@oscharko-dev/keiko-server 0.2.0

package/dist/store/db.js

@@ -0,0 +1,203 @@
+// ADR-0013 D3/D8/D9 — DB lifecycle, factories, and the public UiStore wiring. The synchronous
+// `node:sqlite` DatabaseSync drives both factories; the node adapter adds directory creation,
+// 0o700/0o600 permission hardening (Unix), and reopen-safe migrations.
+import { DatabaseSync } from "node:sqlite";
+import { chmodSync, existsSync, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { runMigrations } from "./schema.js";
+import { deleteProject as sqlDeleteProject, getProject as sqlGetProject, listProjects as sqlListProjects, updateProject as sqlUpdateProject, upsertProject as sqlUpsertProject, } from "./projects.js";
+import { deleteChat as sqlDeleteChat, findChatById as sqlFindChatById, insertChat as sqlInsertChat, listChats as sqlListChats, listChatsLimited as sqlListChatsLimited, touchChat as sqlTouchChat, updateChat as sqlUpdateChat, } from "./chats.js";
+import { findMessageById as sqlFindMessageById, insertMessage as sqlInsertMessage, listMessages as sqlListMessages, listMessagesLimited as sqlListMessagesLimited, updateMessage as sqlUpdateMessage, } from "./messages.js";
+import { validateProjectPath } from "./validation.js";
+import { basename } from "node:path";
+import { invalidRequest } from "./errors.js";
+const DEFAULT_REDACT = (s) => s;
+// Returns whether a project's directory currently exists and is a directory. Derived availability
+// (ADR-0013 D5): the store never deletes a row because the path went missing; the UI surfaces this.
+export function isProjectAvailable(project) {
+    try {
+        return statSync(project.path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function resolveOptions(opts) {
+    return {
+        now: opts?.now ?? (() => Date.now()),
+        newId: opts?.newId ?? randomUUID,
+        redactString: opts?.redactString ?? DEFAULT_REDACT,
+    };
+}
+function deriveProjectName(explicit, path) {
+    if (explicit === undefined)
+        return basename(path);
+    if (explicit.length === 0)
+        throw invalidRequest("Name must not be empty.");
+    return explicit;
+}
+function createChatRecord(db, options, projectPath, title, selectedModel, opts) {
+    const project = sqlGetProject(db, projectPath);
+    if (project !== undefined && !isProjectAvailable(project)) {
+        throw invalidRequest("Project path is unavailable.");
+    }
+    return sqlInsertChat(db, {
+        id: options.newId(),
+        projectPath,
+        title,
+        selectedModel,
+        opts,
+        now: options.now(),
+    });
+}
+function createMessageRecord(db, options, msg) {
+    return sqlInsertMessage(db, options.newId(), msg, options.redactString);
+}
+function createProjectRecord(db, options, path, name) {
+    const normalized = validateProjectPath(path, { mustExist: true });
+    const resolvedName = deriveProjectName(name, normalized);
+    return sqlUpsertProject(db, normalized, resolvedName, name !== undefined, options.now());
+}
+function updateProjectRecord(db, options, path, patch) {
+    const normalized = validateProjectPath(path, { mustExist: false });
+    return sqlUpdateProject(db, normalized, patch, options.now());
+}
+function deleteProjectRecord(db, path) {
+    const normalized = validateProjectPath(path, { mustExist: false });
+    sqlDeleteProject(db, normalized);
+}
+function createMessageBatch(db, options, messages) {
+    if (messages.length === 0) {
+        throw invalidRequest("At least one message is required.");
+    }
+    db.exec("BEGIN");
+    try {
+        const created = messages.map((msg) => createMessageRecord(db, options, msg));
+        for (const chatId of new Set(messages.map((msg) => msg.chatId))) {
+            sqlTouchChat(db, chatId, options.now());
+        }
+        db.exec("COMMIT");
+        return created;
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
+function buildStore(db, options) {
+    return {
+        listProjects: () => sqlListProjects(db),
+        createProject: (path, name) => createProjectRecord(db, options, path, name),
+        updateProject: (path, patch) => updateProjectRecord(db, options, path, patch),
+        deleteProject: (path) => {
+            deleteProjectRecord(db, path);
+        },
+        listChats: (projectPath, limit) => limit === undefined
+            ? sqlListChats(db, projectPath)
