@nyte-ai/host 0.0.18 → 0.0.19

package/src/local/jobs.ts

@@ -1,7 +1,7 @@
 import { spawn } from "node:child_process";
 import type { ChildProcess, SpawnOptions } from "node:child_process";
 import { createRequire } from "node:module";
-import { resolve } from "node:path";
+import { basename, resolve } from "node:path";
 import type { IPty, IPtyForkOptions } from "@lydell/node-pty";
 import { asId, SdkError } from "@nyte-ai/schema";
 import type { JobEnd, OutputFrame, RequestOptions } from "@nyte-ai/schema";
@@ -14,6 +14,7 @@ import {
   tracing,
 } from "@nyte-ai/core";
 import type { EndSpan, ExecutionEnv, Job } from "@nyte-ai/core";
+import { findExecutable, killTree, run, spawnCommand } from "./command.ts";
 
 type PtyModule = {
   spawn(file: string, args: string[] | string, options: IPtyForkOptions): IPty;
@@ -22,7 +23,7 @@ type PtyModule = {
 type Driver = {
   write(bytes: Uint8Array): Promise<void>;
   resize(size: { readonly columns: number; readonly rows: number }): boolean;
-  idle(): boolean;
+  idle(): boolean | Promise<boolean>;
   kill(signal: NodeJS.Signals): void;
   readonly pty: boolean;
 };
@@ -38,19 +39,11 @@ const STOP_GRACE_MS = 2_000;
 
 const CLOSE_GRACE_MS = 2_000;
 
-const QUIET_MS = 300;
-
 const DONE = { done: true, value: undefined } as const;
 
-const ESC = "\u001b";
-
-const BEL = "\u0007";
-
-const PROMPT_MARKER = new RegExp(`${ESC}\\]133;([ABCD])`, "g");
-
 let loaded: PtyModule | null | undefined;
 
