@north-light/cli 0.0.0 → 0.3.413

package/dist/core/canvas/canvas.d.ts

@@ -0,0 +1,397 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ExitIntent, Lifecycle, Mode, NodeIdentity, NodeMeta, NodeOutcomeKind, NodeRow, NodeStatus, TerminalReason } from './types.js';
+export interface OutcomeDeliveryBinding {
+    actionName: string;
+    argv: string[];
+    cwd: string;
+    configOrigin: string;
+    payload?: unknown;
+}
+export declare function assertRunNotDeleting(db: DatabaseSync, runId: string): void;
+/** Create a SQL-authoritative node, then ensure its artifact directories exist. */
+export declare function createNode(meta: NodeMeta, opts?: {
+    outcomeDelivery?: OutcomeDeliveryBinding;
+    withinCreate?: (db: DatabaseSync, row: NodeMeta) => void;
+}): NodeMeta;
+/** The canonical node record, hydrated from SQL. Null if unknown. */
+export declare function getNode(nodeId: string): NodeMeta | null;
+export type CreateRequestState = 'reserved' | 'warm_claimed' | 'complete';
+export interface CreateRequestRecord {
+    requestKey: string;
+    nodeId: string | null;
+    state: CreateRequestState;
+}
+export declare function findCreateRequest(requestKey: string): CreateRequestRecord | null;
+/** Reserve an idempotency key before creation. A null node id means the request
+ *  has not yet selected a cold-birth identity or claimed a warm spare. */
+export declare function reserveCreateRequest(requestKey: string): CreateRequestRecord;
+/** Delete keys past their recovery window; returns how many were removed. */
+export declare function pruneExpiredCreateRequests(now?: number): number;
+/** Bind a reserved key to the node it created (state `complete`). The mapping is
+ *  durable so a retry after a daemon handover returns the original node. */
+export declare function recordCreateRequestNode(requestKey: string, nodeId: string): void;
+/** Reserve a cold-birth node id for a key (state stays `reserved`) so a retry
+ *  after a daemon restart resumes the same identity instead of minting another. */
+export declare function reserveCreateRequestNode(requestKey: string, nodeId: string): void;
+export declare function completeCreateRequest(requestKey: string, nodeId: string): void;
+/** Forget an unserved reservation after a pre-birth failure. A record that
+ *  names a durable node is never removed by this path. */
+export declare function abandonCreateRequest(requestKey: string, nodeId: string | null): void;
+export declare function canonicalSessionFile(sessionFile: string): string;
+/** Resolve the crouter node that owns one exact Pi session file. */
+export declare function findNodeBySessionFile(sessionFile: string): NodeMeta | null;
+/** The indexed row (from the db) — cheap for queries that don't need full meta. */
+export declare function getRow(nodeId: string): NodeRow | null;
+/** The node row whose durable LOCATION pane is `pane`, or null. Lets placement
+ *  resolve "who sits in this pane" by the first-class `%pane_id` handle (e.g.
+ *  to adopt a caller's pane as a focus). pane is not UNIQUE in the schema, but a
+ *  live pane backs at most one node, so this returns the single match. */
+export declare function getRowByPane(pane: string): NodeRow | null;
+/** Nodes whose persisted spawn deadline has elapsed and that remain live work. */
+export declare function dueNodeDeadlines(nowIso: string): NodeRow[];
+/** Write a claimed warm spare's deadline before it is handed to its caller. */
+export declare function setNodeDeadline(nodeId: string, deadlineAt: string | null): boolean;
+/** Shift active/idle profile deadlines by a completed profile pause duration. */
+export declare function shiftProfileNodeDeadlines(profileId: string, pauseDurationMs: number): number;
+/** OWN-11 for a joined runtime: a `user:local` subject becomes the owner, a
+ *  `user:local` grantee becomes `app:terminal` (no node has the owner as grantee),
+ *  a terminal node born before the local grant mirror (no subject) gets the owner,
+ *  and a reference to the dropped local grant is cleared so the node resolves the
+ *  synced grant by grantee and subject. */
+export declare function rewriteLocalNodeIdentity(db: DatabaseSync, owner: string, localGrantId: string): number;
+type NodeUpdate = Partial<Omit<NodeIdentity, 'node_id' | 'pi_session_id' | 'pi_session_file' | 'managed_worktree'>>;
+/** Update node identity/configuration columns. Sessions and worktrees have named stores. */
+export declare function updateNode(nodeId: string, patch: NodeUpdate): NodeMeta;
+/** Set a node's status. Atomic single-column write. */
+export declare function setStatus(nodeId: string, status: NodeStatus): void;
+/** Set a node's exit intent. Atomic single-column write. */
+export declare function setIntent(nodeId: string, intent: ExitIntent): void;
+/** Atomically write status and/or intent, gated on an optional from-status set
+ *  and/or on the row carrying no committed final_report. The lifecycle state
+ *  machine (runtime/lifecycle.ts) is the one caller: it owns the legality
+ *  table and the unknown-node/illegal-move/already-finalized-cancel branching,
+ *  this only performs the single conditional UPDATE it needs. A PRESENT key in
+ *  `fields` (even `intent: null`) writes that column; an ABSENT key leaves it
+ *  unchanged. Returns the row-changed count so the caller can distinguish "no
+ *  such node", "gate failed", and "already applied" without a second query. */
+export declare function transitionStatusIntent(nodeId: string, fields: {
+    status?: NodeStatus;
+    intent?: ExitIntent;
+    terminal_reason?: TerminalReason | null;
+}, opts?: {
+    fromStatuses?: readonly NodeStatus[];
+    requireNoFinalReport?: boolean;
+    /** Present ⇒ latch an outcome and make an armed delivery pending atomically. */
+    outcome?: {
+        kind: NodeOutcomeKind;
+        reason: TerminalReason;
+        detailJson: string | null;
+        at: string;
+        /** Replace a prior outcome after a run resumes or when its final is committed. */
+        supersede?: boolean;
+        /** Action-independent document composed before the conditional latch. */
+        documentJson?: string | null;
+    };
+}): number;
+/** Read a node's committed-final latch pointer. Pure read, no side effect. */
+export declare function getFinalReport(nodeId: string): string | null;
+/** CAS-clear a node's finalization latch (final_report + finalized_at) —
+ *  retract-pointer-only. Gated on the exact final_report value the caller
+ *  observed via getFinalReport, so a concurrent clear/refinalize can never be
+ *  clobbered. Returns true iff the CAS matched and cleared. */
+export declare function clearFinalReportIfMatches(nodeId: string, expectedFinalReport: string): boolean;
+/** Set a node's tmux presence in one atomic write: the durable LOCATION anchor
+ *  `pane` (the `%pane_id`) plus its derived cache (`tmux_session` + `window`).