+            : sqlListChatsLimited(db, projectPath, limit),
+        findChatById: (id) => sqlFindChatById(db, id),
+        createChat: (projectPath, title, selectedModel, opts) => createChatRecord(db, options, projectPath, title, selectedModel, opts),
+        updateChat: (id, patch, updateOptions) => sqlUpdateChat(db, id, patch, options.now(), updateOptions),
+        deleteChat: (id) => {
+            sqlDeleteChat(db, id);
+        },
+        listMessages: (chatId, limit) => limit === undefined ? sqlListMessages(db, chatId) : sqlListMessagesLimited(db, chatId, limit),
+        findMessageById: (id) => sqlFindMessageById(db, id),
+        createMessage: (msg) => {
+            const message = createMessageRecord(db, options, msg);
+            sqlTouchChat(db, msg.chatId, options.now());
+            return message;
+        },
+        createMessages: (messages) => createMessageBatch(db, options, messages),
+        updateMessage: (id, patch) => sqlUpdateMessage(db, id, patch, options.redactString),
+        close: () => {
+            db.close();
+        },
+    };
+}
+function quarantineCorruptDb(target) {
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    renameSync(target, `${target}.corrupt.${ts}`);
+    for (const sidecar of [`${target}-wal`, `${target}-shm`]) {
+        if (existsSync(sidecar)) {
+            renameSync(sidecar, `${sidecar}.corrupt.${ts}`);
+        }
+    }
+}
+// Issue #639 — bound the SQLITE_BUSY window so concurrent UI/BFF writers (chat writes,
+// relationship writes, evidence-adjacent updates) wait for the writer lock for a short, bounded
+// interval instead of failing immediately. 5_000ms matches the conservative default we want for
+// the local single-writer desktop pattern; exported so the regression test can assert the value
+// without re-deriving it.
+export const UI_DB_BUSY_TIMEOUT_MS = 5_000;
+function preparedDatabase(target) {
+    const db = new DatabaseSync(target);
+    db.exec("PRAGMA foreign_keys = ON");
+    db.exec(`PRAGMA busy_timeout = ${String(UI_DB_BUSY_TIMEOUT_MS)}`);
+    return db;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// In-memory factory (tests)
+// ────────────────────────────────────────────────────────────────────────────
+export function createInMemoryUiStore(opts) {
+    const db = preparedDatabase(":memory:");
+    runMigrations(db);
+    return buildStore(db, resolveOptions(opts));
+}
+// ────────────────────────────────────────────────────────────────────────────
+// Node on-disk factory
+// ────────────────────────────────────────────────────────────────────────────
+function ensureDirHardened(dir) {
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    if (process.platform !== "win32") {
+        try {
+            chmodSync(dir, 0o700);
+        }
+        catch {
+            // best-effort; leave existing perms if owner change is unavailable
+        }
+    }
+}
+function chmodIfPresent(path, mode) {
+    if (process.platform === "win32")
+        return;
+    try {
+        chmodSync(path, mode);
+    }
+    catch {
+        // file may not exist yet (WAL/-shm sidecars); best-effort
+    }
+}
+// Issue #539: deps.ts needs the raw DatabaseSync to compose the relationship-engine store on
+// the same UI database file. The relationship V5 schema lives in this DB (schema.ts §V5);
+// keeping a single connection avoids WAL-coordination overhead. `createNodeUiStore` stays a
+// one-shot convenience for callers that do not need the underlying handle.
+export function openNodeUiDatabase(dbPath) {
+    ensureDirHardened(dirname(dbPath));
+    let db = preparedDatabase(dbPath);
+    try {
+        db.exec("PRAGMA journal_mode = WAL");
+        runMigrations(db);
+    }
+    catch {
+        // Corrupt DB: quarantine (rename to .corrupt.<iso>) and open a fresh one.
+        db.close();
+        quarantineCorruptDb(dbPath);
+        db = preparedDatabase(dbPath);
+        db.exec("PRAGMA journal_mode = WAL");
+        runMigrations(db);
+    }
+    chmodIfPresent(dbPath, 0o600);
+    chmodIfPresent(`${dbPath}-wal`, 0o600);
+    chmodIfPresent(`${dbPath}-shm`, 0o600);
+    return db;
+}
+export function buildUiStoreOverDatabase(db, opts) {
+    return buildStore(db, resolveOptions(opts));
+}
+export function createNodeUiStore(dbPath, opts) {
+    return buildUiStoreOverDatabase(openNodeUiDatabase(dbPath), opts);
+}