-/** Returns `exec` for a folder: each call starts one process as a `Job` (a fresh id; `key` null, core keys pty jobs) in `cwd` resolved against `root` (default `root`), with `env` laid over `process.env`. A string command runs through the platform shell (`/bin/sh -c`, `cmd.exe /d /s /c` on Windows) and an argv directly; `[]` with `pty` runs the login shell (`shell()` read at each start, else `$SHELL`, else `/bin/sh`, as a login shell; §37h), a pty's environment carrying `TERM=xterm-256color`, `COLORTERM=truecolor` and `TERM_PROGRAM=Nyte` without Electron's `ELECTRON_RUN_AS_NODE` and `NODE_OPTIONS`, and `[]` without one throws `SdkError("invalid")`. A program that cannot start throws `SdkError("unavailable")`. Without `pty` the process is piped through `node:child_process` in its own process group, stdout and stderr interleaved in `output` (with `stdio: "protocol"`, stderr's frames tagged `stream: "stderr"` and the pipe paced like a pty, so a reader open from the start misses nothing) and stdin fed by `write`; with `pty` it runs under `@lydell/node-pty`, loaded on first use through `createRequire` (§41a; `loadPty`, given, loads it instead, on every pty start), at the given size, and a platform where it does not load throws `SdkError("unavailable")`. `output()` opens a reader over the last 1 MiB of output that yields `bytes`, a `gap` where the reader fell behind or opened after output was dropped, and `exit { code }` last; a merged pipe never stalls, and a pty or a protocol pipe pauses while its slowest open reader is 256 KiB behind, resuming once it is within 64 KiB. `resize` resizes a pty (`not-pty` for a pipe, `missing` once it ended); `idle` answers whether a pty's shell sits at a prompt: by its OSC 133 prompt markers once it sent one, else when it has printed nothing for 300 ms and the cursor's line holds text after the last newline, as a prompt does (false for a pipe); `stop` sends SIGTERM to a pipe's process group (SIGHUP to a pty), SIGKILL after 2 s, and answers `settled { outcome }` (also once it ended); `settled` resolves `exited { code, reason }` (`code` null after a signal), `reason` `exited` when the process ended on its own and `terminated` after `stop` or an aborted `signal`, and an aborted `settled` signal rejects with `SdkError("unavailable")`; `close` detaches this handle's readers. An aborted `signal` stops the process. `signal` on the options ends every reader of every job started here, leaving the processes running (what the provider's `close` does). */
+/** Returns `exec` for a folder: each call starts one process as a `Job` (a fresh id; `key` null, core keys pty jobs) in `cwd` resolved against `root` (default `root`), with `env` laid over `process.env`. A string command runs through the platform shell (`/bin/sh -c`, `cmd.exe /d /s /c` on Windows) and an argv directly; `[]` with `pty` runs the login shell (`shell()` read at each start, else `$SHELL`, else `/bin/sh`, as a login shell; §37h), a pty's environment carrying `TERM=xterm-256color`, `COLORTERM=truecolor` and `TERM_PROGRAM=Nyte` without Electron's `ELECTRON_RUN_AS_NODE` and `NODE_OPTIONS`, and `[]` without one throws `SdkError("invalid")`. A program that cannot start throws `SdkError("unavailable")`. Without `pty` the process is piped through `node:child_process` in its own process group, stdout and stderr interleaved in `output` (with `stdio: "protocol"`, stderr's frames tagged `stream: "stderr"` and the pipe paced like a pty, so a reader open from the start misses nothing) and stdin fed by `write`; with `pty` it runs under `@lydell/node-pty`, loaded on first use through `createRequire` (§41a; `loadPty`, given, loads it instead, on every pty start), at the given size, and a platform where it does not load throws `SdkError("unavailable")`. `output()` opens a reader over the last 1 MiB of output that yields `bytes`, a `gap` where the reader fell behind or opened after output was dropped, and `exit { code }` last; a merged pipe never stalls, and a pty or a protocol pipe pauses while its slowest open reader is 256 KiB behind, resuming once it is within 64 KiB. `resize` resizes a pty (`not-pty` for a pipe, `missing` once it ended); `idle` checks the OS process table for a login shell with no live children (false for a pipe or explicit command, true once it ended); `stop` sends SIGTERM to a pipe's process group (SIGHUP to a pty), SIGKILL after 2 s (on Windows, which has no signals, it ends a pipe's process tree at once with `taskkill /T /F`), and answers `settled { outcome }` (also once it ended); `settled` resolves `exited { code, reason }` (`code` null after a signal), `reason` `exited` when the process ended on its own and `terminated` after `stop` or an aborted `signal`, and an aborted `settled` signal rejects with `SdkError("unavailable")`; `close` detaches this handle's readers. An aborted `signal` stops the process. `signal` on the options ends every reader of every job started here, leaving the processes running (what the provider's `close` does). */
 export function localExec(
   root: string,
   options?: {
@@ -167,7 +160,7 @@ export function localExec(
 
         return finished === null && driver.resize(size) ? { kind: "resized" } : { kind: "missing" };
       },
-      idle: async () => finished === null && driver.idle(),
+      idle: async () => driver.pty && (finished !== null || driver.idle()),
       stop: async () => ({ kind: "settled", outcome: await stop() }),
       settled: (request) => waitEnd(ended, request),
       close,
@@ -184,13 +177,13 @@ async function pipe(
   log: OutputLog,
   finish: (code: number | null) => void,
 ): Promise<Driver> {
-  const group = process.platform !== "win32";
+  const windows = process.platform === "win32";
   const [file, ...args] = typeof command === "string" ? [command] : command;
 
   const settings: SpawnOptions = {
     cwd: options.cwd,
     env: options.env,
-    detached: group,
+    detached: !windows,
     stdio: "pipe",
     windowsHide: true,
   };
@@ -198,7 +191,11 @@ async function pipe(
   const child: ChildProcess =
     typeof command === "string"
       ? spawn(command, { ...settings, shell: true })
-      : spawn(file ?? "", args, settings);
+      : spawnCommand(
+          windows ? ((await findExecutable(file ?? "")) ?? file ?? "") : (file ?? ""),
+          args,
+          settings,
+        );
 
   await new Promise<void>((started, failed) => {
     child.once("spawn", started);
@@ -224,12 +221,13 @@ async function pipe(
       },
     });
   child.stdin?.on("error", () => undefined);
-  child.on("close", (code) => finish(code));
+  let killed = false;
+  child.on("close", (code) => finish(killed ? null : code));
   child.on("exit", (code) => {
     setTimeout(() => {
       child.stdout?.destroy();
       child.stderr?.destroy();
-      finish(code);
+      finish(killed ? null : code);
     }, CLOSE_GRACE_MS).unref();
   });
 
