@pasko70/pibo 3.4.3 → 3.5.0

package/dist/data/pibo-store.js

@@ -23,10 +23,12 @@ export class PiboDataStore {
     telemetry;
     constructor(path = piboHomePath("pibo.sqlite"), options = {}) {
         this.path = path === ":memory:" ? path : resolve(path);
-        const insidePiboHome = ensurePrivatePiboHomeForPath(this.path);
-        if (this.path !== ":memory:")
+        const insidePiboHome = !options.readOnly && ensurePrivatePiboHomeForPath(this.path);
+        if (!options.readOnly && this.path !== ":memory:")
             mkdirSync(dirname(this.path), { recursive: true });
-        this.db = new DatabaseSync(this.path);
+        this.db = new DatabaseSync(this.path, { readOnly: options.readOnly === true });
+        // Connection-only configuration also protects the initial schema read.
+        this.db.exec("PRAGMA busy_timeout = 5000");
         try {
             assertSupportedPiboDataSchemaVersion(this.db);
         }
@@ -34,14 +36,14 @@ export class PiboDataStore {
             this.db.close();
             throw error;
         }
-        if (insidePiboHome)
+        if (!options.readOnly && insidePiboHome)
             protectPrivateFileSync(this.path);
-        this.db.exec("PRAGMA busy_timeout = 5000");
         this.db.exec("PRAGMA foreign_keys = ON");
-        if (this.path !== ":memory:")
+        if (!options.readOnly && this.path !== ":memory:")
             this.db.exec("PRAGMA journal_mode = WAL");
-        applyPiboDataSchema(this.db);
-        this.payloads = new PayloadStore(this.db, options.payloadRootDir ?? piboHomePath("payloads"));
+        if (!options.readOnly)
+            applyPiboDataSchema(this.db);
+        this.payloads = new PayloadStore(this.db, options.payloadRootDir ?? piboHomePath("payloads"), options.readOnly);
         this.eventLog = new PiboEventLogStore(this.db);
         this.messages = new MessageStore(this.db);
         this.observations = new ObservationStore(this.db);

package/dist/data/schema.js

@@ -1,4 +1,7 @@
-export const PIBO_DATA_SCHEMA_VERSION = 9;
+import { CHAT_READ_PROJECTION_SCHEMA, CHAT_NAVIGATION_REVISION_SCHEMA } from "./chat-read-projections.js";
+import { TELEMETRY_MAINTENANCE_SCHEMA } from "./telemetry-maintenance.js";
+import { MESSAGE_COMMAND_SCHEMA } from "./message-command-store.js";
+export const PIBO_DATA_SCHEMA_VERSION = 13;
 const NATIVE_HISTORY_FALLBACK_SCHEMA_VERSION = 5;
 const retiredScopeColumn = ["owner", "scope"].join("_");
 const payloadTableDefinition = `
@@ -710,6 +713,12 @@ function applyPiboDataSchemaInTransaction(db, hooks, previousVersion, tablesToRe
 			ON telemetry_turns(retention_class, updated_at);
 		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_turn_started
 			ON telemetry_phases(turn_id, started_at ASC);
+		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_open_name
+			ON telemetry_phases(turn_id, name, COALESCE(last_progress_at, started_at) DESC, created_at DESC) WHERE status='open';
+		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_open_turn
+			ON telemetry_phases(turn_id, started_at ASC, created_at ASC) WHERE status='open';
+		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_turn_name
+			ON telemetry_phases(turn_id, name);
 		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_session_status
 			ON telemetry_phases(pibo_session_id, status, last_progress_at);
 		CREATE INDEX IF NOT EXISTS idx_telemetry_phases_provider_request
@@ -759,6 +768,9 @@ function applyPiboDataSchemaInTransaction(db, hooks, previousVersion, tablesToRe
 		CREATE INDEX IF NOT EXISTS idx_telemetry_tool_calls_retention_updated
 			ON telemetry_tool_calls(retention_class, updated_at);
 	`);
+    db.exec(CHAT_READ_PROJECTION_SCHEMA);
+    db.exec(CHAT_NAVIGATION_REVISION_SCHEMA);
+    db.exec(TELEMETRY_MAINTENANCE_SCHEMA);
     hooks.afterStep?.("schema");
     db.exec(`
 		INSERT OR IGNORE INTO session_runtime_bindings (
@@ -798,6 +810,7 @@ function applyPiboDataSchemaInTransaction(db, hooks, previousVersion, tablesToRe
 			END;
 	`);
     hooks.afterStep?.("render-high-water");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_event_log_sequence_repair_candidates ON event_log(session_id) WHERE session_id IS NOT NULL AND (session_sequence IS NULL OR session_sequence <= 0)");
     // Always inspect for interrupted pre-atomic v7 repairs. A previous process
     // may have written negative temporary values before setting user_version.