+ *  All three move together — `pane` joins the others inside the single UPDATE so
+ *  a move never half-writes the location. `pane` is optional: a caller that does
+ *  not yet track it (every caller, until the placement layer lands) writes null,
+ *  which is harmless because nothing reads `pane` yet. */
+export declare function setPresence(nodeId: string, presence: {
+    tmux_session?: string | null;
+    window?: string | null;
+    pane?: string | null;
+}): void;
+export declare function recordLaunch(nodeId: string, at: string): void;
+export declare function recordSettledTurn(nodeId: string, at: string): void;
+export declare function setFrozen(nodeId: string, at: string): void;
+export declare function clearFrozen(nodeId: string): void;
+export declare function recordRespawnAttempt(nodeId: string, attempt: {
+    failures: number;
+    notBefore: string | null;
+}): void;
+export declare function listNodesByProfile(profileId: string): NodeMeta[];
+/** Browse's first frame: select only fields its rows/tree use. Keep the fault and
+ * turn columns for rowFrom's live fault/streaming semantics, but never hydrate
+ * outcomes, placement, metadata or the (often large) telemetry activity text. */
+export declare function browseNodes(): NodeRow[];
+/** All rows, optionally filtered by status and terminal execution traces. Unclaimed warm spares are excluded. */
+export declare function updateNodeTelemetry(nodeId: string, telemetry: {
+    tokensIn: number;
+    contextTokens: number | null;
+    lastActivity: string | null;
+    updatedAt: string;
+}): void;
+export interface GraphNodeRow {
+    node_id: string;
+    name: string;
+    description: string | null;
+    cycles: number | null;
+    kind: string;
+    status: NodeStatus;
+    frozen_at: string | null;
+    pi_pid: number | null;
+    telemetry_context_tokens: number | null;
+    telemetry_last_activity: string | null;
+    fault: NodeRow['fault'];
+    streaming: boolean;
+}
+/** Stored fields the attach graph displays, plus the two live execution cues it
+ * needs. This keeps the interactive graph off the full node-summary projection
+ * and its unused runtime, outcome, and placement fields. */
+export declare function graphNodes(): GraphNodeRow[];
+export declare function listNodes(filter?: {
+    status?: NodeStatus | NodeStatus[];
+    withRecordedPid?: boolean;
+    withRecordedPidOrFrozen?: boolean;
+}): NodeRow[];
+/** Placement-only terminal rows for the daemon's residue pass. These columns
+ * preserve lastActivityMs's timestamp inputs and the teardown event fields;
+ * unlike node_rows, the nodes table needs no execution/session/fault joins. */
+export type TerminalPlacementResidue = Pick<NodeRow, 'node_id' | 'created' | 'launched_at' | 'last_settled_at' | 'finalized_at' | 'outcome_at' | 'last_activity_at' | 'pane' | 'window' | 'tmux_session'>;
+export declare const terminalPlacementResidueSql = "SELECT\n      node_id, created, launched_at, last_settled_at, finalized_at,\n      outcome_at, last_activity_at, pane, \"window\", tmux_session\n    FROM nodes INDEXED BY idx_nodes_terminal_placement_created\n    WHERE node_id NOT IN (SELECT node_id FROM warm_pool)\n      AND status IN ('done', 'canceled', 'dead')\n      AND (pane IS NOT NULL OR \"window\" IS NOT NULL OR tmux_session IS NOT NULL)\n    ORDER BY created";
+export declare function listTerminalPlacementResidue(): TerminalPlacementResidue[];
+/** The daemon's complete supervision set. Live rows participate regardless of
+ * PID; terminal rows participate only while they retain a PID or freeze mark. */
+export declare const nodesForSupervisionSql = "WITH candidates AS MATERIALIZED (\n    SELECT node_id FROM nodes WHERE status IN ('active', 'idle')\n    UNION\n    SELECT node_id FROM nodes INDEXED BY idx_nodes_supervision_frozen\n      WHERE frozen_at IS NOT NULL AND status IN ('done', 'canceled', 'dead')\n    UNION\n    SELECT node_id FROM executions\n      WHERE state != 'exited' AND state = 'running' AND pid IS NOT NULL\n  )\n  SELECT v.* FROM candidates c CROSS JOIN node_rows v\n  WHERE v.node_id = c.node_id\n    AND v.node_id NOT IN (SELECT node_id FROM warm_pool)\n    AND v.kind != 'human'\n    AND (v.status IN ('active', 'idle') OR (v.status IN ('done', 'canceled', 'dead') AND (v.pi_pid IS NOT NULL OR v.frozen_at IS NOT NULL)))\n  ORDER BY v.created";
+export declare function listNodesForSupervision(): NodeRow[];
+/** Identity-only projection of every user-visible row: the broker's report
+ *  resolver needs only "does this sender exist, and what is it called", and a
+ *  three-column read stays cheap against a canvas of thousands of rows where a
+ *  full `listNodes()` hydration does not. */
+export declare function listNodeIdentities(): Array<Pick<NodeRow, 'node_id' | 'name' | 'created'> & {
+    grantee: string;
+}>;
+/** Mark an already-spawned node as an unclaimed spare for `recipeKey`. Hides it
+ *  from every listing until it is claimed. */
+export declare function registerWarmSpare(nodeId: string, recipeKey: string): void;
+/** Take a parked spare OUT of the pool without claiming it — the reaper's
+ *  first move. Returns false when the marker was already gone (a concurrent
+ *  claim won it), which is the reaper's signal to leave that node alone: it is
+ *  somebody's live conversation now, not a spare. Deleting the marker under the
+ *  write lock is exactly what `claimWarmSpare` does, so the two can never both
+ *  succeed on the same node. */
+export declare function unregisterWarmSpare(nodeId: string): boolean;
+/** One parked spare, joined to the node row a claim/reap needs to judge it. */
+export interface WarmSpareRow {
+    node_id: string;
+    recipe_key: string;
+    /** Mint time — the claim order and the TTL clock. */
+    created: string;
+    status: NodeStatus;
+    pi_pid: number | null;
+    pi_pid_identity: string | null;
+}
+/** Every parked spare, oldest first — what the reaper (`runtime/warm-pool.ts`
+ *  `reapStaleSpares`) sweeps. Deliberately NOT filtered by liveness: judging a
+ *  spare is the caller's job. */
+export declare function listWarmSpares(): WarmSpareRow[];
+/** True while `nodeId` is an UNCLAIMED spare — nobody owns this conversation
+ *  yet. `registerWarmSpare` runs the instant the row exists and BEFORE the
+ *  broker launch, and a claim deletes the marker atomically, so this is a
+ *  reliable read from inside the booting engine (the context-intro extension
+ *  asks it at `session_start` to withhold bearings that would otherwise assert
+ *  the spare's placeholder persona instead of its eventual claimant's). */
+export declare function isWarmSpare(nodeId: string): boolean;
+/** Hand out the oldest CLAIMABLE spare matching `recipeKey`, or null when the
+ *  pool has none. The select+delete run inside ONE canvas write-lock
+ *  transaction, so two concurrent creates can never be handed the same spare.
+ *  A spare whose broker is gone is skipped here and reaped by
+ *  `reapStaleSpares` — nothing ever resumes a spare (the daemon's row query
+ *  hides them), so a dead spare is garbage, not a parked one.
+ *
+ *  The claim also restamps the row's `created` to `created` — birth time is a
+ *  spare's MINT time, and consumers sort conversations on it, so an hour-old
+ *  spare must not sort as an hour-old conversation. This is the one sanctioned
+ *  write of `created` after birth. */
+export declare function claimWarmSpare(recipeKey: string, created: string, opts?: {
+    deadlineAt?: string;
+    outcomeDelivery?: OutcomeDeliveryBinding;
+    requestKey?: string;
+}): string | null;
+/** How many CLAIMABLE spares are parked for `recipeKey` (the depth check a
+ *  refill reads before minting). Uses the same liveness test as the claim, so a
+ *  spare the claim would skip can never hold the pool at depth 1 and starve
+ *  every later create of a warm start. */
+export declare function warmSpareCount(recipeKey: string): number;
+/** Direct children of `id`, oldest first — an indexed point query
+ *  (`idx_nodes_parent`) instead of a full-table `listNodes()` scan. */
+export declare function childrenOf(id: string): string[];
+/** One lean roster row: only the `nodes` columns needed by the roster. Backs
+ *  `GET /v1/canvas/roster` — the recurring attach /
+ *  browser topology poll, distinct from the enriched per-row
+ *  `dashboardRowsAll`+`enrichRows` snapshot (`GET /v1/canvas/snapshot`). */
+export interface RosterRow {
+    node_id: string;
+    name: string;
+    kind: string;
+    mode: Mode;
+    lifecycle: Lifecycle;
+    status: NodeStatus;
+    cwd: string;
+    host_kind: 'tmux' | 'broker' | null;
+    parent: string | null;
+    created: string;
+}
+/** Every node's lean roster row, oldest first — a single scan indexed by
+ *  `idx_nodes_created`, with no per-row hydration or N+1 query. */
+export declare function rosterNodes(): RosterRow[];
+/** Resumable ROOT conversations pinned to `cwd`, most-recently-created first.
+ *  A "root" is the top of a spine (`parent IS NULL`) that is a real
+ *  conversation (not a `kind:'human'` ask) and still resumable (`active`/`idle`,
+ *  never a `done`/`dead`/`canceled` node). This backs the front-door
+ *  `crtr -c`/`-r` resume: cwd is the key (the Claude-Code mental model — "my
+ *  last session HERE"), so it never teleports across projects. */
+export declare function listResumableRoots(cwd: string): NodeRow[];
+export * from './tree.js';
+/** Whether a node explicitly awaits a controller that can still deliver. A
+ * parent relationship never implies this wait; the node must declare it. */
+export declare function hasLiveMessageWait(nodeId: string): boolean;
+/** Settle an explicit message wait before appending the qualifying delivery.