@@ -245,8 +243,15 @@ async function pipe(
     resize: () => false,
     idle: () => false,
     kill(signal) {
+      if (windows) {
+        killed = true;
+        killTree(child, signal);
+
+        return;
+      }
+
       try {
-        if (group && child.pid !== undefined) process.kill(-child.pid, signal);
+        if (child.pid !== undefined) process.kill(-child.pid, signal);
         else child.kill(signal);
       } catch {
         child.kill(signal);
@@ -316,22 +321,8 @@ async function terminal(
   }
 
   const encoder = new TextEncoder();
-  let marker: string | null = null;
-  let line = "";
-  let quietSince = 0;
 
-  term.onData((text) => {
-    log.push(encoder.encode(text));
-    quietSince = Date.now();
-
-    marker = lastMarker(text) ?? marker;
-    const plain = withoutEscapes(text);
-    const broken = plain.lastIndexOf("\n");
-    line = (broken < 0 ? line + plain : plain.slice(broken + 1)).slice(-1024);
-    const returned = line.replace(/\r+$/, "").lastIndexOf("\r");
-
-    if (returned >= 0) line = line.slice(returned + 1);
-  });
+  term.onData((text) => log.push(encoder.encode(text)));
   term.onExit(({ exitCode, signal }) => finish(signal ? null : exitCode));
   log.throttle({ pause: () => term.pause(), resume: () => term.resume() });
 
@@ -345,10 +336,38 @@ async function terminal(
 
       return true;
     },
-    idle() {
-      if (marker !== null) return marker !== "C";
+    async idle() {
+      if (typeof command === "string" || command.length !== 0) return false;
+
+      const result = await run(
+        windows ? "powershell.exe" : "ps",
+        windows
+          ? [
+              "-NoProfile",
+              "-NonInteractive",
+              "-Command",
+              `Get-CimInstance Win32_Process -Filter "ParentProcessId = ${term.pid} AND Name != 'conhost.exe' AND Name != 'OpenConsole.exe'" | Select-Object -ExpandProperty ProcessId`,
+            ]
+          : ["-A", "-o", "pid=,ppid=,stat=,comm="],
+        { cwd: options.cwd, timeoutMs: 1_500 },
+      );
+
+      if (result.code !== 0) throw new SdkError("unavailable", "Cannot inspect terminal processes");
+      const processes = result.stdout.toString("utf8").trim();
+
+      if (windows) return processes === "";
+
+      return !processes.split("\n").some((line) => {
+        const [pid, parent, state, ...name] = line.trim().split(/\s+/);
 
-      return quietSince > 0 && Date.now() - quietSince >= QUIET_MS && line.trim() !== "";
+        if (state?.startsWith("Z")) return false;
+
+        if (Number(parent) === term.pid) return true;
+
+        return (
+          Number(pid) === term.pid && basename(name.join(" ")).replace(/^-/, "") !== basename(shell)
+        );
+      });
     },
     kill(signal) {
       try {
@@ -358,39 +377,6 @@ async function terminal(
   };
 }
 
-function lastMarker(text: string): string | null {
-  return Array.from(text.matchAll(PROMPT_MARKER), (match) => match[1]).at(-1) ?? null;
-}
-
-function withoutEscapes(text: string): string {
-  let plain = "";
-  let at = 0;
-
-  while (at < text.length) {
-    const char = text[at] ?? "";
-
-    if (char !== ESC) {
-      plain += char;
-      at += 1;
-      continue;
-    }
-
-    const kind = text[at + 1] ?? "";
-    at += 2;
-
-    if (kind === "[") {
-      while (at < text.length && !/[@-~]/.test(text[at] ?? "")) at += 1;
-      at += 1;
-    } else if (kind === "]") {
-      while (at < text.length && text[at] !== BEL && !(text[at] === ESC && text[at + 1] === "\\"))
-        at += 1;
-      at += text[at] === BEL ? 1 : 2;
-    }
-  }
-
-  return plain;
-}
-
 function loadPty(): PtyModule | null {
   if (loaded === undefined)
     loaded = ptyFrom(() => createRequire(import.meta.url)("@lydell/node-pty"));

package/src/local/snapshots.ts

@@ -11,7 +11,7 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { asId, SdkError } from "@nyte-ai/schema";
 import type {
   ChangeSet,
@@ -132,7 +132,9 @@ export function localSnapshots(
     if (ran === null || ran.code !== 0) return null;
     const [root, gitDir, prefix = ""] = ran.stdout.toString("utf8").split("\n");
 
