@oscharko-dev/keiko 0.1.0-beta.0

package/dist/ui/store-handlers.js

@@ -0,0 +1,465 @@
+// ADR-0013 D7 — Route handlers for UI-local store routes. All inputs are validated;
+// every error path uses the redacted `{ error: { code, message } }` envelope; SECURITY_HEADERS are
+// applied uniformly by the server layer. JSON body reading is bounded by MAX_STORE_BODY_BYTES.
+import { errorBody } from "./routes.js";
+import { findCapability } from "../gateway/index.js";
+import { UiStoreError, assertUiDbOutsideProject, isProjectAvailable, validateProjectPath, } from "./store/index.js";
+const MAX_STORE_BODY_BYTES = 256_000;
+class BodyTooLargeError extends Error {
+    constructor() {
+        super("body too large");
+        this.name = "BodyTooLargeError";
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Body parsing helpers
+// ──────────────────────────────────────────────────────────────────────────
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let capped = false;
+        req.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > MAX_STORE_BODY_BYTES) {
+                if (!capped) {
+                    capped = true;
+                    chunks.length = 0;
+                    reject(new BodyTooLargeError());
+                    req.resume();
+                }
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (!capped)
+                resolve(Buffer.concat(chunks).toString("utf8"));
+        });
+        req.on("error", reject);
+    });
+}
+async function readJsonObject(req) {
+    let raw;
+    try {
+        raw = await readBody(req);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError)
+            throw error;
+        throw new InvalidRequest("Failed to read request body.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new InvalidRequest("Request body is not valid JSON.");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new InvalidRequest("Request body must be a JSON object.");
+    }
+    return parsed;
+}
+class InvalidRequest extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InvalidRequest";
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Error mapping
+// ──────────────────────────────────────────────────────────────────────────
+function uiStoreErrorResult(error) {
+    return { status: error.status, body: errorBody(error.code, error.message) };
+}
+function badRequest(code, message) {
+    return { status: 400, body: errorBody(code, message) };
+}
+function notFoundResult(message) {
+    return { status: 404, body: errorBody("not_found", message) };
+}
+function payloadTooLarge() {
+    return {
+        status: 413,
+        body: errorBody("payload_too_large", "Request body exceeds the size limit."),
+    };
+}
+async function runHandler(worker) {
+    try {
+        return await worker();
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError)
+            return payloadTooLarge();
+        if (error instanceof InvalidRequest)
+            return badRequest("invalid_request", error.message);
+        if (error instanceof UiStoreError)
+            return uiStoreErrorResult(error);
+        throw error;
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Field validators (typed narrowing from JSON)
+// ──────────────────────────────────────────────────────────────────────────
+function requireString(body, name) {
+    const v = body[name];
+    if (typeof v !== "string" || v.length === 0) {
+        throw new InvalidRequest(`Field "${name}" is required.`);
+    }
+    return v;
+}
+function optionalString(body, name) {
+    const v = body[name];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "string")
+        throw new InvalidRequest(`Field "${name}" must be a string.`);
+    return v;
+}
+function assertChatModelRegistryId(modelId) {
+    const capability = findCapability(modelId);
+    if (capability?.kind !== "chat") {
+        throw new InvalidRequest('Field "selectedModel" must be a chat model registry id.');
+    }
+}
+function requireChatModelId(body, name) {
+    const modelId = requireString(body, name);
+    assertChatModelRegistryId(modelId);
+    return modelId;
+}
+function optionalChatModelId(body, name) {
+    const modelId = optionalString(body, name);
+    if (modelId !== undefined)
+        assertChatModelRegistryId(modelId);
+    return modelId;
+}
+function optionalBoolean(body, name) {
+    const v = body[name];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "boolean")
+        throw new InvalidRequest(`Field "${name}" must be a boolean.`);