     db.exec(`
@@ -807,7 +820,7 @@ function applyPiboDataSchemaInTransaction(db, hooks, previousVersion, tablesToRe
 		);
 		INSERT INTO pibo_v7_sequence_repair_sessions (session_id)
 		SELECT DISTINCT session_id
-		FROM event_log
+		FROM event_log INDEXED BY idx_event_log_sequence_repair_candidates
 		WHERE session_id IS NOT NULL
 			AND (session_sequence IS NULL OR session_sequence <= 0);
 	`);
@@ -858,6 +871,7 @@ function applyPiboDataSchemaInTransaction(db, hooks, previousVersion, tablesToRe
         }
     }
     hooks.afterStep?.("runtime-binding-metadata");
+    db.exec(MESSAGE_COMMAND_SCHEMA);
     db.exec(`PRAGMA user_version = ${PIBO_DATA_SCHEMA_VERSION}`);
     hooks.afterStep?.("user-version");
 }

package/dist/data/session-store.js

@@ -31,7 +31,7 @@ export class SessionStore {
             now,
         ];
         const assignments = [
-            "pi_session_id = excluded.pi_session_id",
+            ...(input.preserveRuntimeBinding ? [] : ["pi_session_id = excluded.pi_session_id"]),
             "room_id = excluded.room_id",
             "root_session_id = excluded.root_session_id",
             "parent_id = excluded.parent_id",
@@ -53,6 +53,8 @@ export class SessionStore {
 			VALUES (${baseColumns.map(() => "?").join(", ")})
 			ON CONFLICT(id) DO UPDATE SET ${assignments.join(", ")}
 		`).run(...values);
+        if (input.preserveRuntimeBinding)
+            return;
         const binding = input.session.runtimeBinding
             ?? createLegacyPiRuntimeSessionBinding(input.session.id, input.session.piSessionId, input.session.createdAt);
         this.db.prepare(`

package/dist/data/storage-backup.js

@@ -0,0 +1,278 @@
+import { DatabaseSync, backup } from "node:sqlite";
+import { createHash } from "node:crypto";
+import { createReadStream, createWriteStream, statSync } from "node:fs";
+import { mkdir, open, readFile, rename, stat, copyFile } from "node:fs/promises";
+import { basename, dirname, resolve, relative, join, isAbsolute } from "node:path";
+import { createGunzip } from "node:zlib";
+import { pipeline } from "node:stream/promises";
+const MANIFEST = "manifest.json", CATALOG = "payloads.jsonl", DATABASE = "snapshot.sqlite";
+function ownedPath(root, path) { const target = resolve(root, path), rel = relative(resolve(root), target); if (isAbsolute(path) || rel === ".." || rel.startsWith("../") || rel.startsWith("..\\"))
+    throw Error("Backup path escapes its directory"); return target; }
+async function syncFile(path) { const file = await open(path, "r"); try {
+    await file.sync();
+}
+finally {
+    await file.close();
+} }
+async function publishManifest(root, manifest) { const temp = join(root, MANIFEST + ".tmp"), file = await open(temp, "w", 0o600); try {
+    await file.writeFile(JSON.stringify(manifest) + "\n");
+    await file.sync();
+}
+finally {
+    await file.close();
+} await rename(temp, join(root, MANIFEST)); await syncFile(root); }
+export async function readStorageBackupManifest(root) { const path = join(root, MANIFEST); if ((await stat(path)).size > 16384)
+    throw Error("Backup manifest exceeds budget"); const m = JSON.parse(await readFile(path, "utf8")); if (m.format !== "pibo-storage-backup-v1" || !["snapshot", "payloads", "complete"].includes(m.status) || !Number.isSafeInteger(m.maxBytes) || !Number.isSafeInteger(m.maxPayloads))
+    throw Error("Unsupported backup manifest"); return m; }
+async function digest(path, maximum, encoding, signal) { const input = createReadStream(path, { highWaterMark: 65536, signal }); const stream = encoding === "gzip" ? input.pipe(createGunzip()) : input; let bytes = 0; const hash = createHash("sha256"); try {
+    for await (const chunk of stream) {
+        signal?.throwIfAborted();
+        bytes += chunk.length;
+        if (bytes > maximum)
+            throw Error("Backup byte quota exceeded");
+        hash.update(chunk);
+    }
+    return { sha256: hash.digest("hex"), bytes };
+}
+finally {