-    return root === undefined || gitDir === undefined ? null : { root, gitDir, prefix };
+    return root === undefined || gitDir === undefined
+      ? null
+      : { root: resolve(root), gitDir: resolve(gitDir), prefix };
   };
 
   const repository = (): Promise<Repository | null> => {

package/src/local/worktrees.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { copyFile, mkdir, realpath, rm, stat } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { SdkError } from "@nyte-ai/schema";
 import type { WorkspaceTarget } from "@nyte-ai/schema";
 import type { WorktreeProvider } from "@nyte-ai/core";
@@ -50,7 +50,7 @@ export async function listWorktrees(
     const path = fields.find((field) => field.startsWith("worktree "))?.slice(9);
     const branch = fields.find((field) => field.startsWith("branch refs/heads/"))?.slice(18);
 
-    return path === undefined ? [] : [{ path, branch: branch ?? null }];
+    return path === undefined ? [] : [{ path: resolve(path), branch: branch ?? null }];
   });
 }
 
@@ -147,7 +147,7 @@ export function localWorktrees(options?: {
       const branch = `nyte/${slug}`;
       const below = (root: string): WorkspaceTarget => ({
         kind: "local",
-        path: repo.prefix === "" ? root : join(root, repo.prefix).replace(/\/+$/u, ""),
+        path: resolve(root, repo.prefix),
       });
 
       const listed = (await listWorktrees(repo.root, options)).find(
@@ -224,7 +224,7 @@ async function readRepository(git: Git, cwd: string): Promise<Repository | null>
 
   return root === undefined || gitDir === undefined || root === ""
     ? null
-    : { root, gitDir, prefix };
+    : { root: resolve(root), gitDir: resolve(gitDir), prefix };
 }
 
 function worktreeSlug(name: string, title: string | null): string {

package/src/mcp/connect.ts

@@ -10,13 +10,6 @@ import type { McpServerEntry } from "./config.ts";
 import { createAuthProvider, oauthKey, oauthStore } from "./oauth.ts";
 import type { McpOAuthSettings } from "./oauth.ts";
 
-/**
- * Opens the transport to one server for one workspace. A url server that
- * needs OAuth sends its stored tokens; when it needs a new sign-in the
- * connection fails with `McpOAuthAuthorizationRequiredError`, after passing
- * the server's challenge to `challenged`. Throws when the entry cannot be
- * started, such as a missing `${VAR}`.
- */
 export type McpConnector = (
   entry: McpServerEntry,
   context: {
@@ -27,11 +20,6 @@ export type McpConnector = (
   },
 ) => McpTransport;
 
-/**
- * Runs stdio servers on this machine, in `cwd` resolved against the
- * workspace folder, and connects to url servers over streamable HTTP. A url
- * server without an `Authorization` header signs in with OAuth.
- */
 export const connectServer: McpConnector = (entry, context) => {
   const { transport } = entry;
 
@@ -65,7 +53,6 @@ export const connectServer: McpConnector = (entry, context) => {
   });
 };
 
-/** A server's OAuth options with `${VAR}`s in `clientSecret` resolved. */
 export function oauthSettings(config: McpOAuthConfig, server: string): McpOAuthSettings {
   const { clientSecret, authServerMetadataUrl, ...rest } = config;
 