package/dist/store/errors.d.ts

@@ -0,0 +1,13 @@
+export type UiStoreErrorCode = "invalid_path" | "path_not_directory" | "path_not_found" | "project_exists" | "not_found" | "invalid_request" | "internal";
+export declare class UiStoreError extends Error {
+    readonly code: UiStoreErrorCode;
+    readonly status: number;
+    constructor(code: UiStoreErrorCode, message: string, status: number);
+}
+export declare function invalidPath(message: string): UiStoreError;
+export declare function pathNotDirectory(): UiStoreError;
+export declare function pathNotFound(): UiStoreError;
+export declare function notFound(entity: string): UiStoreError;
+export declare function invalidRequest(message: string): UiStoreError;
+export declare function projectExists(): UiStoreError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/store/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/store/errors.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,WAAW,GACX,iBAAiB,GACjB,UAAU,CAAC;AAEf,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,gBAAgB,CAAC;IACvC,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3E;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAEzD;AAED,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C;AAED,wBAAgB,YAAY,IAAI,YAAY,CAE3C;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAErD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE5D;AAED,wBAAgB,aAAa,IAAI,YAAY,CAE5C"}

package/dist/store/errors.js

@@ -0,0 +1,30 @@
+// ADR-0013 — Typed errors with stable codes. NEVER include the raw path, SQL text, or system error
+// strings in `.message` — these surface to the BFF error envelope and must be safe to log/expose.
+export class UiStoreError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = "UiStoreError";
+        this.code = code;
+        this.status = status;
+    }
+}
+export function invalidPath(message) {
+    return new UiStoreError("invalid_path", message, 400);
+}
+export function pathNotDirectory() {
+    return new UiStoreError("path_not_directory", "The path is not a directory.", 400);
+}
+export function pathNotFound() {
+    return new UiStoreError("path_not_found", "The path does not exist.", 400);
+}
+export function notFound(entity) {
+    return new UiStoreError("not_found", `${entity} not found.`, 404);
+}
+export function invalidRequest(message) {
+    return new UiStoreError("invalid_request", message, 400);
+}
+export function projectExists() {
+    return new UiStoreError("project_exists", "Project already registered.", 409);
+}

package/dist/store/index.d.ts

@@ -0,0 +1,7 @@
+export type { Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatMessage, ChatRole, CreateChatOptions, NewChatMessage, Project, UiStore, UiStoreFactoryOptions, UpdateChatOptions, UpdateChatMessagePatch, UpdateChatPatch, UpdateProjectPatch, WorkflowStatus, } from "./types.js";
+export { UiStoreError, type UiStoreErrorCode, invalidPath, invalidRequest, notFound, pathNotDirectory, pathNotFound, projectExists, } from "./errors.js";
+export { classifyPathShape, validateProjectPath, type PathShape, type ValidateProjectPathOptions, } from "./validation.js";
+export { assertUiDbOutsideProject, resolveUiDbPath, UI_DB_FILENAME, UI_DB_DIRNAME, } from "./paths.js";
+export { runMigrations, SCHEMA_VERSION } from "./schema.js";
+export { buildUiStoreOverDatabase, createInMemoryUiStore, createNodeUiStore, isProjectAvailable, openNodeUiDatabase, UI_DB_BUSY_TIMEOUT_MS, } from "./db.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/store/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,OAAO,EACP,OAAO,EACP,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,WAAW,EACX,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,SAAS,CAAC"}

package/dist/store/index.js

@@ -0,0 +1,6 @@
+// ADR-0013 — UI-local SQLite persistence layer. Barrel re-exporting the public seams.
+export { UiStoreError, invalidPath, invalidRequest, notFound, pathNotDirectory, pathNotFound, projectExists, } from "./errors.js";
+export { classifyPathShape, validateProjectPath, } from "./validation.js";
+export { assertUiDbOutsideProject, resolveUiDbPath, UI_DB_FILENAME, UI_DB_DIRNAME, } from "./paths.js";
+export { runMigrations, SCHEMA_VERSION } from "./schema.js";
+export { buildUiStoreOverDatabase, createInMemoryUiStore, createNodeUiStore, isProjectAvailable, openNodeUiDatabase, UI_DB_BUSY_TIMEOUT_MS, } from "./db.js";