+    return v;
+}
+function requireNumber(body, name) {
+    const v = body[name];
+    if (typeof v !== "number" || !Number.isFinite(v)) {
+        throw new InvalidRequest(`Field "${name}" must be a finite number.`);
+    }
+    return v;
+}
+function requireObject(body, name) {
+    const v = body[name];
+    if (typeof v !== "object" || v === null || Array.isArray(v)) {
+        throw new InvalidRequest(`Field "${name}" must be a JSON object.`);
+    }
+    return v;
+}
+const ROLES = new Set(["user", "assistant", "system"]);
+const WORKFLOW_STATUSES = new Set([
+    "pending",
+    "running",
+    "completed",
+    "failed",
+    "cancelled",
+]);
+// Issue #66 — taskType labels non-workflow harness runs (verify, explain-plan) so the chat can
+// render a non-ambiguous label. Constrained to a-z/0-9/`-` so the value stays URL-safe and
+// matches the BFF descriptor taskType identifiers (verify, explain-plan).
+const MAX_TASK_TYPE = 64;
+const TASK_TYPE_RE = /^[a-z][a-z0-9-]*$/;
+function optionalTaskType(body) {
+    const v = body.taskType;
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "string" || v.length === 0 || v.length > MAX_TASK_TYPE || !TASK_TYPE_RE.test(v)) {
+        throw new InvalidRequest('Field "taskType" must match [a-z][a-z0-9-]* (≤ 64 chars).');
+    }
+    return v;
+}
+function requireRole(body) {
+    const v = body.role;
+    if (typeof v !== "string" || !ROLES.has(v)) {
+        throw new InvalidRequest('Field "role" must be one of user, assistant, system.');
+    }
+    return v;
+}
+function optionalWorkflowStatus(body) {
+    const v = body.workflowStatus;
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "string" || !WORKFLOW_STATUSES.has(v)) {
+        throw new InvalidRequest('Field "workflowStatus" is not a recognized value.');
+    }
+    return v;
+}
+function requireQuery(ctx, name) {
+    const v = ctx.url.searchParams.get(name);
+    if (v === null || v.length === 0)
+        throw new InvalidRequest(`Query "${name}" is required.`);
+    return v;
+}
+function projectWithAvailability(p) {
+    return { ...p, available: isProjectAvailable(p) };
+}
+function chatBelongsToProject(deps, projectPath, chatId) {
+    return deps.store.listChats(projectPath).some((chat) => chat.id === chatId);
+}
+function messageBelongsToChat(deps, chatId, messageId) {
+    return deps.store.listMessages(chatId).some((message) => message.id === messageId);
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 13 — GET /api/projects
+// ──────────────────────────────────────────────────────────────────────────
+export function handleListProjects(_ctx, deps) {
+    const projects = deps.store.listProjects().map(projectWithAvailability);
+    return { status: 200, body: { projects } };
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 14 — POST /api/projects
+// ──────────────────────────────────────────────────────────────────────────
+export async function handleCreateProject(ctx, deps) {
+    return runHandler(async () => {
+        const body = await readJsonObject(ctx.req);
+        const path = requireString(body, "path");
+        const name = optionalString(body, "name");
+        const normalizedPath = validateProjectPath(path, { mustExist: true });
+        assertUiDbOutsideProject(deps.uiDbPath, normalizedPath);
+        const project = deps.store.createProject(normalizedPath, name);
+        return { status: 201, body: { project: projectWithAvailability(project) } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 15 — PATCH /api/projects?path=...
+// ──────────────────────────────────────────────────────────────────────────
+function buildProjectPatch(body) {
+    const name = optionalString(body, "name");
+    const favorite = optionalBoolean(body, "favorite");
+    return {
+        ...(name !== undefined ? { name } : {}),
+        ...(favorite !== undefined ? { favorite } : {}),
+    };
+}
+export async function handleUpdateProject(ctx, deps) {
+    return runHandler(async () => {
+        const targetPath = requireQuery(ctx, "path");
+        const body = await readJsonObject(ctx.req);
+        const patch = buildProjectPatch(body);
+        const project = deps.store.updateProject(targetPath, patch);
+        return { status: 200, body: { project: projectWithAvailability(project) } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 16 — DELETE /api/projects?path=...
+// ──────────────────────────────────────────────────────────────────────────
+export function handleDeleteProject(ctx, deps) {
