@oscharko-dev/keiko 0.1.0-beta.0

package/dist/ui/store/projects.d.ts

@@ -0,0 +1,7 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { Project, UpdateProjectPatch } from "./types.js";
+export declare function listProjects(db: DatabaseSync): readonly Project[];
+export declare function getProject(db: DatabaseSync, path: string): Project | undefined;
+export declare function upsertProject(db: DatabaseSync, normalizedPath: string, name: string, hasExplicitName: boolean, now: number): Project;
+export declare function updateProject(db: DatabaseSync, path: string, patch: UpdateProjectPatch, now: number): Project;
+export declare function deleteProject(db: DatabaseSync, path: string): void;

package/dist/ui/store/projects.js

@@ -0,0 +1,61 @@
+// ADR-0013 — projects CRUD. All SQL is module-scope constants; no string-interpolation into SQL.
+import { notFound } from "./errors.js";
+function rowToProject(row) {
+    return {
+        path: row.path,
+        name: row.name,
+        favorite: row.favorite !== 0,
+        createdAt: row.created_at,
+        lastOpenedAt: row.last_opened_at,
+    };
+}
+const SQL_LIST = "SELECT path, name, favorite, created_at, last_opened_at FROM projects ORDER BY path";
+const SQL_GET = "SELECT path, name, favorite, created_at, last_opened_at FROM projects WHERE path = ?";
+// UPSERT: if path already exists, bump last_opened_at; createdAt is preserved by ON CONFLICT DO UPDATE.
+// A re-add with an explicit name repairs the display name; implicit basename derivation never
+// overwrites a user-chosen existing name.
+const SQL_UPSERT = `
+INSERT INTO projects (path, name, favorite, created_at, last_opened_at)
+VALUES (?, ?, 0, ?, ?)
+ON CONFLICT(path) DO UPDATE SET
+  name = CASE WHEN ? THEN excluded.name ELSE name END,
+  last_opened_at = excluded.last_opened_at
+RETURNING path, name, favorite, created_at, last_opened_at
+`;
+const SQL_UPDATE = `
+UPDATE projects
+SET name = COALESCE(?, name),
+    favorite = COALESCE(?, favorite),
+    last_opened_at = ?
+WHERE path = ?
+RETURNING path, name, favorite, created_at, last_opened_at
+`;
+const SQL_DELETE = "DELETE FROM projects WHERE path = ?";
+export function listProjects(db) {
+    return db.prepare(SQL_LIST).all().map(rowToProject);
+}
+export function getProject(db, path) {
+    const row = db.prepare(SQL_GET).get(path);
+    return row === undefined ? undefined : rowToProject(row);
+}
+export function upsertProject(db, normalizedPath, name, hasExplicitName, now) {
+    const row = db
+        .prepare(SQL_UPSERT)
+        .get(normalizedPath, name, now, now, hasExplicitName ? 1 : 0);
+    return rowToProject(row);
+}
+export function updateProject(db, path, patch, now) {
+    const nameParam = patch.name ?? null;
+    const favoriteParam = patch.favorite === undefined ? null : patch.favorite ? 1 : 0;
+    const row = db
+        .prepare(SQL_UPDATE)
+        .get(nameParam, favoriteParam, now, path);
+    if (row === undefined)
+        throw notFound("Project");
+    return rowToProject(row);
+}
+export function deleteProject(db, path) {
+    const info = db.prepare(SQL_DELETE).run(path);
+    if (info.changes === 0)
+        throw notFound("Project");
+}

package/dist/ui/store/schema.d.ts

@@ -0,0 +1,3 @@
+import type { DatabaseSync } from "node:sqlite";
+export declare const SCHEMA_VERSION = 2;
+export declare function runMigrations(db: DatabaseSync): void;