+ * This ordering makes the delivery's one wake observe cleared durable state. */
+export declare function setMessageWait(nodeId: string, controller: string): void;
+/** Append a qualifying delivery and settle its matching wait while holding the
+ * canvas write lock. A concurrent `node wait controller` runs before or after this whole
+ * boundary, never between the durable inbox append and its compare-and-clear. */
+export declare function deliverAndSettleMessageWait<T>(nodeId: string, from: string | null, deliver: () => T): T;
+/** Write one controller-death notice and settle only the still-current dead
+ * wait. The check, notice append, and clear share one canvas write boundary. */
+export declare function settleDeadMessageWait<T>(nodeId: string, controller: string, deliver: () => T): T | null;
+/** The outcome of {@link withFreshTerminalGuard} — exactly one of three
+ *  tagged states, never conflated:
+ *  - `'ran'`: the fresh read found a live, non-terminal row and `body` (the
+ *    guarded write) executed; its result is carried back.
+ *  - `'terminal'`: the row exists but is already terminal by `isTerminal`'s
+ *    predicate — `body` never ran. The snapshot (`status`, `final_report`) is
+ *    reported for the caller's error message.
+ *  - `'missing'`: no row for `nodeId` at all (deleted between the caller's
+ *    own selection/validation and this guard's fresh read) — `body` never ran.
+ *    A missing target is NOT a terminal target: it carries no `status`/
+ *    `final_report` to report, and every caller must fail loud with its own
+ *    not-found contract rather than treat it as either a successful run or a
+ *    terminal rejection. */
+export type TerminalGuardResult<T> = {
+    kind: 'ran';
+    result: T;
+} | {
+    kind: 'terminal';
+    status: NodeStatus;
+    final_report: string | null;
+} | {
+    kind: 'missing';
+};
+/** Close the TOCTOU between checking a target has a natural cycle ahead
+ *  of it and the write that depends on that (for example, a deferred inbox
+ *  append). Fresh-reads `nodeId`'s
+ *  (status, final_report, frozen_at) and either runs `body` (a write) or short-circuits
+ *  with a `'terminal'`/`'missing'` outcome — the read and `body`'s write share
+ *  ONE canvas write-lock boundary (`withCanvasWrite`'s `BEGIN IMMEDIATE`), so
+ *  a concurrent finish/cancel/finalization/deletion either commits entirely
+ *  before this reads (observed here, `body` never runs) or entirely after
+ *  (`body` completes uncontested) — never in the gap a separate check-then-
+ *  write left open. Pass the shared `hasNoNaturalCycle` predicate rather than
+ *  a bespoke one so the two never drift.
+ *
+ *  A dangling `nodeId` — the row deleted after the
+ *  caller's own selection but before this guard's fresh read — MUST NEVER run
+ *  `body`. Reporting `'missing'` distinctly from `'terminal'` (rather than
+ *  folding it into either the terminal branch or a fabricated "safe" empty
+ *  snapshot) keeps the two failure shapes from being conflated: a terminal
+ *  target has a real `status`/`final_report` to report and its own
+ *  `deferred_no_natural_cycle`-style rejection, while a missing target has
+ *  nothing to report and belongs to the caller's own not-found contract. */
+export declare function withFreshTerminalGuard<T>(nodeId: string, isTerminal: (row: {
+    status: NodeStatus;
+    final_report: string | null;
+    frozen_at: string | null;
+}) => boolean, body: () => T): TerminalGuardResult<T>;
+/** A node selected for pruning (or that would be, under --dry-run). */
+export interface PrunedNode {
+    node_id: string;
+    status: NodeStatus;
+    created: string;
+}
+export interface PruneResult {
+    /** The nodes pruned (or, under dryRun, the nodes that WOULD be pruned). */
+    pruned: PrunedNode[];
+    dryRun: boolean;
+}
+/** Whether a row may be removed by an automatic collection sweep. */
+export declare function isCollectible(row: NodeRow, opts?: {
+    pastTtl?: boolean;
+}): boolean;
+/** {@link deleteNode}'s result: whether it actually deleted the node. */
+export interface DeleteNodeResult {
+    deleted: boolean;
+}
+/** A node's files, located while its row still names its app. */
+export interface NodeFiles {
+    nodeId: string;
+    app: string | null;
+}
+export declare function nodeFiles(nodeId: string): NodeFiles;
+/** Remove every directory a deleted node owned. A conversation another node
+ *  still references keeps its file, and so its conversations directory. */
+export declare function removeNodeFiles(files: NodeFiles): void;
+/** Delete ONE node with what it owns ({@link deleteNodeWithOwned}) and remove its on-disk `nodes/<id>/` dir. The single-node
+ *  analogue of {@link pruneNodes}, for IMMEDIATE reaping — e.g. an empty node the
+ *  user closed or detached from. An open managed worktree is never deleted: its
+ *  node retains the ownership needed for `node worktree close`. Pure persisted-state
+ *  removal: the caller MUST have already torn down the broker engine +
+ *  viewer (this does not signal any process). The node row and its FK-coupled
+ *  state are removed in one canvas write boundary. Best-effort dir removal
+ *  follows the commit. */
+export declare function deleteNode(nodeId: string): DeleteNodeResult;
+/** Hard-delete a validated set of nodes in one row transaction, then remove
+ *  their directories. The caller must tear down engines and viewers first. */
+export declare function deleteNodes(nodeIds: readonly string[]): string[];
+/** Retention sweep: remove TERMINAL nodes (status dead | done | canceled) whose
+ *  last activity ({@link lastActivityMs}) is older than `ttlDays`, bounding the
+ *  otherwise-unbounded growth of node rows + dirs. Only {@link isCollectible}
+ *  rows qualify, and never one `held` claims. Each node is deleted with what it
+ *  owns ({@link deleteNodeWithOwned}); the on-disk `nodes/<id>/` dir is removed too.
+ *
+ *  With `includeStale`, ALSO prunes nominally-live (active | idle) nodes past the
+ *  TTL whose process is provably gone and that nothing will bring back: no live
+ *  `pi_pid`, not sleeping until a wake (`idle-release`), no unseen wake mail,
+ *  not frozen, not in respawn backoff, not an app run, not held, and never the CALLER
+ *  ($CRTR_NODE_ID). Without the flag, active | idle are NEVER touched.
+ *
+ *  Each node's rows change in its own transaction. Dir removals follow after COMMIT — the fs isn't transactional, and by then
+ *  the rows are gone, so a re-run never re-finds a half-deleted node. `dryRun`
+ *  reports the candidate set and deletes NOTHING. */
+export declare function pruneNodes(opts: {
+    ttlDays: number;
+    held: (nodeId: string) => boolean;
+    dryRun?: boolean;
+    includeStale?: boolean;
+    removeDirs?: (dirs: string[]) => void;
+}): PruneResult;
+/** A node's most recent activity (epoch ms): the latest of its lifecycle
+ *  timestamps (created, launched, settled, finalized, outcome, last run event)
+ *  and the mtime of `job/telemetry.json`, which every turn_end rewrites. 0 when
+ *  none is readable. The single clock every retention decision uses. Never throws. */
+export declare function lastActivityMs(row: Pick<NodeRow, 'node_id' | 'created' | 'launched_at' | 'last_settled_at' | 'finalized_at' | 'outcome_at' | 'last_activity_at'>): number;
+/** Count-based retention sweep: keep every row that is not collectible or that
+ *  `held` claims, plus the most recently active collectible rows up to
+ *  `maxNodes` in total, so the real retained floor is `max(maxNodes,
+ *  retainedCount)`. Bounds the growth the TTL sweep can't (a canvas that never
+ *  crosses the TTL still grows without limit). Recency is {@link lastActivityMs}.