+    input.destroy();
+    stream.destroy();
+} }
+/** Explicit offline operator operation. The SQLite online-backup API includes committed WAL data. */
+export async function createStorageBackup(input) {
+    const milliseconds = input.maxMilliseconds ?? 60000;
+    if (!Number.isSafeInteger(milliseconds) || milliseconds < 1 || milliseconds > 3600000)
+        throw Error("Invalid backup time quota");
+    const timeout = AbortSignal.timeout(milliseconds);
+    input = { ...input, signal: input.signal ? AbortSignal.any([input.signal, timeout]) : timeout };
+    const root = resolve(input.destination), source = resolve(input.source), payloadRoot = resolve(input.payloadRoot), deadline = Date.now() + (input.maxMilliseconds ?? 60000);
+    const check = () => { input.signal?.throwIfAborted(); if (Date.now() > deadline)
+        throw Error("Backup time budget exhausted; resume explicitly"); };
+    let manifest;
+    let snapshotVerified = false;
+    if (input.resume) {
+        manifest = await readStorageBackupManifest(root);
+        if (manifest.source !== source || manifest.payloadRoot !== payloadRoot)
+            throw Error("Backup resume source does not match manifest");
+    }
+    else {
+        const maxBytes = input.maxBytes ?? 1024 * 1024 * 1024, maxPayloads = input.maxPayloads ?? 100000;
+        if (!Number.isSafeInteger(maxBytes) || maxBytes < 4096 || !Number.isSafeInteger(maxPayloads) || maxPayloads < 1 || maxPayloads > 1000000)
+            throw Error("Invalid backup quota");
+        await mkdir(root, { mode: 0o700 });
+        manifest = { format: "pibo-storage-backup-v1", status: "snapshot", source, payloadRoot, createdAt: new Date().toISOString(), payloadCount: 0, payloadBytes: 0, cursor: "", maxBytes, maxPayloads };
+        await publishManifest(root, manifest);
+    }
+    if (manifest.status === "complete") {
+        await verifyStorageBackup(root, input.signal);
+        return manifest;
+    }
+    if (manifest.status === "snapshot") {
+        check();
+        const walBytes = () => { try {
+            return statSync(source + "-wal").size;
+        }
+        catch {
+            return 0;
+        } };
+        const initialWalBytes = walBytes(), maxWalGrowth = input.maxWalGrowthBytes ?? 64 * 1024 * 1024;
+        if (!Number.isSafeInteger(maxWalGrowth) || maxWalGrowth < 0)
+            throw Error("Invalid WAL growth quota");
+        const db = new DatabaseSync(source, { readOnly: true });
+        const temporary = join(root, DATABASE + ".partial");
+        try {
+            db.exec("PRAGMA busy_timeout=10; BEGIN");
+            const pages = db.prepare("PRAGMA page_count").get().page_count, pageSize = db.prepare("PRAGMA page_size").get().page_size;
+            if (pages * pageSize > manifest.maxBytes)
+                throw Error("Database exceeds backup byte quota");
+            await backup(db, temporary, { rate: 128, progress: ({ totalPages, remainingPages }) => { check(); if (walBytes() - initialWalBytes > maxWalGrowth)
+                    throw Error("Backup WAL growth quota exceeded; source snapshot released"); if (totalPages * pageSize > manifest.maxBytes)
+                    throw Error("Database exceeds backup byte quota"); input.onProgress?.({ stage: "snapshot", copied: (totalPages - remainingPages) * pageSize }); } });
+        }
+        finally {
+            if (db.isTransaction)
+                db.exec("ROLLBACK");
+            db.close();
+        }
+        await syncFile(temporary);
+        await rename(temporary, join(root, DATABASE));
+        const hash = await digest(join(root, DATABASE), manifest.maxBytes, undefined, input.signal);
+        snapshotVerified = true;
+        manifest.databaseSha256 = hash.sha256;
+        manifest.databaseBytes = hash.bytes;
+        manifest.status = "payloads";
+        await publishManifest(root, manifest);
+    }
+    const database = join(root, DATABASE);