package/dist/ui/store/schema.js

@@ -0,0 +1,77 @@
+// ADR-0013 D5 — Schema v1 + migration runner via PRAGMA user_version. Forward-only, idempotent,
+// transactional. Each migration is a `.sql` string of one or more CREATE/ALTER statements; the
+// runner applies migrations whose 1-based index > current user_version.
+export const SCHEMA_VERSION = 2;
+const V1_SQL = `
+CREATE TABLE projects (
+  path TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
+  favorite INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  last_opened_at INTEGER NOT NULL
+) STRICT;
+
+CREATE TABLE chats (
+  id TEXT NOT NULL PRIMARY KEY,
+  project_path TEXT NOT NULL REFERENCES projects(path) ON DELETE CASCADE,
+  title TEXT NOT NULL,
+  selected_model TEXT NOT NULL,
+  branch_label TEXT,
+  status TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+) STRICT;
+
+CREATE TABLE chat_messages (
+  id TEXT NOT NULL PRIMARY KEY,
+  chat_id TEXT NOT NULL REFERENCES chats(id) ON DELETE CASCADE,
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  timestamp INTEGER NOT NULL,
+  run_id TEXT,
+  workflow_id TEXT,
+  workflow_status TEXT,
+  short_result TEXT
+) STRICT;
+
+CREATE INDEX idx_chats_project_path ON chats(project_path);
+CREATE INDEX idx_messages_chat_id ON chat_messages(chat_id);
+CREATE INDEX idx_messages_chat_ts ON chat_messages(chat_id, timestamp);
+`;
+// V2 (issue #66) adds an additive `task_type` column to chat_messages so the chat can label
+// non-workflow task runs (verify, explain-plan) without overloading workflow_id. STRICT tables
+// require an explicit type for ALTER ... ADD COLUMN; existing rows materialise NULL.
+const V2_SQL = `
+ALTER TABLE chat_messages ADD COLUMN task_type TEXT;
+`;
+const MIGRATIONS = [
+    { version: 1, sql: V1_SQL },
+    { version: 2, sql: V2_SQL },
+];
+function currentUserVersion(db) {
+    const row = db.prepare("PRAGMA user_version").get();
+    return typeof row?.user_version === "number" ? row.user_version : 0;
+}
+function setUserVersion(db, v) {
+    // user_version cannot be parameterized; v is a server-controlled integer constant from MIGRATIONS.
+    db.exec(`PRAGMA user_version = ${String(v)}`);
+}
+// Applies pending migrations inside a single transaction. Throws (and rolls back) on any failure.
+export function runMigrations(db) {
+    const start = currentUserVersion(db);
+    const pending = MIGRATIONS.filter((m) => m.version > start);
+    if (pending.length === 0)
+        return;
+    db.exec("BEGIN");
+    try {
+        for (const m of pending) {
+            db.exec(m.sql);
+            setUserVersion(db, m.version);
+        }
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}

package/dist/ui/store/types.d.ts

@@ -0,0 +1,80 @@
+export interface Project {
+    readonly path: string;
+    readonly name: string;
+    readonly favorite: boolean;
+    readonly createdAt: number;
+    readonly lastOpenedAt: number;
+}
+export interface Chat {
+    readonly id: string;
+    readonly projectPath: string;
+    readonly title: string;
+    readonly selectedModel: string;
+    readonly branchLabel: string | undefined;
+    readonly status: "open" | "closed" | undefined;
+    readonly createdAt: number;
+    readonly updatedAt: number;
+}
+export type ChatRole = "user" | "assistant" | "system";
+export type WorkflowStatus = "pending" | "running" | "completed" | "failed" | "cancelled";
+export interface ChatMessage {
+    readonly id: string;
+    readonly chatId: string;
+    readonly role: ChatRole;
+    readonly content: string;
+    readonly timestamp: number;
+    readonly runId: string | undefined;
+    readonly workflowId: string | undefined;
+    readonly workflowStatus: WorkflowStatus | undefined;
+    readonly shortResult: string | undefined;
+    readonly taskType: string | undefined;
+}
+export interface CreateChatOptions {
+    readonly branchLabel?: string;
+}
+export interface UpdateProjectPatch {
+    readonly name?: string;
+    readonly favorite?: boolean;
+}
+export interface UpdateChatPatch {
+    readonly title?: string;
+    readonly selectedModel?: string;
+    readonly branchLabel?: string;
+    readonly status?: "open" | "closed";
+}
+export interface NewChatMessage {
+    readonly chatId: string;
+    readonly role: ChatRole;
+    readonly content: string;
+    readonly timestamp: number;
+    readonly runId: string | undefined;
+    readonly workflowId: string | undefined;
+    readonly workflowStatus: WorkflowStatus | undefined;
+    readonly shortResult: string | undefined;
+    readonly taskType: string | undefined;
+}
+export interface UpdateChatMessagePatch {
+    readonly workflowStatus?: WorkflowStatus;
+    readonly shortResult?: string;
+    readonly taskType?: string;
+}
+export interface UiStore {
+    readonly listProjects: () => readonly Project[];
+    readonly createProject: (path: string, name?: string) => Project;
+    readonly updateProject: (path: string, patch: UpdateProjectPatch) => Project;
+    readonly deleteProject: (path: string) => void;
+    readonly listChats: (projectPath: string) => readonly Chat[];
+    readonly createChat: (projectPath: string, title: string, selectedModel: string, opts?: CreateChatOptions) => Chat;
+    readonly updateChat: (id: string, patch: UpdateChatPatch) => Chat;
+    readonly deleteChat: (id: string) => void;
+    readonly listMessages: (chatId: string) => readonly ChatMessage[];
+    readonly createMessage: (msg: NewChatMessage) => ChatMessage;
+    readonly createMessages: (messages: readonly NewChatMessage[]) => readonly ChatMessage[];
+    readonly updateMessage: (id: string, patch: UpdateChatMessagePatch) => ChatMessage;
+    readonly close: () => void;
+}
+export interface UiStoreFactoryOptions {
+    readonly now?: () => number;
+    readonly newId?: () => string;
+    readonly redactString?: (input: string) => string;
+}