@@ -95,7 +82,7 @@ function expand(values: Readonly<Record<string, string>>, server: string): Recor
 
         if (found === undefined)
           throw new Error(
-            `${server} needs the environment variable ${name}. Set it where Nyte runs, then restart Nyte (for the CLI, \`nyte service stop\`).`,
+            `${server} needs the environment variable ${name}. Set it where Nyte runs, then restart Nyte.`,
           );
 
         return found;

package/src/open.ts

@@ -1,7 +1,7 @@
 import { watch } from "node:fs";
 import { mkdir, readFile } from "node:fs/promises";
 import { homedir, hostname } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import process from "node:process";
 import type { Models, Provider } from "@nyte-ai/ai";
 import { defaultProviderAuthContext } from "@nyte-ai/ai/auth/context";
@@ -43,55 +43,28 @@ import { localProvider } from "./local/provider.ts";
 import { importLegacyTrust } from "./local/legacy-trust.ts";
 import { migrateLocalWorkspaceIdentities } from "./local/workspace-migration.ts";
 import { listen } from "./listen.ts";
+import { nodeImages } from "./images/node.ts";
 import { createMcpHub } from "./mcp/hub.ts";
 import { loadPluginDirectory, pluginLoader } from "./plugins/loader.ts";
 import { defaultSecrets } from "./secrets.ts";
 import type { SecretsSource } from "./secrets.ts";
-import { sqliteStore } from "./sqlite.ts";
+import { sqliteStore, storePath } from "./sqlite.ts";
 
 const RELOAD_DEBOUNCE_MS = 250;
 
 const STORE_POLL_MS = 500;
 
-/**
- * Describes what `openHost` takes: `OpenOptions` with `store`, `workspace`,
- * `models` and `plugins` optional, `secrets` defaulting to this machine's key,
- * and the home directory holding `.nyte`. Every `OpenOptions` is one, so the
- * sdk's Node `open` passes its options straight through.
- */
 export type OpenHostOptions = Omit<OpenOptions, "store" | "workspace" | "models" | "plugins"> & {
-  /** The host's store; absent, `sqliteStore` at `<home>/.nyte/nyte.db`, which the host then closes with itself (§51c). */
   readonly store?: Store;
-  /** Where a root session acts when `create` names none; default the local folder `process.cwd()` (§51c). */
   readonly workspace?: WorkspaceTarget;
-  /** The `@nyte-ai/ai` catalog; absent, `nyteModels` over this host's encrypted credential store (§42e). */
   readonly models?: Models;
-  /** Core plugins loaded after the first-party built-ins and before the plugin files; default none. One with a built-in's id replaces that built-in, as a bundled client's `codemode` runtime does, and a `local` environment provider among them replaces the default one. */
   readonly plugins?: readonly Plugin<"core">[];
-  /** The directory whose `.nyte` holds the store, settings, plugins, secrets key and identity key; default `os.homedir()`. */
   readonly home?: string;
-  /** The login shell the default local provider's pty jobs run, read at each start; absent or null is `$SHELL`. */
   readonly shell?: () => string | null;
+  readonly label?: string;
+  readonly onRevoked?: () => void;
 };
 
-/**
- * Opens the Node host the sdk's Node `open` calls: `composeHost` with
- * `home` (default `os.homedir()`), `store` (default `<home>/.nyte/nyte.db`,
- * checked every 500 ms for another process's commits, which are then read so
- * a second process on the file sees the first one's runs live),
- * `workspace` (default the local folder `process.cwd()`), `secrets` (default
- * `defaultSecrets(home)`), `models` (default `nyteModels`), `localProvider`
- * unless a plugin provides the `local` environment, every first-party plugin
- * of `@nyte-ai/plugin` that `plugins` does not replace by id, then `plugins`
- * and `filePlugins`' files, `settingsSeed`'s seed and
- * `hostDescription()`; each file that did not load becomes a
- * `server.report` row. The host's `loadPlugins` is `pluginLoader` over
- * the plugin directories (§47l), which `watchPlugins` watches for hot reload
- * (§49a). `listen` defaults `identity` to `identitySigner(host.hostId, home)`
- * and `describe` to the description; nothing here reads the secrets key, even
- * with a credential stored (§50d, §55). `close()` stops the watch, closes the
- * open listeners, the host, then a store it opened.
- */
 export async function openHost(options: OpenHostOptions): Promise<Host> {
   const home = options.home ?? homedir();
   const workspace = options.workspace ?? { kind: "local", path: process.cwd() };
@@ -109,9 +82,10 @@ export async function openHost(options: OpenHostOptions): Promise<Host> {
 }
 
 async function defaultStore(home: string): Promise<Store> {
-  await mkdir(join(home, ".nyte"), { recursive: true, mode: 0o700 });
+  const path = storePath(home);
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
 