+    if (!snapshotVerified && (await digest(database, manifest.maxBytes, undefined, input.signal)).sha256 !== manifest.databaseSha256)
+        throw Error("Backup snapshot hash changed");
+    const db = new DatabaseSync(database, { readOnly: true });
+    try {
+        if (db.prepare("PRAGMA quick_check").get().quick_check !== "ok")
+            throw Error("Backup SQLite integrity check failed");
+        // Rebuild the small cursor from the fsynced catalog, including a file published before a crash.
+        let count = 0, bytes = 0, cursor = "";
+        const catalog = join(root, CATALOG);
+        const catalogFile = await open(catalog, "a+", 0o600);
+        try {
+            const size = (await catalogFile.stat()).size;
+            if (size) {
+                const tail = Buffer.alloc(Math.min(8192, size));
+                await catalogFile.read(tail, 0, tail.length, size - tail.length);
+                if (tail.at(-1) !== 10) {
+                    const newline = tail.lastIndexOf(10);
+                    if (newline < 0 && size > 8192)
+                        throw Error("Invalid partial backup catalog");
+                    await catalogFile.truncate(newline < 0 ? 0 : size - tail.length + newline + 1);
+                    await catalogFile.sync();
+                }
+            }
+        }
+        finally {
+            await catalogFile.close();
+        }
+        for await (const row of catalogRows(catalog, manifest.maxPayloads)) {
+            check();
+            if (row.id <= cursor)
+                throw Error("Backup catalog order is invalid");
+            const hash = await digest(ownedPath(join(root, "payloads"), row.path), manifest.maxBytes, undefined, input.signal);
+            if (hash.sha256 !== row.storedSha256 || hash.bytes !== row.bytes)
+                throw Error("Backup payload changed");
+            count++;
+            bytes += row.bytes;
+            cursor = row.id;
+        }
+        manifest.payloadCount = count;
+        manifest.payloadBytes = bytes;
+        manifest.cursor = cursor;
+        const hasPayloads = Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='payloads'").get());
+        while (hasPayloads) {
+            check();
+            const rows = db.prepare("SELECT id,storage_path,sha256,encoding,byte_size,status FROM payloads WHERE id>? ORDER BY id LIMIT 128").all(manifest.cursor);
+            if (!rows.length)
+                break;
+            for (const row of rows) {
+                check();
+                if (!row.storage_path || row.status !== "committed")
+                    throw Error("Snapshot contains unavailable payload metadata");
+                if (manifest.payloadCount >= manifest.maxPayloads)
+                    throw Error("Backup payload count quota exceeded");
+                const sourcePath = ownedPath(payloadRoot, row.storage_path), target = ownedPath(join(root, "payloads"), row.storage_path), size = (await stat(sourcePath)).size;
+                if ((manifest.databaseBytes ?? 0) + manifest.payloadBytes + size > manifest.maxBytes)
+                    throw Error("Backup byte quota exceeded");
+                await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+                const temporary = target + ".partial";
+                await pipeline(createReadStream(sourcePath, { highWaterMark: 65536 }), createWriteStream(temporary, { mode: 0o600 }), { signal: input.signal });
+                const raw = await digest(temporary, manifest.maxBytes, undefined, input.signal), content = await digest(temporary, row.byte_size, row.encoding, input.signal);
+                if (content.sha256 !== row.sha256 || content.bytes !== row.byte_size)
+                    throw Error("Source payload failed content verification");
+                await syncFile(temporary);
+                await rename(temporary, target);
+                await syncFile(dirname(target));
