ *     on a corpse would hold the turn open for nothing. agent_inflight has
+ *     no host column; like the busy check, liveness is judged against the
+ *     local host (pre-existing remote-holder ambiguity, unchanged here).
+ *   - the lease for THIS delivery (receiver == the session being run) is
+ *     excluded — without that guard a self-addressed chat would wait on its
+ *     own lease until max-hold.
+ *
+ * Bounding (the "stuck row" question): the real bound is per-poll liveness —
+ * a holder that dies or gets reclaimed drops out on the next poll. maxHoldMs
+ * (= the agent_inflight TTL, 8h default) is last-resort insurance against a
+ * live-but-wedged holder; anything SHORTER would re-introduce the original
+ * bug by killing legitimately long dispatched work, and the adapter's idle
+ * timer (same 8h default, resolves 'stalled') backstops independently.
+ */
+export declare function buildDispatchHoldOpen(io: CliIo, receiver: LaneIdentity, env: NodeJS.ProcessEnv): NonNullable<Parameters<typeof libraryChat>[0]['holdOpen']>;
+export interface LaneIdentity {
+    teamfile: string;
+    alias: string;
+}
+export interface LaneDeliveryTarget extends LaneIdentity {
+    provider: string;
+    sessionId: string;
+    cwd: string;
+    model?: string;
+    effort?: string;
+    isLead?: boolean;
+}
+export interface DeliverLaneInput {
+    sender: LaneIdentity;
+    receiver: LaneDeliveryTarget;
+    newMessage: string;
+    newMessageFrom?: string;
+    io: CliIo;
+    permissionMode: PermissionMode;
+    env: NodeJS.ProcessEnv;
+    idleTimeoutMs?: number;
+    /** Multi-turn callers must never fall back to a fresh provider session. */
+    requireResume?: boolean;
+    /**
+     * Caller-held bundle provider session (batch bundle mode): the turn
+     * goes through the already-open provider process. When set, the
+     * `holdOpen` below is still built but ignored by the transport — the
+     * bundle's persistence IS the hold, and its close() runs the check once.
+     */
+    bundleSession?: BundleSession;
+    onDelta?: (chunk: string) => void;
+    onProgress?: (event: ProgressEvent) => void;
+    onPromptBuilt?: (prompt: string) => void | Promise<void>;
+}
+export type DeliverLaneResult = {
+    status: 'ok';
+    receipt: string;
+    prompt: string;
+    wroteDelta: boolean;
+    durationMs?: number;
+    /** Task #232: human-readable strings when the provider silently
+     * dropped a declared model=/effort=. Omitted when nothing was dropped. */
+    warnings?: string[];
+} | {
+    status: 'stalled';
+    receipt: string;
+    prompt: string;
+    wroteDelta: boolean;
+    durationMs?: number;
+    stalledAfterMs?: number;
+    warnings?: string[];
+} | {
+    status: 'error';
+    receipt: string;
+    prompt: string;
+    wroteDelta: boolean;
+    durationMs?: number;
+    error: string;
+};
+export declare function deliverLane(input: DeliverLaneInput): Promise<DeliverLaneResult>;
+export declare function renderQueuedChatPrompt(newPrompt: string, options?: {
+    newMessageFrom?: string;
+}): string;

package/dist/cli/ratelimit.d.ts

@@ -0,0 +1,3 @@
+import { type CliIo } from './common.js';
+export { _setRatelimitFsDepsForTests, _setRatelimitRunnerForTests } from '../providers/ratelimit-readings.js';
+export declare function runRatelimit(args: string[], io: CliIo): Promise<number>;

package/dist/cli/remote-fetch.d.ts

@@ -0,0 +1,7 @@
+export declare function isHttpsUrl(value: string): boolean;
+export declare function isUrlLike(value: string): boolean;
+export declare function httpsOnlyError(value: string, noun: string): string | null;
+export declare function fetchHttpsBytes(url: string, options: {
+    description: string;
+    timeoutMs?: number;
+}): Promise<Buffer>;