+ *
+ *  Mirrors {@link pruneNodes} exactly for the delete (shared `deletePrunedNodes`:
+ *  transactioned row sweep + FK edge cascade + best-effort dir removal). `dryRun`
+ *  reports the candidate set and deletes NOTHING. */
+export declare function pruneToLimit(opts: {
+    maxNodes: number;
+    held: (nodeId: string) => boolean;
+    dryRun?: boolean;
+}): PruneResult;

package/dist/core/canvas/canvas.js

@@ -0,0 +1,65 @@
+var K=Object.defineProperty;var r=(e,n)=>K(e,"name",{value:n,configurable:!0});import{prepared as a}from"../sqlite-statements.js";import{envNodeId as k}from"../../shared/env.js";import{rmdirSync as Z,rmSync as ee,statSync as ne}from"node:fs";import{dirname as te,join as x,resolve as oe}from"node:path";import{removeTreeBeneath as W}from"../spaces/open-beneath.js";import{emitEvent as re}from"../events/emit.js";import{openDb as d,prepared as j,withCanvasWrite as c}from"./db.js";import{conversationStore as ie,ConversationNotFoundError as se}from"../conversation-store/index.js";import{hasUnseenWakeMail as ae}from"./deliveries.js";import{isAppRun as H}from"./app-run.js";import{registerOutcomeAction as F}from"./outcome-actions.js";import{publish as de}from"../graph/events.js";import{nodeObject as le}from"../graph/objects.js";import{findNodeBySessionFileSql as ue}from"./sessions.js";import{hydrateFault as _e}from"./recovery.js";import{hasUnreconciledWorktree as ce,openWorktree as pe,readWorktree as fe,worktreeFromRow as Ee}from"./worktrees.js";import{isPidAlive as me,isPidPresent as b,recordedPidLiveness as Ne}from"./pid.js";import{ensureHome as Re,jobDir as ye,nodeDir as we,nodeRunDir as I}from"./paths.js";import{appForNode as Se,ensureNodeDirs as ge,nodeAgentDir as Oe}from"./node-agent-paths.js";import{appSpace as C}from"../layout.js";import{createObject as Te,getById as U,ownerForGrantee as M,setObjectKind as he,setObjectName as Le}from"../graph/objects.js";import{deleteNodeWithOwned as De}from"../graph/deletion.js";function m(e,n){if(e==null)return null;const t=JSON.stringify(e);if(t===void 0)throw new TypeError(`${n} must be JSON-serializable`);return t}r(m,"jsonValue");function on(e,n){if(a(e,"SELECT deleting_at FROM nodes WHERE node_id = ?").get(n)?.deleting_at)throw new Error("run is deleting")}r(on,"assertRunNotDeleting");function ve(e,n){const t=M(n,e.grantee??"app:terminal");Te(n,{id:e.node_id,type:"node",kind:e.kind,owner:t.rowid,privacy:"public",name:e.name,preview:""}),a(n,`INSERT INTO nodes (node_id, description, title, icon, cycles, mode, lifecycle, cwd, host_kind, profile_id, parent, spawned_by, creator, fork_from, fork_source_file, created, passive_default, cycle_pending, model_override, persona_ack_json, review_binding_json, launch_config_json, scopes_json, isolated, status, intent, waiting_for, final_report, finalized_at, deadline_at, "window", tmux_session, pane, sub, grant_id, client_id, metadata_json, run_id, event_cursor, usage_json, deleting_at) VALUES (${Array(41).fill("?").join(", ")})`).run(e.node_id,e.description??null,e.title??null,e.icon??null,e.cycles??null,e.mode,e.lifecycle,e.cwd,e.host_kind??null,e.profile_id??null,e.parent??null,e.spawned_by??null,e.creator??null,e.fork_from??null,e.fork_source_file??null,e.created,e.passive_default===!0?1:0,e.cycle_pending===!0?1:0,e.model_override??null,m(e.persona_ack,"persona_ack"),m(e.review_binding,"review_binding"),m(e.launch,"launch"),m(e.scopes,"scopes"),e.isolated===!0?1:0,e.status??"active",e.intent??null,e.waiting_for??null,e.final_report??null,e.finalized_at??null,e.deadline_at??null,e.window??null,e.tmux_session??null,e.pane??null,e.sub??null,e.grant_id??null,e.client_id??null,e.metadata_json??null,e.run_id??null,e.event_cursor??null,e.usage_json??null,e.deleting_at??null)}r(ve,"seedRow");function P(e){if(e.fault_id==null)return null;const n=Object.entries(e).filter(([t])=>t.startsWith("fault_")).map(([t,o])=>[t==="fault_id"?t:t.slice(6),o]);return _e(Object.fromEntries(n))}r(P,"faultFrom");function f(e){const n={node_id:e.node_id,name:e.name,description:e.description??void 0,cycles:e.cycles??void 0,kind:e.kind,mode:e.mode,lifecycle:e.lifecycle,status:e.status,cwd:e.cwd,host_kind:e.host_kind??null,profile_id:e.profile_id??null,scopes:e.scopes_json==null?null:JSON.parse(e.scopes_json),isolated:e.isolated===1,grantee:e.grantee,sub:e.sub??null,grant_id:e.grant_id??null,client_id:e.client_id??null,metadata_json:e.metadata_json??null,run_id:e.run_id??null,event_cursor:e.event_cursor??null,last_activity_at:e.last_activity_at??null,usage_json:e.usage_json??null,last_turn_error_json:e.last_turn_error_json??null,deleting_at:e.deleting_at??null,parent:e.parent??null,created:e.created,intent:e.intent??null,waiting_for:e.waiting_for??null,frozen_at:e.frozen_at??null,respawn_failures:e.respawn_failures??0,respawn_not_before:e.respawn_not_before??null,launched_at:e.launched_at??null,last_settled_at:e.last_settled_at??null,terminal_reason:e.terminal_reason??null,final_report:e.final_report??null,finalized_at:e.finalized_at??null,outcome_kind:e.outcome_kind??null,outcome_reason:e.outcome_reason??null,outcome_at:e.outcome_at??null,outcome_revision:e.outcome_revision??0,outcome_detail_json:e.outcome_detail_json??null,deadline_at:e.deadline_at??null,telemetry_tokens_in:e.telemetry_tokens_in??null,telemetry_context_tokens:e.telemetry_context_tokens??null,telemetry_last_activity:e.telemetry_last_activity??null,telemetry_updated_at:e.telemetry_updated_at??null,pi_pid:e.pi_pid??null,pi_pid_identity:e.pi_pid_identity??null,window:e.window??null,tmux_session:e.tmux_session??null,pane:e.pane??null,fault:null,streaming:!1},t=b(n.pi_pid),o=P(e);return n.fault=o?.link==="pi\u2192provider"&&o.retry.by==="daemon"&&o.retry.disposition==="auto"&&!t?null:o,n.streaming=e.turn_open_at!==null&&e.turn_closed_at===null&&t,n}r(f,"rowFrom");function q(e,n=fe(e.node_id)){return{...f(e),title:e.title??void 0,icon:e.icon??void 0,spawned_by:e.spawned_by??null,creator:e.creator??null,fork_from:e.fork_from??null,fork_source_file:e.fork_source_file??null,passive_default:e.passive_default===1,cycle_pending:e.cycle_pending===1,model_override:e.model_override??null,scopes:e.scopes_json==null?null:JSON.parse(e.scopes_json),persona_ack:e.persona_ack_json==null?void 0:JSON.parse(e.persona_ack_json),review_binding:e.review_binding_json==null?void 0:JSON.parse(e.review_binding_json),launch:e.launch_config_json==null?void 0:JSON.parse(e.launch_config_json),pi_session_id:e.pi_session_id??null,pi_session_file:e.pi_session_file??null,...n===null?{}:{managed_worktree:n}}}r(q,"metaFrom");function rn(e,n={}){return Re(),c(t=>{ve(e,t),e.managed_worktree!==void 0&&e.managed_worktree!==null&&pe(e.node_id,e.managed_worktree,t),n.outcomeDelivery!==void 0&&F(t,e.node_id,n.outcomeDelivery),n.withinCreate?.(t,e)}),ge(e.node_id),R(e.node_id)}r(rn,"createNode");function R(e){const n=j(d(),"SELECT * FROM node_rows WHERE node_id = ?").get(e);return n===void 0?null:q(n)}r(R,"getNode");const Ae=1440*60*1e3;function $(e){return{requestKey:e.request_key,nodeId:e.node_id,state:e.state}}r($,"createRequestRecord");function sn(e){const n=d().prepare("SELECT request_key, node_id, state FROM create_requests WHERE request_key = ?").get(e);return n===void 0?null:$(n)}r(sn,"findCreateRequest");function an(e){return c(n=>{const t=Date.now();n.prepare("DELETE FROM create_requests WHERE expires_at <= ?").run(t);const o=n.prepare("SELECT request_key, node_id, state FROM create_requests WHERE request_key = ?").get(e);return o!==void 0?