package/dist/ui/store/types.js

@@ -0,0 +1,3 @@
+// ADR-0013 D4 — UiStore port and entity types. The port is the seam for testing; the concrete
+// `createNodeUiStore` adapter and the `createInMemoryUiStore` test adapter both implement it.
+export {};

package/dist/ui/store/validation.d.ts

@@ -0,0 +1,4 @@
+export interface ValidateProjectPathOptions {
+    readonly mustExist: boolean;
+}
+export declare function validateProjectPath(input: string, options: ValidateProjectPathOptions): string;

package/dist/ui/store/validation.js

@@ -0,0 +1,72 @@
+// ADR-0013 D6 — Path validation policy (fail-closed). Seven rules in one place. NO path reaches the
+// database without passing every check. Normalized absolute form is the only thing that returns.
+import { isAbsolute, normalize, resolve as resolvePath } from "node:path";
+import { statSync } from "node:fs";
+import { invalidPath, pathNotDirectory, pathNotFound } from "./errors.js";
+const MAX_PATH_LEN = 4096;
+// scheme prefix per RFC 3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) "://"
+const REMOTE_URL_PREFIX_RE = /^[a-zA-Z][a-zA-Z0-9+\-.]*:\/\//;
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
+const WINDOWS_TRAVERSAL_SEGMENT_RE = /(^|[\\/])\.\.(?:[\\/]|$)/;
+function isWindowsRootPath(input) {
+    return input.startsWith("\\\\") || input.startsWith("//");
+}
+function rejectWindowsPathShape(input) {
+    if (WINDOWS_DRIVE_RE.test(input) || isWindowsRootPath(input)) {
+        throw invalidPath("Windows drive, UNC, and device paths are not supported.");
+    }
+}
+function rejectTraversal(input) {
+    if (WINDOWS_TRAVERSAL_SEGMENT_RE.test(input)) {
+        throw invalidPath("Path contains a traversal segment.");
+    }
+    // Pre-normalize traversal segment check (D6 rule 5): reject explicit `..` segments.
+    if (input.includes("/../") || input.endsWith("/..") || input === "..") {
+        throw invalidPath("Path contains a traversal segment.");
+    }
+}
+function rejectStructural(input) {
+    if (input.length === 0)
+        throw invalidPath("Path is empty.");
+    if (input.length > MAX_PATH_LEN)
+        throw invalidPath("Path too long.");
+    if (input.includes("\0"))
+        throw invalidPath("Path contains a null byte.");
+    if (REMOTE_URL_PREFIX_RE.test(input))
+        throw invalidPath("Remote URL forms are not allowed.");
+    rejectWindowsPathShape(input);
+    rejectTraversal(input);
+    if (!isAbsolute(input))
+        throw invalidPath("Path must be absolute.");
+}
+function normalizeOrReject(input) {
+    const normalized = normalize(input);
+    const resolved = resolvePath(normalized);
+    if (!isAbsolute(resolved))
+        throw invalidPath("Path must be absolute after normalization.");
+    rejectWindowsPathShape(resolved);
+    rejectTraversal(resolved);
+    return resolved;
+}
+function statAsDirectory(resolved) {
+    let s;
+    try {
+        s = statSync(resolved);
+    }
+    catch {
+        throw pathNotFound();
+    }
+    if (!s.isDirectory())
+        throw pathNotDirectory();
+}
+// Validates and normalizes a project path. Returns the canonical absolute path on success; throws a
+// typed UiStoreError otherwise. When `mustExist` is false, the stat-as-directory step is skipped
+// (PATCH/DELETE callers identify a project by its previously normalized path; the directory may
+// have been deleted/moved since registration — that is reflected via derived availability).
+export function validateProjectPath(input, options) {
+    rejectStructural(input);
+    const resolved = normalizeOrReject(input);
+    if (options.mustExist)
+        statAsDirectory(resolved);
+    return resolved;
+}

package/dist/ui/store-handlers.d.ts

@@ -0,0 +1,16 @@
+import type { RouteContext, RouteResult } from "./routes.js";
+import type { UiHandlerDeps } from "./deps.js";
+declare function notFoundResult(message: string): RouteResult;
+export declare function handleListProjects(_ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleCreateProject(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleUpdateProject(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleDeleteProject(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleListChats(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleCreateChat(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleUpdateChat(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleDeleteChat(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleListMessages(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleCreateMessage(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleCreateRunSummaryPair(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleUpdateMessage(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export { notFoundResult };