package/dist/store/messages.d.ts

@@ -0,0 +1,8 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { ChatMessage, NewChatMessage, UpdateChatMessagePatch } from "./types.js";
+export declare function listMessages(db: DatabaseSync, chatId: string): readonly ChatMessage[];
+export declare function listMessagesLimited(db: DatabaseSync, chatId: string, limit: number): readonly ChatMessage[];
+export declare function findMessageById(db: DatabaseSync, id: string): ChatMessage | undefined;
+export declare function insertMessage(db: DatabaseSync, id: string, msg: NewChatMessage, redactString: (s: string) => string): ChatMessage;
+export declare function updateMessage(db: DatabaseSync, id: string, patch: UpdateChatMessagePatch, redactString: (s: string) => string): ChatMessage;
+//# sourceMappingURL=messages.d.ts.map

package/dist/store/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/store/messages.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,WAAW,EAEX,cAAc,EACd,sBAAsB,EAEvB,MAAM,YAAY,CAAC;AA+GpB,wBAAgB,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAErF;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,SAAS,WAAW,EAAE,CAOxB;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGrF;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAClC,WAAW,CAoBb;AAOD,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,sBAAsB,EAC7B,YAAY,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAClC,WAAW,CA6Bb"}

package/dist/store/messages.js

@@ -0,0 +1,149 @@
+// ADR-0013 — chat_messages CRUD. shortResult is redacted+truncated to ≤ MAX_SHORT_RESULT before persist.
+// Issue #66 adds:
+//   - `cancelled` to the accepted workflow status set (parity with src/ui/runs.ts RunStatus).
+//   - `task_type` column read/write so non-workflow runs (verify/explain-plan) can be labelled.
+//   - updateMessage(): partial PATCH on the row, re-using the existing redact+truncate path.
+import { invalidRequest, notFound } from "./errors.js";
+const MAX_SHORT_RESULT = 200;
+const MAX_TASK_TYPE = 64;
+// Constrained to a-z, digits, and a single inner `-` so the label remains URL-safe and survives
+// a SQL round-trip. Identical to the rule the BFF descriptors use for taskType identifiers.
+const TASK_TYPE_RE = /^[a-z][a-z0-9-]*$/;
+const ROLES = new Set(["user", "assistant", "system"]);
+const STATUSES = new Set([
+    "pending",
+    "running",
+    "completed",
+    "failed",
+    "cancelled",
+]);
+function rowToMessage(row) {
+    return {
+        id: row.id,
+        chatId: row.chat_id,
+        role: row.role,
+        content: row.content,
+        timestamp: row.timestamp,
+        runId: row.run_id ?? undefined,
+        workflowId: row.workflow_id ?? undefined,
+        workflowStatus: (row.workflow_status ?? undefined),
+        shortResult: row.short_result ?? undefined,
+        taskType: row.task_type ?? undefined,
+    };
+}
+const COLUMNS = "id, chat_id, role, content, timestamp, run_id, workflow_id, workflow_status, short_result, task_type";
+const SQL_LIST = `SELECT ${COLUMNS} FROM chat_messages WHERE chat_id = ? ORDER BY timestamp ASC, rowid ASC`;
+const SQL_LIST_LIMITED = `${SQL_LIST} LIMIT ?`;
+const SQL_FIND_BY_ID = `SELECT ${COLUMNS} FROM chat_messages WHERE id = ? LIMIT 1`;
+const SQL_CHAT_EXISTS = "SELECT 1 FROM chats WHERE id = ?";
+const SQL_INSERT = `
+INSERT INTO chat_messages
+  (id, chat_id, role, content, timestamp, run_id, workflow_id, workflow_status, short_result, task_type)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+RETURNING ${COLUMNS}
+`;
+function validateTaskType(value) {
+    if (value.length === 0 || value.length > MAX_TASK_TYPE || !TASK_TYPE_RE.test(value)) {
+        throw invalidRequest("Invalid taskType.");
+    }
+}
+function hasRunSummaryFields(msg) {
+    return (msg.runId !== undefined ||
+        msg.workflowId !== undefined ||
+        msg.workflowStatus !== undefined ||
+        msg.shortResult !== undefined ||