$(o):(n.prepare("INSERT INTO create_requests (request_key, node_id, expires_at, state) VALUES (?, NULL, ?, 'reserved')").run(e,t+Ae),{requestKey:e,nodeId:null,state:"reserved"})})}r(an,"reserveCreateRequest");function dn(e=Date.now()){return c(n=>Number(n.prepare("DELETE FROM create_requests WHERE expires_at <= ?").run(e).changes))}r(dn,"pruneExpiredCreateRequests");function ln(e,n){c(t=>{t.prepare("UPDATE create_requests SET node_id = ?, state = 'complete' WHERE request_key = ?").run(n,e)})}r(ln,"recordCreateRequestNode");function un(e,n){c(t=>{t.prepare("UPDATE create_requests SET node_id = ?, state = 'reserved' WHERE request_key = ?").run(n,e)})}r(un,"reserveCreateRequestNode");function _n(e,n){c(t=>{t.prepare("UPDATE create_requests SET state = 'complete' WHERE request_key = ? AND node_id = ?").run(e,n)})}r(_n,"completeCreateRequest");function cn(e,n){c(t=>{if(n===null){t.prepare("DELETE FROM create_requests WHERE request_key = ? AND node_id IS NULL").run(e);return}t.prepare("DELETE FROM create_requests WHERE request_key = ? AND node_id = ?").run(e,n)})}r(cn,"abandonCreateRequest");function pn(e){return oe(e)}r(pn,"canonicalSessionFile");function fn(e){const n=ue(e);return n===null?null:R(n)}r(fn,"findNodeBySessionFile");function En(e){const n=a(d(),"SELECT * FROM node_rows WHERE node_id = ?").get(e);return n?f(n):null}r(En,"getRow");function mn(e){const n=a(d(),"SELECT * FROM node_rows WHERE pane = ?").get(e);return n?f(n):null}r(mn,"getRowByPane");function Nn(e){return a(d(),`SELECT * FROM node_rows
+     WHERE deadline_at IS NOT NULL AND outcome_at IS NULL
+       AND deadline_at <= ? AND status IN ('active','idle') AND kind != 'human'
+     ORDER BY deadline_at, created, node_id`).all(e).map(f)}r(Nn,"dueNodeDeadlines");function Rn(e,n){return Number(a(d(),"UPDATE nodes SET deadline_at = ? WHERE node_id = ?").run(n,e).changes)===1}r(Rn,"setNodeDeadline");function yn(e,n){return!Number.isFinite(n)||n<=0?0:c(t=>{const o=a(t,`SELECT node_id, deadline_at FROM nodes
+       WHERE profile_id = ? AND deadline_at IS NOT NULL AND status IN ('active', 'idle')`).all(e),i=a(t,"UPDATE nodes SET deadline_at = ? WHERE node_id = ? AND deadline_at = ?");let s=0;for(const l of o){const u=Date.parse(l.deadline_at);Number.isNaN(u)||(s+=Number(i.run(new Date(u+n).toISOString(),l.node_id,l.deadline_at).changes))}return s})}r(yn,"shiftProfileNodeDeadlines");function wn(e,n,t){const o=`SELECT o.rowid FROM objects o JOIN identities i ON i.object = o.owner
+    WHERE o.type = 'node' AND i.scheme = 'local-user' AND i.external_id = 'user:local'`,s=e.prepare(`${o} LIMIT 1`).get()!==void 0?Number(e.prepare(`UPDATE objects SET owner = ? WHERE rowid IN (${o})`).run(M(e,"app:terminal").rowid).changes):0;return Number(a(e,"UPDATE nodes SET sub = ? WHERE sub = 'user:local'").run(n).changes)+s+Number(a(e,`UPDATE nodes SET sub = ? WHERE sub IS NULL AND node_id IN (
+        SELECT o.id FROM objects o JOIN identities i ON i.object = o.owner
+        WHERE o.type = 'node' AND i.scheme = 'app' AND i.external_id = 'app:terminal')`).run(n).changes)+Number(a(e,"UPDATE nodes SET grant_id = NULL WHERE grant_id = ?").run(t).changes)}r(wn,"rewriteLocalNodeIdentity");function g(e,n){if(e==null)return null;if(typeof e=="string"||typeof e=="number"||typeof e=="bigint"||e instanceof Uint8Array)return e;throw new TypeError(`${n} must be a SQLite scalar`)}r(g,"sqlInput");function Sn(e,n){const t=[],o=r((s,l=s)=>{Object.prototype.hasOwnProperty.call(n,s)&&t.push([l,g(n[s],s)])},"add");if(o("description"),o("title"),o("icon"),o("cycles"),o("mode"),o("lifecycle"),o("cwd"),o("host_kind"),o("profile_id"),o("parent"),o("spawned_by"),o("creator"),o("fork_from"),o("fork_source_file"),o("model_override"),Object.prototype.hasOwnProperty.call(n,"passive_default")&&t.push(["passive_default",n.passive_default===!0?1:0]),Object.prototype.hasOwnProperty.call(n,"cycle_pending")&&t.push(["cycle_pending",n.cycle_pending===!0?1:0]),Object.prototype.hasOwnProperty.call(n,"persona_ack")&&t.push(["persona_ack_json",m(n.persona_ack,"persona_ack")]),Object.prototype.hasOwnProperty.call(n,"review_binding")&&t.push(["review_binding_json",m(n.review_binding,"review_binding")]),Object.prototype.hasOwnProperty.call(n,"isolated"))throw new TypeError("isolated cannot change after node creation");Object.prototype.hasOwnProperty.call(n,"scopes")&&t.push(["scopes_json",m(n.scopes,"scopes")]),Object.prototype.hasOwnProperty.call(n,"launch")&&t.push(["launch_config_json",m(n.launch,"launch")]);const i=r(s=>Object.prototype.hasOwnProperty.call(n,s),"has");return c(s=>{const l=U(s,e);if(l===null||l.type!=="node")throw new Error(`unknown node: ${e}`);if(i("name")&&Le(s,l,g(n.name,"name")),i("kind")&&he(s,l,g(n.kind,"kind")),t.length===0)return;if(s.prepare(`UPDATE nodes SET ${t.map(([p])=>`${p} = ?`).join(", ")} WHERE node_id = ?`).run(...t.map(([,p])=>p),e).changes!==1)throw new Error(`unknown node: ${e}`)}),R(e)}r(Sn,"updateNode");function gn(e,n){a(d(),"UPDATE nodes SET status = ? WHERE node_id = ?").run(n,e)}r(gn,"setStatus");function On(e,n){a(d(),"UPDATE nodes SET intent = ? WHERE node_id = ?").run(n??null,e)}r(On,"setIntent");function Tn(e,n,t={}){if(t.outcome===void 0){const i=[],s=[];Object.prototype.hasOwnProperty.call(n,"status")&&(i.push("status = ?"),s.push(n.status??null)),Object.prototype.hasOwnProperty.call(n,"intent")&&(i.push("intent = ?"),s.push(n.intent??null)),Object.prototype.hasOwnProperty.call(n,"terminal_reason")&&(i.push("terminal_reason = ?"),s.push(n.terminal_reason??null));const l=["node_id = ?"];s.push(e),t.fromStatuses!==void 0&&(l.push(`status IN (${t.fromStatuses.map(()=>"?").join(", ")})`),s.push(...t.fromStatuses)),t.requireNoFinalReport===!0&&l.push("final_report IS NULL");const u=d().prepare(`UPDATE nodes SET ${i.join(", ")} WHERE ${l.join(" AND ")}`).run(...s);return Number(u.changes)}const o=t.outcome;return c(i=>{const s=[],l=[];Object.prototype.hasOwnProperty.call(n,"status")&&(s.push("status = ?"),l.push(n.status??null)),Object.prototype.hasOwnProperty.call(n,"intent")&&(s.push("intent = ?"),l.push(n.intent??null)),Object.prototype.hasOwnProperty.call(n,"terminal_reason")&&(s.push("terminal_reason = ?"),l.push(n.terminal_reason??null));const u=r((y,_)=>o.supersede===!0?"?":`CASE WHEN outcome_at IS NULL THEN ? ELSE ${_} END`,"outcomeValue");s.push(`outcome_kind = ${u(o.kind,"outcome_kind")}`,`outcome_reason = ${u(o.reason,"outcome_reason")}`,`outcome_detail_json = ${u(o.detailJson,"outcome_detail_json")}`,`outcome_revision = ${o.supersede===!0?"outcome_revision + 1":"CASE WHEN outcome_at IS NULL THEN outcome_revision + 1 ELSE outcome_revision END"}`,`outcome_at = ${u(o.at,"outcome_at")}`),l.push(o.kind,o.reason,o.detailJson,o.at);const p=["node_id = ?"];l.push(e),t.fromStatuses!==void 0&&(p.push(`status IN (${t.fromStatuses.map(()=>"?").join(", ")})`),l.push(...t.fromStatuses)),t.requireNoFinalReport===!0&&p.push("final_report IS NULL");const E=i.prepare(`UPDATE nodes SET ${s.join(", ")} WHERE ${p.join(" AND ")}`).run(...l);if(Number(E.changes)===0)return 0;const S=a(i,"SELECT outcome_at FROM nodes WHERE node_id = ?").get(e);return(o.supersede===!0||S.outcome_at===o.at)&&o.documentJson!==null&&o.documentJson!