+    return runHandlerSync(() => {
+        const targetPath = requireQuery(ctx, "path");
+        deps.store.deleteProject(targetPath);
+        return { status: 204, body: null };
+    });
+}
+function runHandlerSync(worker) {
+    try {
+        return worker();
+    }
+    catch (error) {
+        if (error instanceof InvalidRequest)
+            return badRequest("invalid_request", error.message);
+        if (error instanceof UiStoreError)
+            return uiStoreErrorResult(error);
+        throw error;
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 17 — GET /api/chats?projectPath=...
+// ──────────────────────────────────────────────────────────────────────────
+export function handleListChats(ctx, deps) {
+    return runHandlerSync(() => {
+        const projectPath = requireQuery(ctx, "projectPath");
+        const chats = deps.store.listChats(projectPath);
+        return { status: 200, body: { chats } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 18 — POST /api/chats
+// ──────────────────────────────────────────────────────────────────────────
+export async function handleCreateChat(ctx, deps) {
+    return runHandler(async () => {
+        const body = await readJsonObject(ctx.req);
+        const projectPath = requireString(body, "projectPath");
+        const title = requireString(body, "title");
+        const selectedModel = requireChatModelId(body, "selectedModel");
+        const branchLabel = optionalString(body, "branchLabel");
+        const chat = deps.store.createChat(projectPath, title, selectedModel, branchLabel === undefined ? undefined : { branchLabel });
+        return { status: 201, body: { chat } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 19 — PATCH /api/chats?id=...
+// ──────────────────────────────────────────────────────────────────────────
+function buildChatPatch(body) {
+    const title = optionalString(body, "title");
+    const selectedModel = optionalChatModelId(body, "selectedModel");
+    const branchLabel = optionalString(body, "branchLabel");
+    const statusRaw = body.status;
+    const patch = {
+        ...(title !== undefined ? { title } : {}),
+        ...(selectedModel !== undefined ? { selectedModel } : {}),
+        ...(branchLabel !== undefined ? { branchLabel } : {}),
+    };
+    if (statusRaw === undefined)
+        return patch;
+    if (statusRaw !== "open" && statusRaw !== "closed") {
+        throw new InvalidRequest('Field "status" must be "open" or "closed".');
+    }
+    return { ...patch, status: statusRaw };
+}
+export async function handleUpdateChat(ctx, deps) {
+    return runHandler(async () => {
+        const id = requireQuery(ctx, "id");
+        const body = await readJsonObject(ctx.req);
+        const patch = buildChatPatch(body);
+        const chat = deps.store.updateChat(id, patch);
+        return { status: 200, body: { chat } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 20 — DELETE /api/chats?id=...
+// ──────────────────────────────────────────────────────────────────────────
+export function handleDeleteChat(ctx, deps) {
+    return runHandlerSync(() => {
+        const id = requireQuery(ctx, "id");
+        deps.store.deleteChat(id);
+        return { status: 204, body: null };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 21 — GET /api/chats/messages?chatId=...
+// ──────────────────────────────────────────────────────────────────────────
+export function handleListMessages(ctx, deps) {
+    return runHandlerSync(() => {
+        const chatId = requireQuery(ctx, "chatId");
+        const projectPath = requireQuery(ctx, "projectPath");
+        if (!chatBelongsToProject(deps, projectPath, chatId)) {
+            return notFoundResult("Chat not found.");
+        }
+        const messages = deps.store.listMessages(chatId);
+        return { status: 200, body: { messages } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 22 — POST /api/chats/messages
+// ──────────────────────────────────────────────────────────────────────────
+export async function handleCreateMessage(ctx, deps) {
+    return runHandler(async () => {
+        const body = await readJsonObject(ctx.req);
+        const chatId = requireString(body, "chatId");
+        const projectPath = requireString(body, "projectPath");
+        if (!chatBelongsToProject(deps, projectPath, chatId)) {
+            return notFoundResult("Chat not found.");
+        }
+        const role = requireRole(body);
+        const content = requireString(body, "content");