-  return sqliteStore({ path: join(home, ".nyte", "nyte.db") });
+  return sqliteStore({ path });
 }
 
 async function composeOpen(
@@ -156,7 +130,6 @@ async function composeOpen(
     openaiAstraContext,
     telemetry,
     canvas,
-    browserTools,
     claudeCode.plugin,
     acp.plugin,
   ];
@@ -179,6 +152,7 @@ async function composeOpen(
     models,
     mcp: options.mcp ?? createMcpHub({ home }),
     github: options.github ?? (usesLocalProvider ? localGitHubAccount({ home }) : undefined),
+    images: options.images ?? nodeImages(),
     plugins: [...plugins, ...files.plugins],
     pluginSources: files.sources,
     secrets,
@@ -186,6 +160,12 @@ async function composeOpen(
     description,
     ...(settings.seed === null ? {} : { seed: settings.seed }),
     ...(owned === null ? {} : { poll: STORE_POLL_MS }),
+    member: {
+      label: options.label ?? "nyte",
+      pid: process.pid,
+      capabilities: given.some((plugin) => plugin.id === browserTools.id) ? [browserTools.id] : [],
+    },
+    revoked: options.onRevoked,
   });
 
   projectDirs = async () =>
@@ -281,7 +261,6 @@ async function nyteModels(input: {
   readonly store: Store;
   readonly secrets: SecretsSource;
   readonly home: string;
-  /** Providers beside Nyte's catalog, each refreshed offline at open. */
   readonly providers: readonly Provider[];
 }): Promise<Models> {
   const credentials = credentialStore(input.store, input.secrets);
@@ -302,6 +281,7 @@ async function nyteModels(input: {
   });
 
   for (const provider of [...nyteProviders(), ...input.providers]) models.setProvider(provider);
+
   const [stored, selected] = await Promise.all([
     credentials.list(),
     input.store.open().then(readModelSelection),

package/src/serve/binding.ts

@@ -193,6 +193,7 @@ export function bindConnection(connection: Connection, options: BindingOptions):
       return null;
     },
     "models.setDefault": ({ ref }) => connection.models.setDefault(ref),
+    "models.setListing": ({ refs, listing }) => connection.models.setListing(refs, listing),
     "models.verify": ({ provider }) => connection.models.verify(provider),
     "models.login": async (input) => {
       const { provider } = input;
@@ -384,9 +385,9 @@ export function bindConnection(connection: Connection, options: BindingOptions):
     "mcp.remove": ({ workspace: id, server, scope }) => workspace(id).mcp.remove(server, scope),
     "workspace.update": ({ workspace: id, patch }) => workspace(id).update(patch),
     "workspace.reload": ({ workspace: id }) => workspace(id).reload(),
-    "workspace.changes": ({ workspace: id, run }) => workspace(id).changes(run),
-    "workspace.patches": async ({ workspace: id, run, paths, options }) =>
-      mapped(workspace(id).patches(run, paths, options), patchesWire),
+    "workspace.changes": ({ workspace: id, source }) => workspace(id).changes(source),
+    "workspace.patches": async ({ workspace: id, source, paths, options }) =>
+      mapped(workspace(id).patches(source, paths, options), patchesWire),
     "workspace.files": async ({ workspace: id }) => capabilityWire(await workspace(id).files()),
     "workspace.git": async ({ workspace: id }) => capabilityWire(await workspace(id).git()),
     "workspace.github": async ({ workspace: id }) => capabilityWire(await workspace(id).github()),

package/src/sqlite.ts

@@ -1,5 +1,6 @@
 import { mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import process from "node:process";
 import { DatabaseSync } from "node:sqlite";
 import type { SQLInputValue, StatementSync } from "node:sqlite";
 import { asSeq } from "@nyte-ai/schema";
@@ -34,7 +35,6 @@ import {
 } from "./store-rows.ts";
 import { sqliteWorkers } from "./sqlite-workers.ts";
 import { sessionIndexChanges, sqlSessionIndex } from "./session-index.ts";
-import { claimStore } from "./store-owner.ts";
 
 const BUSY_TIMEOUT_MS = 5_000;
 