==void 0&&de(i,{event:"outcome",object:le(i,e),actor:null,attrs:{revision:Number(a(i,"SELECT outcome_revision FROM nodes WHERE node_id = ?").get(e).outcome_revision)},messageBody:JSON.parse(o.documentJson)}),Number(E.changes)})}r(Tn,"transitionStatusIntent");function hn(e){return a(d(),"SELECT final_report FROM nodes WHERE node_id = ?").get(e)?.final_report??null}r(hn,"getFinalReport");function Ln(e,n){return a(d(),"UPDATE nodes SET final_report = NULL, finalized_at = NULL WHERE node_id = ? AND final_report = ?").run(e,n).changes>0}r(Ln,"clearFinalReportIfMatches");function Dn(e,n){a(d(),'UPDATE nodes SET tmux_session = ?, "window" = ?, pane = ? WHERE node_id = ?').run(n.tmux_session??null,n.window??null,n.pane??null,e)}r(Dn,"setPresence");function vn(e,n){a(d(),"UPDATE nodes SET launched_at = ?, frozen_at = NULL, respawn_not_before = NULL WHERE node_id = ?").run(n,e)}r(vn,"recordLaunch");function An(e,n){a(d(),"UPDATE nodes SET last_settled_at = ? WHERE node_id = ?").run(n,e)}r(An,"recordSettledTurn");function kn(e,n){a(d(),"UPDATE nodes SET frozen_at = ? WHERE node_id = ?").run(n,e)}r(kn,"setFrozen");function xn(e){a(d(),"UPDATE nodes SET frozen_at = NULL WHERE node_id = ?").run(e)}r(xn,"clearFrozen");function Wn(e,n){a(d(),"UPDATE nodes SET respawn_failures = ?, respawn_not_before = ? WHERE node_id = ?").run(n.failures,n.notBefore,e)}r(Wn,"recordRespawnAttempt");const N="node_id NOT IN (SELECT node_id FROM warm_pool)",z=["state","cleanup_state","path","branch","repo_root","base_ref","base_sha","created_at","closed_at","next_attempt_at","attempts","quarantined","sweep_reason","sweep_detail","sweep_last_at","sweep_observed_json","abandoned_json","land_intent_json","disposal_json"];function ke(e){return e.worktree_state===null?null:Ee(Object.fromEntries(z.map(n=>[n,e[`worktree_${n}`]])))}r(ke,"worktreeFromProjection");function jn(e){const n=z.map(o=>`w.${o} AS worktree_${o}`).join(", ");return d().prepare(`SELECT n.*, ${n} FROM node_rows n LEFT JOIN worktrees w ON w.node_id = n.node_id WHERE n.profile_id = ? ORDER BY n.created`).all(e).map(o=>q(o,ke(o)))}r(jn,"listNodesByProfile");function Hn(){const e=d();return j(e,`SELECT
+      node_id, name, description, kind, mode, lifecycle, status, cwd, profile_id,
+      grantee, parent, created, frozen_at, terminal_reason, final_report,
+      telemetry_tokens_in, telemetry_updated_at, pi_pid, turn_open_at, turn_closed_at,
+      fault_id, fault_link, fault_op, fault_kind, fault_message, fault_since,
+      fault_operation_id, fault_anchor_entry_id, fault_retry_disposition,
+      fault_retry_by, fault_retry_attempt, fault_retry_max, fault_retry_next_at,
+      fault_provider_error_json
+    FROM node_rows WHERE ${N} ORDER BY created`).all().map(f)}r(Hn,"browseNodes");function Fn(e,n){a(d(),`UPDATE nodes
+    SET telemetry_tokens_in = ?,
+        telemetry_context_tokens = COALESCE(?, telemetry_context_tokens),
+        telemetry_last_activity = COALESCE(?, telemetry_last_activity),
+        telemetry_updated_at = ?
+    WHERE node_id = ?
+      AND (telemetry_updated_at IS NULL OR telemetry_updated_at < ?)`).run(n.tokensIn,n.contextTokens,n.lastActivity,n.updatedAt,e,n.updatedAt)}r(Fn,"updateNodeTelemetry");function bn(){return a(d(),`SELECT
+      node_id, name, description, cycles, kind, status, frozen_at,
+      telemetry_context_tokens, telemetry_last_activity,
+      pi_pid, turn_open_at, turn_closed_at,
+      fault_id, fault_link, fault_op, fault_kind, fault_message, fault_since,
+      fault_operation_id, fault_anchor_entry_id, fault_retry_disposition,
+      fault_retry_by, fault_retry_attempt, fault_retry_max, fault_retry_next_at,
+      fault_provider_error_json
+    FROM node_rows WHERE ${N} ORDER BY created`).all().map(n=>{const t=n.pi_pid??null,o=b(t),i=P(n);return{node_id:n.node_id,name:n.name,description:n.description??null,cycles:n.cycles??null,kind:n.kind,status:n.status,frozen_at:n.frozen_at??null,pi_pid:t,telemetry_context_tokens:n.telemetry_context_tokens??null,telemetry_last_activity:n.telemetry_last_activity??null,fault:i?.link==="pi\u2192provider"&&i.retry.by==="daemon"&&i.retry.disposition==="auto"&&!o?null:i,streaming:n.turn_open_at!==null&&n.turn_closed_at===null&&o}})}r(bn,"graphNodes");function xe(e){const n=[N],t=[];if(e?.status!==void 0){const i=Array.isArray(e.status)?e.status:[e.status];n.push(`status IN (${i.map(()=>"?").join(",")})`),t.push(...i)}return e?.withRecordedPid===!0&&n.push("pi_pid IS NOT NULL"),e?.withRecordedPidOrFrozen===!0&&n.push("(pi_pid IS NOT NULL OR frozen_at IS NOT NULL)"),d().prepare(`SELECT * FROM node_rows WHERE ${n.join(" AND ")} ORDER BY created`).all(...t).map(f)}r(xe,"listNodes");const We=`SELECT
+      node_id, created, launched_at, last_settled_at, finalized_at,
+      outcome_at, last_activity_at, pane, "window", tmux_session
+    FROM nodes INDEXED BY idx_nodes_terminal_placement_created
+    WHERE ${N}
+      AND status IN ('done', 'canceled', 'dead')
+      AND (pane IS NOT NULL OR "window" IS NOT NULL OR tmux_session IS NOT NULL)
+    ORDER BY created`;function In(){return a(d(),We).all()}r(In,"listTerminalPlacementResidue");const je=`WITH candidates AS MATERIALIZED (
+    SELECT node_id FROM nodes WHERE status IN ('active', 'idle')
+    UNION
+    SELECT node_id FROM nodes INDEXED BY idx_nodes_supervision_frozen
+      WHERE frozen_at IS NOT NULL AND status IN ('done', 'canceled', 'dead')
+    UNION
+    SELECT node_id FROM executions
+      WHERE state != 'exited' AND state = 'running' AND pid IS NOT NULL
+  )
+  SELECT v.* FROM candidates c CROSS JOIN node_rows v
+  WHERE v.node_id = c.node_id
+    AND v.node_id NOT IN (SELECT node_id FROM warm_pool)
+    AND v.kind != 'human'
+    AND (v.status IN ('active', 'idle') OR (v.status IN ('done', 'canceled', 'dead') AND (v.pi_pid IS NOT NULL OR v.frozen_at IS NOT NULL)))
+  ORDER BY v.created`;function Cn(){return a(d(),je).all().map(f)}r(Cn,"listNodesForSupervision");function Un(){return a(d(),`SELECT node_id, name, created, grantee FROM node_rows WHERE ${N} ORDER BY created`).all()}r(Un,"listNodeIdentities");function Mn(e,n){c(t=>{a(t,"INSERT OR REPLACE INTO warm_pool (node_id, recipe_key, created) VALUES (?, ?, ?)").run(e,n,new Date().toISOString())})}r(Mn,"registerWarmSpare");function Pn(e){return c(n=>a(n,"DELETE FROM warm_pool WHERE node_id = ?").run(e).changes>0)}r(Pn,"unregisterWarmSpare");function O(e,n){const t=`SELECT w.node_id AS node_id, w.recipe_key AS recipe_key, w.created AS created,
+            n.status AS status, n.pi_pid AS pi_pid, n.pi_pid_identity AS pi_pid_identity
+       FROM warm_pool w JOIN node_rows n ON n.node_id = w.node_id`+(n===void 0?"":" WHERE w.recipe_key = ?")+" ORDER BY w.created";return(n===void 0?e.prepare(t).all():e.prepare(t).all(n)).map(i=>({node_id:i.node_id,recipe_key:i.recipe_key,created:i.created,status:i.status,pi_pid:i.pi_pid??null,pi_pid_identity:i.pi_pid_identity??null}))}r(O,"warmSpareRowsFor");function qn(){return O(d())}r(qn,"listWarmSpares");function $n(e){return a(d(),"SELECT 1 FROM warm_pool WHERE node_id = ?").get(e)!==void 0}r($n,"isWarmSpare");function B(e){return e.status!=="active"&&e.status!=="idle"?!1:Ne(e.pi_pid,e.pi_pid_identity)==="alive"}r(B,"spareIsClaimable");function zn(e,n,t={}){return c(o=>{const i=O(o,e).find(B);return i===void 0||t.requestKey!==void 0&&o.prepare("UPDATE create_requests SET node_id = ?, state = 'warm_claimed' WHERE request_key = ? AND node_id IS NULL").run(i.node_id,t.requestKey).changes===0||a(o,"DELETE FROM warm_pool WHERE node_id = ?").run(i.node_id).changes===0?null:(a(o,"UPDATE nodes SET created = ?, deadline_at = ? WHERE node_id = ?").run(n,t.deadlineAt??null,i.node_id),t.outcomeDelivery!==void 0&&F(o,i.node_id,t.outcomeDelivery),i.node_id)})}r(zn,"claimWarmSpare");function Bn(e){return O(d(),e).filter(B).length}r(Bn,"warmSpareCount");function Jn(e){return a(d(),"SELECT node_id FROM nodes WHERE parent = ? ORDER BY created").all(e).map(n=>n.node_id)}r(Jn,"childrenOf");function Yn(){return d().prepare(`SELECT node_id, name, kind, mode, lifecycle, status, cwd, host_kind, parent, created
+         FROM node_rows WHERE ${N} ORDER BY created`).all().map(e=>({node_id:e.node_id,name:e.name,kind:e.kind,mode:e.mode,lifecycle:e.lifecycle,status:e.status,cwd:e.cwd,host_kind:e.host_kind??null,parent:e.parent??null,created:e.created}))}r(Yn,"rosterNodes");function Vn(e){return d().prepare(`SELECT * FROM node_rows
+        WHERE parent IS NULL AND kind != 'human'
+          AND status IN ('active','idle') AND cwd = ?