+        const timestamp = requireNumber(body, "timestamp");
+        const message = deps.store.createMessage({
+            chatId,
+            role,
+            content,
+            timestamp,
+            runId: optionalString(body, "runId"),
+            workflowId: optionalString(body, "workflowId"),
+            workflowStatus: optionalWorkflowStatus(body),
+            shortResult: optionalString(body, "shortResult"),
+            taskType: optionalTaskType(body),
+        });
+        return { status: 201, body: { message } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 23 — POST /api/chats/messages/run-summary-pair (issue #66)
+// ──────────────────────────────────────────────────────────────────────────
+function buildRunSummaryPair(body) {
+    const chatId = requireString(body, "chatId");
+    const user = requireObject(body, "user");
+    const summary = requireObject(body, "summary");
+    const workflowId = optionalString(summary, "workflowId");
+    const taskType = optionalTaskType(summary);
+    if ((workflowId === undefined) === (taskType === undefined)) {
+        throw new InvalidRequest('Run summary requires exactly one of "workflowId" or "taskType".');
+    }
+    const userMessage = {
+        chatId,
+        role: "user",
+        content: requireString(user, "content"),
+        timestamp: requireNumber(user, "timestamp"),
+        runId: undefined,
+        workflowId: undefined,
+        workflowStatus: undefined,
+        shortResult: undefined,
+        taskType: undefined,
+    };
+    const summaryMessage = {
+        chatId,
+        role: "system",
+        content: requireString(summary, "content"),
+        timestamp: requireNumber(summary, "timestamp"),
+        runId: requireString(summary, "runId"),
+        workflowId,
+        workflowStatus: optionalWorkflowStatus(summary),
+        shortResult: optionalString(summary, "shortResult"),
+        taskType,
+    };
+    if (summaryMessage.workflowStatus === undefined) {
+        throw new InvalidRequest('Field "summary.workflowStatus" is required.');
+    }
+    return [userMessage, summaryMessage];
+}
+export async function handleCreateRunSummaryPair(ctx, deps) {
+    return runHandler(async () => {
+        const body = await readJsonObject(ctx.req);
+        const chatId = requireString(body, "chatId");
+        const projectPath = requireString(body, "projectPath");
+        if (!chatBelongsToProject(deps, projectPath, chatId)) {
+            return notFoundResult("Chat not found.");
+        }
+        const messages = deps.store.createMessages(buildRunSummaryPair(body));
+        return { status: 201, body: { messages } };
+    });
+}
+// ──────────────────────────────────────────────────────────────────────────
+// Route 24 — PATCH /api/chats/messages?id=... (issue #66)
+// ──────────────────────────────────────────────────────────────────────────
+// Builds a typed UpdateChatMessagePatch from the JSON body. At least one updatable field must
+// appear; the store layer also fails-closed on this, but throwing here surfaces the friendlier
+// INVALID_REQUEST envelope without spending a SQL prepare.
+function buildMessagePatch(body) {
+    const workflowStatus = optionalWorkflowStatus(body);
+    const shortResult = optionalString(body, "shortResult");
+    const taskType = optionalTaskType(body);
+    if (workflowStatus === undefined && shortResult === undefined && taskType === undefined) {
+        throw new InvalidRequest("PATCH body must include at least one updatable field.");
+    }
+    return {
+        ...(workflowStatus !== undefined ? { workflowStatus } : {}),
+        ...(shortResult !== undefined ? { shortResult } : {}),
+        ...(taskType !== undefined ? { taskType } : {}),
+    };
+}
+export async function handleUpdateMessage(ctx, deps) {
+    return runHandler(async () => {
+        const id = requireQuery(ctx, "id");
+        const chatId = requireQuery(ctx, "chatId");
+        const projectPath = requireQuery(ctx, "projectPath");
+        if (!chatBelongsToProject(deps, projectPath, chatId) || !messageBelongsToChat(deps, chatId, id)) {
+            return notFoundResult("Message not found.");
+        }
+        const body = await readJsonObject(ctx.req);
+        const patch = buildMessagePatch(body);
+        const message = deps.store.updateMessage(id, patch);
+        return { status: 200, body: { message } };
+    });
+}
+// barrel-level NOT_FOUND helper used by future delete-missing paths
+export { notFoundResult };