+        msg.taskType !== undefined);
+}
+function validateRunIdentifiers(msg) {
+    if (msg.runId?.length === 0) {
+        throw invalidRequest("runId is required for run summaries.");
+    }
+    if (msg.workflowId?.length === 0) {
+        throw invalidRequest("workflowId must be non-empty.");
+    }
+}
+function validateRunSummaryScope(msg) {
+    if (hasRunSummaryFields(msg) && (msg.role !== "system" || msg.runId === undefined)) {
+        throw invalidRequest("Run summary fields require a system message with runId.");
+    }
+}
+function validateMessage(msg) {
+    if (!ROLES.has(msg.role))
+        throw invalidRequest("Invalid role.");
+    if (msg.content.length === 0)
+        throw invalidRequest("Content is required.");
+    validateRunIdentifiers(msg);
+    validateRunSummaryScope(msg);
+    if (msg.workflowStatus !== undefined && !STATUSES.has(msg.workflowStatus)) {
+        throw invalidRequest("Invalid workflowStatus.");
+    }
+    if (msg.taskType !== undefined)
+        validateTaskType(msg.taskType);
+}
+function processShortResult(raw, redactString) {
+    if (raw === undefined)
+        return null;
+    const redacted = redactString(raw);
+    return redacted.length > MAX_SHORT_RESULT ? redacted.slice(0, MAX_SHORT_RESULT) : redacted;
+}
+export function listMessages(db, chatId) {
+    return db.prepare(SQL_LIST).all(chatId).map(rowToMessage);
+}
+export function listMessagesLimited(db, chatId, limit) {
+    if (!Number.isInteger(limit) || limit <= 0) {
+        throw invalidRequest("limit must be a positive integer.");
+    }
+    return db.prepare(SQL_LIST_LIMITED).all(chatId, limit).map(rowToMessage);
+}
+export function findMessageById(db, id) {
+    const row = db.prepare(SQL_FIND_BY_ID).get(id);
+    return row === undefined ? undefined : rowToMessage(row);
+}
+export function insertMessage(db, id, msg, redactString) {
+    validateMessage(msg);
+    const chatExists = db.prepare(SQL_CHAT_EXISTS).get(msg.chatId) !== undefined;
+    if (!chatExists)
+        throw notFound("Chat");
+    const shortResult = processShortResult(msg.shortResult, redactString);
+    const row = db
+        .prepare(SQL_INSERT)
+        .get(id, msg.chatId, msg.role, msg.content, msg.timestamp, msg.runId ?? null, msg.workflowId ?? null, msg.workflowStatus ?? null, shortResult, msg.taskType ?? null);
+    return rowToMessage(row);
+}
+// Issue #66 — Partial PATCH on a system run-summary message. Builds a dynamic SET clause from the
+// supplied fields so absent fields are not overwritten. shortResult goes through the existing
+// redact+truncate pipeline. workflowStatus and taskType are validated before SQL is built. An
+// empty patch is an invalid_request — the route surface guards this earlier, but the store layer
+// also fails-closed.
+export function updateMessage(db, id, patch, redactString) {
+    const sets = [];
+    const args = [];
+    if (patch.workflowStatus !== undefined) {
+        if (!STATUSES.has(patch.workflowStatus))
+            throw invalidRequest("Invalid workflowStatus.");
+        sets.push("workflow_status = ?");
+        args.push(patch.workflowStatus);
+    }
+    if (patch.shortResult !== undefined) {
+        sets.push("short_result = ?");
+        args.push(processShortResult(patch.shortResult, redactString));
+    }
+    if (patch.taskType !== undefined) {
+        validateTaskType(patch.taskType);
+        sets.push("task_type = ?");
+        args.push(patch.taskType);
+    }
+    if (sets.length === 0) {
+        throw invalidRequest("PATCH body must include at least one updatable field.");
+    }
+    const sql = `
+    UPDATE chat_messages
+    SET ${sets.join(", ")}
+    WHERE id = ? AND role = 'system' AND run_id IS NOT NULL AND length(run_id) > 0
+    RETURNING ${COLUMNS}
+  `;
+    const row = db.prepare(sql).get(...args, id);
+    if (row === undefined)
+        throw notFound("Message");
+    return rowToMessage(row);
+}