package/dist/cli/run-queries.d.ts

@@ -0,0 +1,82 @@
+/**
+ * DAL-pure run/attention/escalation read queries shared by the surviving
+ * stateless commands (`prompt --run`, `ls --runs`, the MCP mediation core).
+ *
+ * Relocated verbatim from src/serve/data.ts when the daemon/HTTP surface
+ * (`serve`/`api`) moved to lmbee — these helpers import only db types and
+ * perform no I/O beyond `dal.query`.
+ */
+import type { AttentionRow, Dal, RunRow } from '../db/index.js';
+export declare function listRuns(dal: Dal, opts?: {
+    limit?: number;
+}): RunRow[];
+export declare function listAttentions(dal: Dal, opts?: {
+    unacked?: boolean;
+}): AttentionRow[];
+export interface EscalationRow {
+    attention_id: number;
+    /**
+     * Discriminator for the operator response contract. Interactive rows resume
+     * an `interactive_session`; workflow escalations are session-free DEF-1
+     * decisions and accept only a declared outcome token or `@abort`.
+     */
+    kind: string;
+    /**
+     * Attention severity tier. Historical attention values were error/warn/info-ish.
+     *
+     * project_issue #37 item 5: `"attn"` is the value used for the new
+     * `interactive_waiting_operator` (operator-pause) escalations. It is an
+     * intentional new tier — these are NOT errors and NOT warnings; they are
+     * operator-attention requests with no provenance baggage. UI/tooling that
+     * filters or color-codes by severity should branch on "attn" alongside the
+     * pre-existing error/warn/info-ish values.
+     */
+    severity: string | null;
+    created_at: string;
+    project_id: number | null;
+    project: string | null;
+    run_id: number | null;
+    workflow_name: string | null;
+    step_id: number | null;
+    state_name: string | null;
+    prompt: string | null;
+    /** Most recent interactive_session row status; null when no session linked. */
+    session_status: string | null;
+    /**
+     * ISO timestamp when the attention was acknowledged; null when still pending.
+     * Surfaced so operators using `escalations list --all` can distinguish acked
+     * from unacked history.  project_issue #45.
+     */
+    acknowledged_at: string | null;
+    node_path: string[] | null;
+    expected_response: {
+        kind: string;
+        choices: string[] | null;
+    } | null;
+    transcript_tail: string[] | null;
+    paused_at: string | null;
+    created_run_inputs: Record<string, unknown> | null;
+    workflow_version_id: number | null;
+    /**
+     * Session-free workflow-escalation context copied from attention.payload.
+     * `workflow_escalation` has no interactive_session row, so the JOIN columns
+     * above are intentionally null for prompt/step details; SDKs and CLI clients
+     * must use these nullable fields to render the human prompt.
+     */
+    workflow_step: {
+        id: string;
+        name: string | null;
+        type: string | null;
+    } | null;
+    escalation_tier: string | null;
+    escalation_token: string | null;
+    escalation_reason: string | null;
+    declared_outcomes: string[] | null;
+    agent_output: string | null;
+}
+export declare function listEscalations(dal: Dal, opts?: {
+    project?: string;
+    all?: boolean;
+    since?: string;
+}): EscalationRow[];
+export declare function getEscalation(dal: Dal, attention_id: number): EscalationRow | null;

package/dist/cli/running.d.ts

@@ -0,0 +1,5 @@
+import { type CliIo } from './common.js';
+/** Test-only seam: cap the number of `--watch` ticks so tests can exercise
+ *  the loop without hanging on the SIGINT/SIGTERM shutdown. */
+export declare function _setRunningWatchMaxTicksForTests(maxTicks: number | null): void;
+export declare function runRunning(args: string[], io: CliIo): Promise<number>;

package/dist/cli/schema.sql

@@ -613,7 +613,13 @@ CREATE TABLE IF NOT EXISTS team_chat_log (
   status            TEXT NOT NULL,
   error_detail      TEXT,
   truncated         INTEGER NOT NULL DEFAULT 0,
-  created_at        TEXT NOT NULL
+  created_at        TEXT NOT NULL,
+  -- v61: batch-vs-individual framing ('batch' for rows belonging to a batch
+  -- run, NULL for individual chats). Distinct from
+  -- message_pending.message_type (request/response lane semantics).
+  -- Appended LAST so a fresh create and a v60->v61 ALTER-upgrade converge on
+  -- the same column order (migrate-v32's table_info parity check).
+  message_type      TEXT CHECK(message_type IN ('batch'))
 );
 CREATE INDEX IF NOT EXISTS idx_team_chat_log_root_time
   ON team_chat_log(root_teamfile, created_at);
@@ -878,3 +884,16 @@ CREATE TABLE IF NOT EXISTS state_ledger_identity (
   instance_id TEXT NOT NULL,
   created_at  TEXT NOT NULL
 );
+
+-- v61: schema metadata kv. Holds min_reader_version -- the oldest build
+-- schema version that may safely open this db (batch redesign Landing A,
+-- item 0). migrate()'s skew check refuses a newer db only when
+-- min_reader_version exceeds the binary's CURRENT_USER_VERSION; a db without
+-- the marker defaults to its raw user_version (strict, pre-v61 behavior).
+-- v61 is purely additive, so its floor is 60. Additive migrations keep/lower
+-- the floor (INSERT OR IGNORE); breaking ones raise it to their own version.
+CREATE TABLE IF NOT EXISTS schema_meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+INSERT OR IGNORE INTO schema_meta (key, value) VALUES ('min_reader_version', '60');

package/dist/cli/script.d.ts

@@ -0,0 +1,6 @@
+import { type CliIo } from './common.js';
+import { type FunctionDoc, type LMScript, type ScriptModule } from '../script/adapter.js';
+export declare function formatFunctionDoc(doc: FunctionDoc): string;
+export declare function formatModuleOverview(engine: LMScript, module: ScriptModule): string;
+export declare function formatCategoryOverview(engine: LMScript): string;
+export declare function runScript(args: string[], io?: CliIo): Promise<number>;