+                const entry = { id: row.id, path: row.storage_path, sha256: row.sha256, storedSha256: raw.sha256, bytes: raw.bytes, encoding: row.encoding, contentBytes: row.byte_size };
+                const file = await open(catalog, "a", 0o600);
+                try {
+                    await file.writeFile(JSON.stringify(entry) + "\n");
+                    await file.sync();
+                }
+                finally {
+                    await file.close();
+                }
+                manifest.payloadCount++;
+                manifest.payloadBytes += raw.bytes;
+                manifest.cursor = row.id;
+                input.onProgress?.({ stage: "payloads", copied: manifest.payloadCount });
+            }
+            await publishManifest(root, manifest);
+        }
+        manifest.catalogSha256 = (await digest(catalog, Math.max(1024, manifest.maxPayloads * 4096), undefined, input.signal)).sha256;
+        manifest.status = "complete";
+        await publishManifest(root, manifest);
+        return manifest;
+    }
+    finally {
+        db.close();
+    }
+}
+async function* catalogRows(path, maximum) {
+    const stream = createReadStream(path, { highWaterMark: 65536, encoding: "utf8" });
+    let count = 0, pending = "";
+    const parse = (line) => { if (line.length > 4096 || ++count > maximum)
+        throw Error("Backup catalog exceeds quota"); const row = JSON.parse(line); if (typeof row.id !== "string" || typeof row.path !== "string" || !Number.isSafeInteger(row.bytes) || row.bytes < 0)
+        throw Error("Invalid backup catalog row"); return row; };
+    try {
+        for await (const chunk of stream) {
+            pending += chunk;
+            let newline;
+            while ((newline = pending.indexOf("\n")) >= 0) {
+                const line = pending.slice(0, newline);
+                pending = pending.slice(newline + 1);
+                yield parse(line);
+            }
+            if (pending.length > 4096)
+                throw Error("Backup catalog line exceeds quota");
+        }
+        if (pending)
+            throw Error("Incomplete backup catalog line");
+    }
+    finally {
+        stream.destroy();
+    }
+}
+export async function verifyStorageBackup(root, signal) {
+    const m = await readStorageBackupManifest(root);
+    if (m.status !== "complete")
+        throw Error("Backup is incomplete");
+    if ((await digest(join(root, DATABASE), m.maxBytes, undefined, signal)).sha256 !== m.databaseSha256 || (await digest(join(root, CATALOG), Math.max(1024, m.maxPayloads * 4096), undefined, signal)).sha256 !== m.catalogSha256)
+        throw Error("Backup manifest hash mismatch");
+    const db = new DatabaseSync(join(root, DATABASE), { readOnly: true });
+    let payloads = 0, bytes = m.databaseBytes ?? 0, previousId = "";
+    try {
+        if (db.prepare("PRAGMA quick_check").get().quick_check !== "ok")
+            throw Error("Backup database failed verification");
+        const hasPayloads = Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='payloads'").get());
+        for await (const row of catalogRows(join(root, CATALOG), m.maxPayloads)) {
+            signal?.throwIfAborted();
+            if (row.id <= previousId)
+                throw Error("Backup catalog order is invalid");
+            previousId = row.id;
+            const metadata = hasPayloads ? db.prepare("SELECT sha256,storage_path,byte_size FROM payloads WHERE id=?").get(row.id) : undefined;
+            if (!metadata || metadata.sha256 !== row.sha256 || metadata.storage_path !== row.path || metadata.byte_size !== row.contentBytes)
+                throw Error("Catalog does not match snapshot");
+            const path = ownedPath(join(root, "payloads"), row.path);
+            const raw = await digest(path, m.maxBytes, undefined, signal), content = await digest(path, row.contentBytes, row.encoding, signal);
+            if (raw.sha256 !== row.storedSha256 || raw.bytes !== row.bytes || content.sha256 !== row.sha256 || content.bytes !== row.contentBytes)