package/dist/store/paths.d.ts

@@ -0,0 +1,5 @@
+export declare const UI_DB_FILENAME = "keiko-ui.db";
+export declare const UI_DB_DIRNAME = ".keiko";
+export declare function resolveUiDbPath(explicit: string | undefined, env: Readonly<Record<string, string | undefined>>): string;
+export declare function assertUiDbOutsideProject(uiDbPath: string | undefined, projectPath: string): void;
+//# sourceMappingURL=paths.d.ts.map

package/dist/store/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/store/paths.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,aAAa,WAAW,CAAC;AA4DtC,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,MAAM,CASR;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAgBhG"}

package/dist/store/paths.js

@@ -0,0 +1,84 @@
+// ADR-0013 D4 — resolveUiDbPath precedence (mirrors resolveEvidenceDir):
+// explicit option → KEIKO_UI_DATA_DIR/keiko-ui.db → homedir()/.keiko/keiko-ui.db.
+import { homedir } from "node:os";
+import { existsSync, lstatSync } from "node:fs";
+import { dirname, isAbsolute, join, normalize, parse, resolve, sep } from "node:path";
+import { invalidRequest } from "./errors.js";
+export const UI_DB_FILENAME = "keiko-ui.db";
+export const UI_DB_DIRNAME = ".keiko";
+function isInsideCurrentWorkingDirectory(path) {
+    const cwd = resolve(process.cwd());
+    const resolved = resolve(path);
+    return resolved === cwd || resolved.startsWith(`${cwd}${sep}`);
+}
+function isInsideRuntimeStateRoot(path, workspaceRoot) {
+    const runtimeRoot = resolve(workspaceRoot, UI_DB_DIRNAME);
+    const resolved = resolve(path);
+    return resolved === runtimeRoot || resolved.startsWith(`${runtimeRoot}${sep}`);
+}
+function hasSymlinkAncestor(path) {
+    let current = dirname(path);
+    const root = parse(current).root;
+    while (current !== root) {
+        if (existsSync(current)) {
+            return lstatSync(current).isSymbolicLink();
+        }
+        current = dirname(current);
+    }
+    return false;
+}
+function resolveConfiguredPath(path, label) {
+    // NUL bypass (CWE-22): path.normalize() leaves NUL bytes intact, so a string like
+    // "/safe/path\0/etc/passwd" satisfies the CWD-containment check but open(2) truncates
+    // at the NUL and lands on a completely different file. Reject NUL bytes first so the
+    // downstream guards reason about the same string the kernel will syscall on. Parity
+    // with the fix landed in packages/keiko-memory-vault/src/paths.ts (commit fbb90a88).
+    if (path.includes("\0")) {
+        throw invalidRequest(`${label} must not contain NUL bytes.`);
+    }
+    if (!isAbsolute(path)) {
+        throw invalidRequest(`${label} must be absolute.`);
+    }
+    const resolved = normalize(path);
+    if (isInsideCurrentWorkingDirectory(resolved) &&
+        !isInsideRuntimeStateRoot(resolved, process.cwd())) {
+        throw invalidRequest(`${label} must not be inside the current workspace.`);
+    }
+    if (existsSync(resolved) && lstatSync(resolved).isSymbolicLink()) {
+        throw invalidRequest(`${label} must not be a symlink.`);
+    }
+    if (hasSymlinkAncestor(resolved)) {
+        throw invalidRequest(`${label} must not be inside a symlinked directory.`);
+    }
+    return resolved;
+}
+function containsPath(parent, child) {
+    const resolvedParent = resolve(parent);
+    const resolvedChild = resolve(child);
+    return resolvedChild === resolvedParent || resolvedChild.startsWith(`${resolvedParent}${sep}`);
+}
+export function resolveUiDbPath(explicit, env) {
+    if (explicit !== undefined && explicit.length > 0) {
+        return resolveConfiguredPath(explicit, "UI database path");
+    }
+    const dir = env.KEIKO_UI_DATA_DIR;
+    if (dir !== undefined && dir.length > 0) {
+        return join(resolveConfiguredPath(dir, "KEIKO_UI_DATA_DIR"), UI_DB_FILENAME);
+    }
+    return join(homedir(), UI_DB_DIRNAME, UI_DB_FILENAME);
+}
+export function assertUiDbOutsideProject(uiDbPath, projectPath) {
+    if (uiDbPath === undefined || uiDbPath.length === 0) {
+        return;
+    }
+    const resolvedDbPath = resolve(uiDbPath);
+    const resolvedDbDir = dirname(resolvedDbPath);
+    const resolvedProject = resolve(projectPath);
+    if (containsPath(resolvedProject, resolvedDbPath) &&
+        !isInsideRuntimeStateRoot(resolvedDbPath, resolvedProject)) {
+        throw invalidRequest("UI database path must not be inside a selected project.");
+    }
+    if (containsPath(resolvedDbDir, resolvedProject)) {
+        throw invalidRequest("Selected projects must not be inside the UI database directory.");
+    }
+}