@@ -43,16 +43,18 @@ const BACKUPS_KEPT = 3;
 const PUT_BODY =
   "INSERT INTO objects (id, body) VALUES (?, ?) ON CONFLICT (id) DO UPDATE SET body = excluded.body WHERE objects.body IS NULL";
 
-/** Returns a `Store` over one `node:sqlite` `DatabaseSync`: a file at `path` (WAL mode, opened only by the process that `claimStore` makes its owner, so a second process rejects with `SdkError("unavailable")` before it reads or migrates the file) or an in-memory database. The first `open()` brings it to core's `STORE_VERSION` with `migrateStore` (core's `objects`, `refs`, `log` and `store_meta` tables; each commit one `BEGIN IMMEDIATE`), a file store whose migration rewrites records first saving those refs' rows (name, target, revision; objects are never deleted, so the rows restore them) to `backups/store-<time>-<pid>-<uuid>-v<from>-v<to>.json` beside it, keeping the newest three backups, and rejects with `SdkError("unavailable")` for a store a newer Nyte migrated; a `migrations` table an older Nyte left is kept and ignored. `put` ids the value with core's `objectId` and stores its JSON once; `putBlob` buffers the stream, ids it with `blobId` and stores the bytes once; an object and a blob that share an id share the row, each column filled once (§41f); `blob` reads the bytes back with their size and a null mime. `refs.set` is one `BEGIN IMMEDIATE` transaction with `RefStore.set`'s semantics, each revision a random UUID, that first rejects with `SdkError("unavailable")` when a newer Nyte has migrated the store since it opened. `list(prefix)` reads the name range from `prefix` in name order (BINARY, by code point); `log` returns the events after `after` in seq order up to `limit`, each validated as a `SessionEvent`; `tail` is the session's last seq, or 0; `commitMark` is the writer connection's `PRAGMA data_version`, which moves only for another connection's commit. `checkpoints` keeps one fold checkpoint per session in `fold_checkpoints`, a write at a lower seq leaving the kept one, and `gap` counts a session's events past a seq and sums their UTF-8 bytes. File stores run `list` and `log` on a read-only worker and WAL checkpoints on a separate worker, checking at 1,000 frames and after 100 ms idle with a 10,000-frame writer backstop; unavailable workers warn and fall back to the main connection. Checkpoints use fullfsync on macOS, WAL reuse retains at most 32 MiB, and opening refreshes planner statistics. Writes binding more than 64 KiB use uncached statements. Every `open()` returns a connection over the one writer; `close()` waits for opening and worker shutdown before closing it, and an open during close waits to reopen. */
+/** The local store's file: `NYTE_DB` when set, so a source run keeps its own chats, else `.nyte/nyte.db` under `home`. */
+export function storePath(home: string): string {
+  return process.env["NYTE_DB"] ?? join(home, ".nyte", "nyte.db");
+}
+
 export function sqliteStore(input: { readonly path: string } | { readonly memory: true }): Store {
   let database: DatabaseSync | null = null;
   let opening: Promise<StoreConnection> | null = null;
   let closing: Promise<void> | null = null;
   let workers: ReturnType<typeof sqliteWorkers> | null = null;
-  let release: (() => void) | null = null;
 
   const open = async (): Promise<StoreConnection> => {
-    const claim = "path" in input ? claimStore(input.path) : null;
     let created: DatabaseSync | undefined;
 
     try {
@@ -69,13 +71,11 @@ export function sqliteStore(input: { readonly path: string } | { readonly memory
       created.exec("PRAGMA optimize = 0x10012");
     } catch (error) {
       created?.close();
-      claim?.();
 
       throw error;
     }
 
     database = created;
-    release = claim;
     workers = "path" in input ? sqliteWorkers(created, input.path) : null;
 
     return connect(created, workers);
@@ -99,10 +99,8 @@ export function sqliteStore(input: { readonly path: string } | { readonly memory
         await opening?.catch(() => undefined);
         await workers?.close();
         database?.close();
-        release?.();
         workers = null;
         database = null;
-        release = null;
         opening = null;
       })().finally(() => {
         closing = null;
@@ -189,6 +187,7 @@ function sqliteTarget(database: DatabaseSync, path: string | null): MigrationTar
 
             return "conflict";
           }
+
           updateSessionIndex(database, moved.name, moved.id, mintRevision());
         }
 