+                throw Error("Backup payload hash mismatch");
+            payloads++;
+            bytes += raw.bytes;
+            if (bytes > m.maxBytes)
+                throw Error("Backup exceeds byte quota");
+        }
+        const expected = hasPayloads ? Number(db.prepare("SELECT COUNT(*) AS count FROM payloads").get().count) : 0;
+        if (payloads !== expected || payloads !== m.payloadCount)
+            throw Error("Backup payload coverage mismatch");
+        return { payloads, bytes };
+    }
+    finally {
+        db.close();
+    }
+}
+export async function restoreStorageBackup(root, destination, signal) {
+    await verifyStorageBackup(root, signal);
+    const m = await readStorageBackupManifest(root), name = basename(m.source);
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name))
+        throw Error("Unsafe restored database name");
+    await mkdir(destination, { mode: 0o700 });
+    const payloadRoot = join(destination, "payloads"), database = join(destination, name);
+    for await (const row of catalogRows(join(root, CATALOG), m.maxPayloads)) {
+        signal?.throwIfAborted();
+        const target = ownedPath(payloadRoot, row.path);
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        await copyFile(ownedPath(join(root, "payloads"), row.path), target);
+        await syncFile(target);
+    }
+    await copyFile(join(root, DATABASE), database);
+    await syncFile(database);
+    await syncFile(destination);
+    return { database, payloadRoot };
+}

package/dist/data/telemetry-capture.js

@@ -0,0 +1,188 @@
+import { DatabaseSync, backup } from "node:sqlite";
+import { randomUUID, createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, statSync, openSync, closeSync, fsyncSync, createReadStream } from "node:fs";
+import { join } from "node:path";
+function validId(id) { if (!/^capture_[a-f0-9-]{36}$/.test(id))
+    throw Error("Invalid capture id"); return id; }
+function readJson(path) { if (statSync(path).size > 16384)
+    throw Error("Capture manifest exceeds budget"); return JSON.parse(readFileSync(path, "utf8")); }
+function publish(path, value) { const temp = path + ".tmp"; writeFileSync(temp, JSON.stringify(value) + "\n", { mode: 0o600 }); const fd = openSync(temp, "r"); try {
+    fsyncSync(fd);
+}
+finally {
+    closeSync(fd);
+} renameSync(temp, path); }
+export function inspectTelemetryCapture(root, id) { const m = readJson(join(root, validId(id), "manifest.json")); if (m.format !== "pibo-telemetry-capture-v1" || m.id !== id)
+    throw Error("Invalid capture manifest"); return m; }
+export function startTelemetryCapture(root, input) {
+    if (!input.sessionId.startsWith("ps_") || input.sessionId.length > 128 || !input.owner.trim() || input.owner.length > 128 || !Number.isSafeInteger(input.durationMs) || input.durationMs < 1000 || input.durationMs > 3600000 || !Number.isSafeInteger(input.maxBytes) || input.maxBytes < 1024 || input.maxBytes > 64 * 1024 * 1024 || !Number.isSafeInteger(input.maxRows) || input.maxRows < 1 || input.maxRows > 100000)
+        throw Error("Capture requires explicit session, owner, duration, byte and row limits");
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const active = join(root, "active.json");
+    const lock = openSync(active, "wx", 0o600);
+    const id = `capture_${randomUUID()}`, directory = join(root, id);
+    const m = { format: "pibo-telemetry-capture-v1", id, status: "active", sessionId: input.sessionId, owner: input.owner, detail: "provider_metadata", createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + input.durationMs).toISOString(), maxBytes: input.maxBytes, maxRows: input.maxRows, rows: 0, bytes: 0 };
+    try {
+        mkdirSync(directory, { mode: 0o700 });
+        const db = new DatabaseSync(join(directory, "active.sqlite"));
+        try {