package/dist/store/projects.d.ts

@@ -0,0 +1,8 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { Project, UpdateProjectPatch } from "./types.js";
+export declare function listProjects(db: DatabaseSync): readonly Project[];
+export declare function getProject(db: DatabaseSync, path: string): Project | undefined;
+export declare function upsertProject(db: DatabaseSync, normalizedPath: string, name: string, hasExplicitName: boolean, now: number): Project;
+export declare function updateProject(db: DatabaseSync, path: string, patch: UpdateProjectPatch, now: number): Project;
+export declare function deleteProject(db: DatabaseSync, path: string): void;
+//# sourceMappingURL=projects.d.ts.map

package/dist/store/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/store/projects.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8C9D,wBAAgB,YAAY,CAAC,EAAE,EAAE,YAAY,GAAG,SAAS,OAAO,EAAE,CAEjE;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAG9E;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,OAAO,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAKT;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGlE"}

package/dist/store/projects.js

@@ -0,0 +1,59 @@
+// ADR-0013 — projects CRUD. All SQL is module-scope constants; no string-interpolation into SQL.
+import { notFound } from "./errors.js";
+function rowToProject(row) {
+    return {
+        path: row.path,
+        name: row.name,
+        favorite: row.favorite !== 0,
+        createdAt: row.created_at,
+        lastOpenedAt: row.last_opened_at,
+    };
+}
+const SQL_LIST = "SELECT path, name, favorite, created_at, last_opened_at FROM projects ORDER BY path";
+const SQL_GET = "SELECT path, name, favorite, created_at, last_opened_at FROM projects WHERE path = ?";
+// UPSERT: if path already exists, bump last_opened_at; createdAt is preserved by ON CONFLICT DO UPDATE.
+// A re-add with an explicit name repairs the display name; implicit basename derivation never
+// overwrites a user-chosen existing name.
+const SQL_UPSERT = `
+INSERT INTO projects (path, name, favorite, created_at, last_opened_at)
+VALUES (?, ?, 0, ?, ?)
+ON CONFLICT(path) DO UPDATE SET
+  name = CASE WHEN ? THEN excluded.name ELSE name END,
+  last_opened_at = excluded.last_opened_at
+RETURNING path, name, favorite, created_at, last_opened_at
+`;
+const SQL_UPDATE = `
+UPDATE projects
+SET name = COALESCE(?, name),
+    favorite = COALESCE(?, favorite),
+    last_opened_at = ?
+WHERE path = ?
+RETURNING path, name, favorite, created_at, last_opened_at
+`;
+const SQL_DELETE = "DELETE FROM projects WHERE path = ?";
+export function listProjects(db) {
+    return db.prepare(SQL_LIST).all().map(rowToProject);
+}
+export function getProject(db, path) {
+    const row = db.prepare(SQL_GET).get(path);
+    return row === undefined ? undefined : rowToProject(row);
+}
+export function upsertProject(db, normalizedPath, name, hasExplicitName, now) {
+    const row = db
+        .prepare(SQL_UPSERT)
+        .get(normalizedPath, name, now, now, hasExplicitName ? 1 : 0);
+    return rowToProject(row);
+}
+export function updateProject(db, path, patch, now) {
+    const nameParam = patch.name ?? null;
+    const favoriteParam = patch.favorite === undefined ? null : patch.favorite ? 1 : 0;
+    const row = db.prepare(SQL_UPDATE).get(nameParam, favoriteParam, now, path);
+    if (row === undefined)
+        throw notFound("Project");
+    return rowToProject(row);
+}
+export function deleteProject(db, path) {
+    const info = db.prepare(SQL_DELETE).run(path);
+    if (info.changes === 0)
+        throw notFound("Project");
+}