+          AND ${N}
+        ORDER BY created DESC`).all(e).map(f)}r(Vn,"listResumableRoots");export*from"./tree.js";function Xn(e){const n=R(e)?.waiting_for;if(n==null)return!1;const t=R(n);return t!==null&&(t.status==="active"||t.status==="idle")}r(Xn,"hasLiveMessageWait");function Gn(e,n){a(d(),"UPDATE nodes SET waiting_for = ?, waiting_for_generation = waiting_for_generation + 1 WHERE node_id = ?").run(n,e)}r(Gn,"setMessageWait");function Qn(e,n,t){return c(o=>{const i=a(o,"SELECT waiting_for_generation FROM nodes WHERE node_id = ? AND waiting_for = ?").get(e,n),s=t();return n!==null&&i!==void 0&&a(o,"UPDATE nodes SET waiting_for = NULL WHERE node_id = ? AND waiting_for = ? AND waiting_for_generation = ?").run(e,n,i.waiting_for_generation),s})}r(Qn,"deliverAndSettleMessageWait");function Kn(e,n,t){return c(o=>{const i=a(o,`SELECT waiter.waiting_for, waiter.waiting_for_generation, target.status AS controller_status
+       FROM nodes AS waiter LEFT JOIN nodes AS target ON target.node_id = waiter.waiting_for
+       WHERE waiter.node_id = ?`).get(e),s=i?.controller_status==="active"||i?.controller_status==="idle";if(i?.waiting_for!==n||s)return null;const l=t();return a(o,"UPDATE nodes SET waiting_for = NULL WHERE node_id = ? AND waiting_for = ? AND waiting_for_generation = ?").run(e,n,i.waiting_for_generation),l})}r(Kn,"settleDeadMessageWait");function Zn(e,n,t){return c(o=>{const i=a(o,"SELECT status, final_report, frozen_at FROM nodes WHERE node_id = ?").get(e);return i===void 0?{kind:"missing"}:n(i)?{kind:"terminal",status:i.status,final_report:i.final_report}:{kind:"ran",result:t()}})}r(Zn,"withFreshTerminalGuard");function w(e){return ce(e)}r(w,"hasUnreconciledManagedWorktree");function J(e,n={}){return!["done","dead","canceled"].includes(e.status)||e.pi_pid!==null||e.frozen_at!==null||w(e.node_id)||e.node_id===k()||H(e)?!1:n.pastTtl===!0||!["crashed","stranded",null].includes(e.terminal_reason??null)}r(J,"isCollectible");function T(e){if(e.length===0)return[];const n=e.map(()=>"?").join(",");return d().prepare(`SELECT DISTINCT session_id FROM sessions WHERE node_id IN (${n}) AND session_id IS NOT NULL`).all(...e).map(({session_id:o})=>o)}r(T,"nodeConversationIds");function h(e){const n=d(),t=a(n,"SELECT 1 FROM sessions WHERE session_id = ? LIMIT 1"),o=a(n,`SELECT 1 FROM nodes n WHERE n.fork_source_file LIKE '%\\_' || ? || '.jsonl' ESCAPE '\\'
+    AND NOT EXISTS (SELECT 1 FROM sessions s WHERE s.node_id = n.node_id) LIMIT 1`);for(const i of e)if(!(t.get(i)!==void 0||o.get(i)!==void 0))try{ie().delete(i)}catch(s){if(!(s instanceof se))throw s}}r(h,"deleteNodeConversations");function L(e,n){const t=U(e,n);return t===null||t.deleted_at!==null?!1:(De(e,t),!0)}r(L,"deleteNodeObject");function D(e){return{nodeId:e,app:R(e)===null?null:Se(e)}}r(D,"nodeFiles");function Y({nodeId:e,app:n}){n!==null&&W(C(n).nodes,Oe(e,n)),W(te(I(e)),I(e))}r(Y,"removeNodeAppTrees");function V({nodeId:e}){return[we(e)]}r(V,"nodeOwnedDirs");function X({nodeId:e,app:n}){if(n!==null)try{Z(x(C(n).conversations,e))}catch(t){if(!["ENOENT","ENOTEMPTY"].includes(t.code??""))throw t}}r(X,"removeNodeConversationDir");function v(e){Y(e);for(const n of V(e))ee(n,{recursive:!0,force:!0});X(e)}r(v,"removeNodeFiles");function et(e){if(w(e))return{deleted:!1};const n=D(e),t=T([e]),o=c(i=>(L(i,e),{deleted:!0}));return h(t),v(n),o}r(et,"deleteNode");function nt(e){const n=[...new Set(e)];if(n.length===0)return[];const t=n.filter(w);if(t.length>0)throw new Error(`refusing to delete nodes with unreconciled managed worktrees: ${t.join(", ")}`);const o=n.map(D),i=T(n),s=n.map(()=>"?").join(","),u=d().prepare(`SELECT node_id FROM nodes WHERE node_id IN (${s}) ORDER BY created`).all(...n).map(({node_id:p})=>p).filter(p=>c(E=>L(E,p)));h(i);for(const p of u){const E=o[n.indexOf(p)];A(E,()=>v(E))}return u}r(nt,"deleteNodes");function tt(e){const n=e.dryRun??!1,t=e.includeStale??!1,o=Date.now()-e.ttlDays*864e5,i=new Date(o).toISOString(),s=k()??"",l=d(),u=r(_=>Q(_)<o,"quiet"),p=r(_=>({node_id:_.node_id,status:_.status,created:_.created}),"toPruned"),E=a(l,`SELECT * FROM node_rows
+       WHERE status IN ('dead', 'done', 'canceled') AND created < ?
+       ORDER BY created`).all(i).map(f).filter(_=>J(_,{pastTtl:!0})&&u(_)&&!e.held(_.node_id)).map(p),S=t?a(l,`SELECT * FROM node_rows
+       WHERE status IN ('active', 'idle') AND created < ?