package/dist/ui/terminal-errors.d.ts

@@ -0,0 +1,21 @@
+export declare const TERMINAL_ERROR_CODES: {
+    readonly PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND";
+    readonly COMMAND_DENIED: "COMMAND_DENIED";
+    readonly CWD_OUTSIDE_PROJECT: "CWD_OUTSIDE_PROJECT";
+    readonly CWD_DENIED: "CWD_DENIED";
+    readonly EXECUTION_NOT_FOUND: "EXECUTION_NOT_FOUND";
+    readonly EXECUTION_LIMIT_EXCEEDED: "EXECUTION_LIMIT_EXCEEDED";
+    readonly TIMEOUT: "TIMEOUT";
+    readonly CANCELLED: "CANCELLED";
+    readonly EXECUTABLE_NOT_FOUND: "EXECUTABLE_NOT_FOUND";
+    readonly EVIDENCE_WRITE_FAILED: "EVIDENCE_WRITE_FAILED";
+    readonly BAD_REQUEST: "BAD_REQUEST";
+    readonly PAYLOAD_TOO_LARGE: "PAYLOAD_TOO_LARGE";
+    readonly INTERNAL: "INTERNAL";
+};
+export type TerminalErrorCode = (typeof TERMINAL_ERROR_CODES)[keyof typeof TERMINAL_ERROR_CODES];
+export declare class TerminalToolError extends Error {
+    readonly code: TerminalErrorCode;
+    readonly status: number;
+    constructor(code: TerminalErrorCode, message: string);
+}

package/dist/ui/terminal-errors.js

@@ -0,0 +1,45 @@
+// ADR-0018 D10 — typed failure modes for the UI terminal tool. Callers switch on `code`; messages
+// are static strings that never leak filesystem paths or raw Node/OS error text into the HTTP
+// response or SSE event payload.
+export const TERMINAL_ERROR_CODES = {
+    PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
+    COMMAND_DENIED: "COMMAND_DENIED",
+    CWD_OUTSIDE_PROJECT: "CWD_OUTSIDE_PROJECT",
+    CWD_DENIED: "CWD_DENIED",
+    EXECUTION_NOT_FOUND: "EXECUTION_NOT_FOUND",
+    EXECUTION_LIMIT_EXCEEDED: "EXECUTION_LIMIT_EXCEEDED",
+    TIMEOUT: "TIMEOUT",
+    CANCELLED: "CANCELLED",
+    EXECUTABLE_NOT_FOUND: "EXECUTABLE_NOT_FOUND",
+    EVIDENCE_WRITE_FAILED: "EVIDENCE_WRITE_FAILED",
+    BAD_REQUEST: "BAD_REQUEST",
+    PAYLOAD_TOO_LARGE: "PAYLOAD_TOO_LARGE",
+    INTERNAL: "INTERNAL",
+};
+// HTTP status mapping per ADR-0018 D10. CANCELLED uses 499 ("Client Closed Request"), the
+// Nginx-popularised convention also used by the harness for abort-driven cancellation.
+const STATUS_MAP = {
+    PROJECT_NOT_FOUND: 404,
+    COMMAND_DENIED: 403,
+    CWD_OUTSIDE_PROJECT: 403,
+    CWD_DENIED: 403,
+    EXECUTION_NOT_FOUND: 404,
+    EXECUTION_LIMIT_EXCEEDED: 429,
+    TIMEOUT: 408,
+    CANCELLED: 499,
+    EXECUTABLE_NOT_FOUND: 404,
+    EVIDENCE_WRITE_FAILED: 500,
+    BAD_REQUEST: 400,
+    PAYLOAD_TOO_LARGE: 413,
+    INTERNAL: 500,
+};
+export class TerminalToolError extends Error {
+    code;
+    status;
+    constructor(code, message) {
+        super(message);
+        this.name = "TerminalToolError";
+        this.code = code;
+        this.status = STATUS_MAP[code];
+    }
+}