+            db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA max_page_count=${Math.ceil((input.maxBytes + 1048576) / 4096)}; CREATE TABLE state(id INTEGER PRIMARY KEY CHECK(id=1),status TEXT NOT NULL,rows INTEGER NOT NULL,bytes INTEGER NOT NULL);INSERT INTO state VALUES(1,'active',0,0);CREATE TABLE events(sequence INTEGER PRIMARY KEY,received_at TEXT NOT NULL,type TEXT NOT NULL,metadata_json TEXT NOT NULL);`);
+        }
+        finally {
+            db.close();
+        }
+        publish(join(directory, "manifest.json"), m);
+        writeFileSync(lock, JSON.stringify({ id }) + "\n");
+        fsyncSync(lock);
+        return m;
+    }
+    catch (error) {
+        try {
+            unlinkSync(active);
+        }
+        catch { }
+        throw error;
+    }
+    finally {
+        closeSync(lock);
+    }
+}
+/** One run-owned connection; scopes and limits are checked transactionally before every append. */
+export class TelemetryCaptureWriter {
+    root;
+    db;
+    manifest;
+    refreshAfter = 0;
+    failures = 0;
+    dropped = 0;
+    constructor(root) {
+        this.root = root;
+    }
+    status() { return { id: this.manifest?.id, rows: this.manifest?.rows, bytes: this.manifest?.bytes, expiresAt: this.manifest?.expiresAt, failures: this.failures, dropped: this.dropped }; }
+    close() { this.db?.close(); this.db = undefined; this.manifest = undefined; }
+    append(commands) {
+        try {
+            if (Date.now() >= this.refreshAfter) {
+                this.refreshAfter = Date.now() + 1000;
+                const path = join(this.root, "active.json");
+                if (!existsSync(path)) {
+                    this.close();
+                    return;
+                }
+                const id = validId(readJson(path).id);
+                if (this.manifest?.id !== id) {
+                    this.close();
+                    const m = inspectTelemetryCapture(this.root, id);
+                    if (m.status !== "active")
+                        return;
+                    this.db = new DatabaseSync(join(this.root, id, "active.sqlite"));
+                    this.db.exec("PRAGMA busy_timeout=10; PRAGMA synchronous=FULL");
+                    this.manifest = m;
+                }
+            }
+            const db = this.db, m = this.manifest;
+            if (!db || !m)
+                return;
+            db.exec("BEGIN IMMEDIATE");
+            try {
+                const state = db.prepare("SELECT status,rows,bytes FROM state WHERE id=1").get();
+                if (state.status !== "active") {
+                    db.exec("COMMIT");
+                    this.close();
+                    return;
+                }
+                const insert = db.prepare("INSERT INTO events(received_at,type,metadata_json) VALUES(?,?,?)");
+                let stopped = Date.now() >= Date.parse(m.expiresAt);
+                for (const input of commands) {
+                    if (input.recorder !== "runtime" || input.command.kind !== "pi" || input.command.piboSessionId !== m.sessionId)
+                        continue;
+                    const summary = input.command.summary;
+                    const metadata = { piboSessionId: m.sessionId, eventType: summary.eventType.slice(0, 256), byteSize: summary.byteSize, parseStatus: summary.parseStatus, normalizedType: summary.normalizedType?.slice(0, 256), assistantEventType: summary.assistantEventType?.slice(0, 128), messageEnded: summary.messageEnded };
+                    const json = JSON.stringify(metadata), bytes = Buffer.byteLength(json) + 64;
+                    if (stopped || state.rows >= m.maxRows || state.bytes + bytes > m.maxBytes) {
+                        stopped = true;
+                        this.dropped++;
+                        continue;
+                    }
+                    insert.run(new Date().toISOString(), summary.eventType.slice(0, 256), json);
+                    state.rows++;
+                    state.bytes += bytes;
+                }