+       ORDER BY created`).all(i).map(f).filter(_=>_.node_id!==s&&!me(_.pi_pid??null)&&(_.frozen_at??null)===null&&(_.respawn_not_before??null)===null&&_.intent!=="idle-release"&&!H(_)&&!ae(_.node_id)&&!w(_.node_id)&&u(_)&&!e.held(_.node_id)).map(p):[],y=[...E,...S];return n||y.length===0?{pruned:y,dryRun:n}:(G(y,e.removeDirs),{pruned:y,dryRun:n})}r(tt,"pruneNodes");function G(e,n){if(e.length===0)return;const t=e.map(i=>D(i.node_id)),o=T(e.map(i=>i.node_id));for(const i of e)c(s=>L(s,i.node_id));if(h(o),n!==void 0){for(const i of t)A(i,()=>{Y(i),X(i)});n(t.flatMap(V));return}for(const i of t)A(i,()=>v(i))}r(G,"deletePrunedNodes");function A(e,n){try{n()}catch(t){re({level:"error",event:"canvas.node_files.remove_failed",error:t,fields:{node_id:e.nodeId}})}}r(A,"eachNodeBestEffort");function Q(e){let n=0;for(const t of[e.created,e.launched_at,e.last_settled_at,e.finalized_at,e.outcome_at,e.last_activity_at]){if(t==null)continue;const o=Date.parse(t);Number.isFinite(o)&&o>n&&(n=o)}try{const t=ne(x(ye(e.node_id),"telemetry.json"),{throwIfNoEntry:!1});t!==void 0&&t.mtimeMs>n&&(n=t.mtimeMs)}catch{}return n}r(Q,"lastActivityMs");function ot(e){const n=e.dryRun??!1,t=xe(),o=t.filter(u=>J(u)&&!e.held(u.node_id)),i=t.length-o.length,s=Math.max(0,e.maxNodes-i),l=o.map(u=>({row:u,recency:Q(u)})).sort((u,p)=>p.recency-u.recency).slice(s).map(({row:u})=>({node_id:u.node_id,status:u.status,created:u.created}));return n||l.length===0?{pruned:l,dryRun:n}:(G(l),{pruned:l,dryRun:n})}r(ot,"pruneToLimit");export{cn as abandonCreateRequest,on as assertRunNotDeleting,Hn as browseNodes,pn as canonicalSessionFile,Jn as childrenOf,zn as claimWarmSpare,Ln as clearFinalReportIfMatches,xn as clearFrozen,_n as completeCreateRequest,rn as createNode,et as deleteNode,nt as deleteNodes,Qn as deliverAndSettleMessageWait,Nn as dueNodeDeadlines,sn as findCreateRequest,fn as findNodeBySessionFile,hn as getFinalReport,R as getNode,En as getRow,mn as getRowByPane,bn as graphNodes,Xn as hasLiveMessageWait,J as isCollectible,$n as isWarmSpare,Q as lastActivityMs,Un as listNodeIdentities,xe as listNodes,jn as listNodesByProfile,Cn as listNodesForSupervision,Vn as listResumableRoots,In as listTerminalPlacementResidue,qn as listWarmSpares,D as nodeFiles,je as nodesForSupervisionSql,dn as pruneExpiredCreateRequests,tt as pruneNodes,ot as pruneToLimit,ln as recordCreateRequestNode,vn as recordLaunch,Wn as recordRespawnAttempt,An as recordSettledTurn,Mn as registerWarmSpare,v as removeNodeFiles,an as reserveCreateRequest,un as reserveCreateRequestNode,wn as rewriteLocalNodeIdentity,Yn as rosterNodes,kn as setFrozen,On as setIntent,Gn as setMessageWait,Rn as setNodeDeadline,Dn as setPresence,gn as setStatus,Kn as settleDeadMessageWait,yn as shiftProfileNodeDeadlines,We as terminalPlacementResidueSql,Tn as transitionStatusIntent,Pn as unregisterWarmSpare,Sn as updateNode,Fn as updateNodeTelemetry,Bn as warmSpareCount,Zn as withFreshTerminalGuard};

package/dist/core/canvas/context-strip.d.ts

@@ -0,0 +1,20 @@
+/** Files larger than this are replaced with a tombstone. */
+export declare const CONTEXT_STRIP_FILE_LIMIT_BYTES: number;
+/** The directory tombstone's file name; a directory whose only entry is this file is already stripped. */
+export declare const CONTEXT_TOMBSTONE_NAME = "REMOVED.md";
+export interface StrippedEntry {
+    /** Path relative to the context folder. */
+    path: string;
+    bytes: number;
+    reason: string;
+}
+export interface ContextStripResult {
+    removed: StrippedEntry[];
+    bytes: number;
+}
+/** When this node's context folder was last stripped (epoch ms), or null. */
+export declare function lastContextStripMs(nodeId: string): Promise<number | null>;
+/** Remove bulky content from one node's context folder and record the pass.
+ *  The caller decides eligibility (finished, quiet, not held) and re-checks it
+ *  immediately before calling. Per-entry failures are skipped, not thrown. */
+export declare function stripContextDir(nodeId: string, now?: Date): Promise<ContextStripResult>;

package/dist/core/canvas/context-strip.js

@@ -0,0 +1,5 @@
+var F=Object.defineProperty;var s=(t,e)=>F(t,"name",{value:e,configurable:!0});import{readFile as M,writeFile as R}from"node:fs/promises";import{setImmediate as B}from"node:timers/promises";import{join as p,relative as T}from"node:path";import{appSpace as v}from"../layout.js";import{readdirBeneath as d,removeTreeBeneath as $,statBeneath as E,writeFileBeneath as N}from"../spaces/open-beneath.js";import{appForNode as I,contextDir as C}from"./node-agent-paths.js";import{jobDir as w}from"./paths.js";const x=10*1024*1024,A=new Set(["node_modules",".pnpm-store",".git",".venv","venv","__pycache__","dist","build","target",".next",".turbo"]),L=[".heapsnapshot",".heapprofile",".cpuprofile"],g="REMOVED.md",D="context-stripped.json";async function Y(t){try{const e=JSON.parse(await M(p(w(t),D),"utf8")),n=typeof e.stripped_at=="string"?Date.parse(e.stripped_at):Number.NaN;return Number.isFinite(n)?n:null}catch{return null}}s(Y,"lastContextStripMs");function P(t,e){const n=t.toLowerCase();return n.endsWith(".md")?null:L.some(r=>n.endsWith(r))?"heap or CPU profile":n.endsWith(".har")||n==="har.json"?"browser network capture (HAR)":e>x?`file larger than ${x/(1024*1024)} MB`:null}s(P,"fileReason");function O(t,e,n){const r=(e.bytes/1048576).toFixed(1);return`# Removed by crouter retention
+
+\`${e.path}\` (${r} MB, ${e.reason}) was deleted from node ${t}'s context folder on ${n.toISOString()}, after the node had been finished for at least a day. The original content is gone; recreate it if you need it.
+`}s(O,"tombstoneText");function j(t,e){let n=0;const r=[e];for(;r.length>0;){const a=r.pop();for(const o of d(t,a)){const c=p(a,o.name);o.isDirectory()?r.push(c):o.isFile()&&(n+=E(t,c).size)}}return n}s(j,"treeBytes");function k(t,e){const n=d(t,e);return n.length===1&&n[0].name===g}s(k,"isTombstonedDir");async function q(t,e=new Date){const n=I(t),r=v(n).nodes,a=C(t,n),o=[],c=s(async u=>{let f;try{f=d(r,u)}catch{return}for(const m of f){const l=m.name,i=p(u,l);try{if(m.isDirectory()){if(!A.has(l)){await B(),await c(i);continue}if(k(r,i))continue;const S={path:T(a,i),bytes:j(r,i),reason:`${l} directory`};$(r,i),N(r,p(i,g),O(t,S,e)),o.push(S);continue}if(!m.isFile())continue;const h=E(r,i).size,_=P(l,h);if(_===null||h<1024)continue;const b={path:T(a,i),bytes:h,reason:_};N(r,i,O(t,b,e)),o.push(b)}catch{}}},"walk");await c(a);const y=o.reduce((u,f)=>u+f.bytes,0);try{await R(p(w(t),D),`${JSON.stringify({stripped_at:e.toISOString(),bytes:y,removed:o},null,2)}
+`)}catch{}return{removed:o,bytes:y}}s(q,"stripContextDir");export{x as CONTEXT_STRIP_FILE_LIMIT_BYTES,g as CONTEXT_TOMBSTONE_NAME,Y as lastContextStripMs,q as stripContextDir};