package/dist/ui/terminal-evidence.d.ts

@@ -0,0 +1,20 @@
+import type { EvidenceStore } from "../audit/store.js";
+import type { EvidenceManifest } from "../audit/types.js";
+export declare const TERMINAL_EVIDENCE_KIND: "terminal-execution";
+export type TerminalEvidenceEntry = EvidenceManifest;
+export interface TerminalEvidenceInput {
+    readonly executionId: string;
+    readonly projectId: string;
+    readonly command: string;
+    readonly argCount: number;
+    readonly exitCode: number | null;
+    readonly signal: string | null;
+    readonly durationMs: number;
+    readonly timedOut: boolean;
+    readonly truncated: boolean;
+    readonly stdoutBytes: number;
+    readonly stderrBytes: number;
+    readonly startedAt: number;
+}
+export declare function buildTerminalEvidenceEntry(input: TerminalEvidenceInput): TerminalEvidenceEntry;
+export declare function appendTerminalEvidence(store: EvidenceStore, entry: TerminalEvidenceEntry, redact: (input: string) => string): string;

package/dist/ui/terminal-evidence.js

@@ -0,0 +1,65 @@
+// ADR-0018 D6/D11 — terminal-execution evidence. Each execution writes a normal
+// EvidenceManifest via the existing EvidenceStore.put port, so the shared evidence list/detail
+// APIs can parse it. The terminal-specific data lives in the standard run/task identity plus one
+// commandExecutions record. It carries counts only — never command args, never output bytes.
+import { deepRedactStrings } from "../audit/redaction.js";
+import { EVIDENCE_SCHEMA_VERSION } from "../audit/types.js";
+import { HARNESS_VERSION } from "../harness/session.js";
+export const TERMINAL_EVIDENCE_KIND = "terminal-execution";
+function terminalOutcome(input) {
+    if (input.signal !== null)
+        return "cancelled";
+    if (input.timedOut)
+        return "limit-exceeded";
+    if (input.exitCode === null)
+        return "failed";
+    return "completed";
+}
+// PURE. Builds the on-disk manifest from a finished execution. The executionId and projectId carry
+// only identifiers; args and output are deliberately excluded.
+export function buildTerminalEvidenceEntry(input) {
+    const runId = input.executionId;
+    return {
+        evidenceSchemaVersion: EVIDENCE_SCHEMA_VERSION,
+        run: {
+            runId,
+            fingerprint: runId,
+            harnessVersion: HARNESS_VERSION,
+            taskType: TERMINAL_EVIDENCE_KIND,
+            outcome: terminalOutcome(input),
+            startedAt: input.startedAt,
+            finishedAt: input.startedAt + input.durationMs,
+            durationMs: input.durationMs,
+        },
+        model: { modelId: "terminal-tool", costClass: "unknown" },
+        usageTotals: { promptTokens: 0, completionTokens: 0, requestCount: 0, totalLatencyMs: 0 },
+        context: {
+            workspaceRoot: input.projectId,
+            totalCandidates: 0,
+            usedBytes: 0,
+            budgetBytes: 0,
+            droppedForBudget: 0,
+            entries: [],
+        },
+        stateTransitions: [],
+        toolCalls: [],
+        commandExecutions: [
+            {
+                seq: 1,
+                ts: input.startedAt,
+                executable: input.command,
+                argCount: input.argCount,
+                exitCode: input.exitCode,
+                timedOut: input.timedOut,
+                durationMs: input.durationMs,
+            },
+        ],
+    };
+}
+// Defense in depth: applies the live redactor to every string leaf of the entry before serializing.
+// All known leaves (command, projectId, executionId) are structurally safe today, but a future
+// schema addition would inherit the redaction automatically. Mirrors the persistEvidence pattern.
+export function appendTerminalEvidence(store, entry, redact) {
+    const safe = deepRedactStrings(entry, redact);
+    return store.put(safe.run.runId, JSON.stringify(safe, null, 2));
+}

package/dist/ui/terminal-routes.d.ts

@@ -0,0 +1,9 @@
+import { type TerminalErrorCode } from "./terminal-errors.js";
+import type { UiHandlerDeps } from "./deps.js";
+import { type HandlerOutcome, type RouteContext, type RouteResult } from "./routes.js";
+export declare function handleTerminalPolicy(_ctx: RouteContext, _deps: UiHandlerDeps): RouteResult;
+export declare function handleTerminalDirectories(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleCreateTerminalExecution(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleDeleteTerminalExecution(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleTerminalEvents(ctx: RouteContext, deps: UiHandlerDeps): HandlerOutcome;
+export type { TerminalErrorCode };