package/dist/store/relationship-audit.d.ts

@@ -0,0 +1,42 @@
+import type { DatabaseSync } from "node:sqlite";
+export declare const RELATIONSHIP_AUDIT_SCHEMA_VERSION: "1";
+export declare const RELATIONSHIP_AUDIT_SUMMARY_MAX_CHARS = 240;
+export type RelationshipAuditKind = "relationship.created" | "relationship.updated" | "relationship.deleted" | "relationship.reconnected" | "relationship.validation-denied" | "relationship.policy-denied" | "relationship.activity-transitioned" | "relationship.impact-analysis-bounded" | "relationship.health-finding";
+export type RelationshipAuditActorSurface = "chat" | "inspector" | "workflow" | "health-check" | "system";
+export type RelationshipAuditPlacement = "sibling-table" | "evidence-manifest";
+export interface RelationshipAuditEntryInput {
+    readonly eventId: string;
+    readonly workspaceId: string;
+    readonly occurredAt: number;
+    readonly kind: RelationshipAuditKind;
+    readonly relationshipId?: string | undefined;
+    readonly actor: {
+        readonly surface: RelationshipAuditActorSurface;
+        readonly redactedActorId: string;
+    };
+    readonly summary: string;
+    readonly payload: Readonly<Record<string, unknown>>;
+}
+export interface RelationshipAuditEntryRow {
+    readonly eventId: string;
+    readonly workspaceId: string;
+    readonly sequence: number;
+    readonly occurredAt: number;
+    readonly kind: RelationshipAuditKind;
+    readonly relationshipId: string | undefined;
+    readonly actorSurface: RelationshipAuditActorSurface;
+    readonly redactedActorId: string;
+    readonly redactionState: "redacted-on-write" | "redacted-on-write-and-persist";
+    readonly summary: string;
+    readonly payload: Readonly<Record<string, unknown>>;
+}
+export declare function resolveAuditPlacement(input: {
+    readonly kind: RelationshipAuditKind;
+    readonly sourceKind?: string | undefined;
+}): RelationshipAuditPlacement;
+export declare const MAX_AUDIT_LIST_LIMIT = 256;
+export declare const DEFAULT_AUDIT_LIST_LIMIT = 64;
+export declare function insertRelationshipAuditEntry(db: DatabaseSync, entry: RelationshipAuditEntryInput, redactString: (value: string) => string): RelationshipAuditEntryRow;
+export declare function listRelationshipAuditEntries(db: DatabaseSync, workspaceId: string, limit?: number): readonly RelationshipAuditEntryRow[];
+export declare function listRelationshipAuditEntriesForRelationship(db: DatabaseSync, workspaceId: string, relationshipId: string, limit?: number): readonly RelationshipAuditEntryRow[];
+//# sourceMappingURL=relationship-audit.d.ts.map

package/dist/store/relationship-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-audit.d.ts","sourceRoot":"","sources":["../../src/store/relationship-audit.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAKhD,eAAO,MAAM,iCAAiC,EAAG,GAAY,CAAC;AAC9D,eAAO,MAAM,oCAAoC,MAAM,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAC7B,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,0BAA0B,GAC1B,gCAAgC,GAChC,4BAA4B,GAC5B,oCAAoC,GACpC,sCAAsC,GACtC,6BAA6B,CAAC;AAElC,MAAM,MAAM,6BAA6B,GACrC,MAAM,GACN,WAAW,GACX,UAAU,GACV,cAAc,GACd,QAAQ,CAAC;AAEb,MAAM,MAAM,0BAA0B,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAE/E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;QAChD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,6BAA6B,CAAC;IACrD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,GAAG,+BAA+B,CAAC;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAKD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C,GAAG,0BAA0B,CAM7B;AAsCD,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AA2B3C,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,2BAA2B,EAClC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GACtC,yBAAyB,CA4C3B;AAoCD,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAiC,GACvC,SAAS,yBAAyB,EAAE,CAMtC;AAED,wBAAgB,2CAA2C,CACzD,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,KAAK,GAAE,MAAiC,GACvC,SAAS,yBAAyB,EAAE,CAQtC"}