@@ -308,6 +307,7 @@ function connect(
   );
 
   const deleteRef = database.prepare("DELETE FROM refs WHERE name = ?");
+  const audit = auditing(database);
   const append = database.prepare("INSERT INTO log (session, seq, at, event) VALUES (?, ?, ?, ?)");
 
   const readLog = database.prepare(
@@ -327,6 +327,7 @@ function connect(
   const readGap = database.prepare(
     "SELECT COUNT(*) AS events, COALESCE(SUM(LENGTH(CAST(event AS BLOB))), 0) AS bytes FROM log WHERE session = ? AND seq > ?",
   );
+
   const readVersion = database.prepare("SELECT version FROM store_meta WHERE id = 1");
   const readDataVersion = database.prepare("PRAGMA data_version");
 
@@ -422,11 +423,23 @@ function connect(
           }
 
           const touched = new Map<SessionId, Revision>();
+          const current = new Map([...before].map(([name, row]) => [name, row?.revision ?? null]));
+
           const revisions = updates.map((update) => {
             const revision = mintRevision();
 
             if (update.target === null) deleteRef.run(update.name);
             else putRef.run(update.name, update.target, revision);
+            audit?.run(
+              Date.now(),
+              process.pid,
+              fenceNames([update]).find((name) => name.startsWith("processes/")) ?? null,
+              update.name,
+              current.get(update.name) ?? null,
+              update.target === null ? null : revision,
+              update.target,
+            );
+            current.set(update.name, update.target === null ? null : revision);
             updateSessionIndex(database, update.name, update.target, revision);
             const session = parseSessionRef(update.name);
 
@@ -496,6 +509,17 @@ function connect(
   };
 }
 
+function auditing(database: DatabaseSync): StatementSync | null {
+  if (process.env.NYTE_STORE_AUDIT !== "1") return null;
+  database.exec(
+    "CREATE TABLE IF NOT EXISTS store_audit (id INTEGER PRIMARY KEY, at INTEGER NOT NULL, pid INTEGER NOT NULL, writer TEXT, name TEXT NOT NULL, before TEXT, after TEXT, target TEXT)",
+  );
+
+  return database.prepare(
+    "INSERT INTO store_audit (at, pid, writer, name, before, after, target) VALUES (?, ?, ?, ?, ?, ?, ?)",
+  );
+}
+
 function updateSessionIndex(
   database: DatabaseSync,
   name: string,
@@ -503,6 +527,7 @@ function updateSessionIndex(
   revision: Revision,
 ): void {
   if (sessionIndexRef(name) === null) return;
+
   const body =
     target === null
       ? null

package/src/store-usage.ts

@@ -1,5 +1,4 @@
 import { existsSync } from "node:fs";
-import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import {
   decodeObject,
@@ -17,6 +16,7 @@ import type {
   UsageTotals,
   UsageWindow,
 } from "./usage-types.ts";
+import { storePath } from "./sqlite.ts";
 import { cacheSavings, usageTokens } from "./usage-summary.ts";
 import { decodeEvent, parseNumber, parseText } from "./store-rows.ts";
 
@@ -129,6 +129,7 @@ export function projectUsageReport(
 
       for (const spend of session.records) {
         const { usage } = spend;
+
         const amounts = [
           usage.total,
           usage.input,
@@ -201,7 +202,7 @@ export function projectUsageReport(
 
 export function readNyteUsage(home: string, window: UsageWindow): UsageReport {
   const readAt = Date.now();
-  const path = join(home, ".nyte", "nyte.db");
+  const path = storePath(home);
 
   if (!existsSync(path)) return projectUsageReport([], window, readAt);
   let database: DatabaseSync | undefined;
@@ -268,11 +269,13 @@ export function readNyteUsage(home: string, window: UsageWindow): UsageReport {
       const session = parseSessionRef(`sessions/${parseText(row.session) ?? ""}`);
 
       if (session === null) throw new Error("Cannot read usage session.");
+
       const event = decodeEvent(
         parseNumber(row.seq),
         parseNumber(row.at),
         parseText(row.event) ?? "",
       );
+
       let heads = models.get(session);
 
       if (heads === undefined) {