+                if (state.rows >= m.maxRows || state.bytes >= m.maxBytes)
+                    stopped = true;
+                db.prepare("UPDATE state SET rows=?,bytes=?,status=? WHERE id=1").run(state.rows, state.bytes, stopped ? "stopped" : "active");
+                db.exec("COMMIT");
+                m.rows = state.rows;
+                m.bytes = state.bytes;
+                if (stopped) {
+                    publish(join(this.root, m.id, "manifest.json"), { ...m, status: "stopped", rows: state.rows, bytes: state.bytes });
+                    this.close();
+                }
+            }
+            catch (error) {
+                if (db.isTransaction)
+                    db.exec("ROLLBACK");
+                throw error;
+            }
+        }
+        catch {
+            this.failures++;
+            this.close();
+        }
+    }
+}
+export async function finalizeTelemetryCapture(root, id) {
+    const m = inspectTelemetryCapture(root, id);
+    if (m.status === "archived")
+        return m;
+    const directory = join(root, id), db = new DatabaseSync(join(directory, "active.sqlite"));
+    try {
+        db.exec("PRAGMA busy_timeout=1000; PRAGMA synchronous=FULL; BEGIN IMMEDIATE");
+        db.exec("UPDATE state SET status='stopped' WHERE id=1");
+        const state = db.prepare("SELECT rows,bytes FROM state WHERE id=1").get();
+        db.exec("COMMIT");
+        publish(join(directory, "manifest.json"), { ...m, ...state, status: "stopped" });
+        // The archive is a separate closed snapshot; stale active handles cannot mutate it.
+        await backup(db, join(directory, "archive.sqlite"), { rate: 128 });
+        const archiveFd = openSync(join(directory, "archive.sqlite"), "r");
+        try {
+            fsyncSync(archiveFd);
+        }
+        finally {
+            closeSync(archiveFd);
+        }
+        const hash = createHash("sha256");
+        let bytes = 0;
+        for await (const chunk of createReadStream(join(directory, "archive.sqlite"), { highWaterMark: 65536 })) {
+            bytes += chunk.length;
+            if (bytes > m.maxBytes + 1048576)
+                throw Error("Capture archive exceeds physical quota");
+            hash.update(chunk);
+        }
+        const archived = { ...m, ...state, status: "archived", sha256: hash.digest("hex"), archiveBytes: bytes };
+        publish(join(directory, "manifest.json"), archived);
+        const pointer = join(root, "active.json");
+        if (existsSync(pointer) && readJson(pointer).id === id)
+            unlinkSync(pointer);
+        return archived;
+    }
+    finally {
+        if (db.isTransaction)
+            db.exec("ROLLBACK");
+        db.close();
+    }
+}
+export async function readTelemetryCapturePage(root, id, after = 0, limit = 50) { const m = inspectTelemetryCapture(root, id); if (m.status !== "archived")
+    throw Error("Capture must be finalized before inspection"); if (!Number.isSafeInteger(after) || after < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+    throw Error("Invalid capture page budget"); const path = join(root, id, "archive.sqlite"), hash = createHash("sha256"); let bytes = 0; for await (const chunk of createReadStream(path, { highWaterMark: 65536 })) {
+    bytes += chunk.length;
+    if (bytes > m.maxBytes + 1048576)
+        throw Error("Capture archive exceeds physical quota");
+    hash.update(chunk);
+} if (hash.digest("hex") !== m.sha256 || bytes !== m.archiveBytes)
+    throw Error("Capture archive hash mismatch"); const db = new DatabaseSync(path, { readOnly: true }); try {
+    return db.prepare("SELECT * FROM events WHERE sequence>? ORDER BY sequence LIMIT ?").all(after, limit);
+}
+finally {
+    db.close();
+} }

package/dist/data/telemetry-command.js

@@ -0,0 +1,3 @@
+export function isTelemetryProgress(input) {
+    return input.recorder === "runtime" && (input.command.kind === "pi" || (input.command.kind === "output" && ["assistant_delta", "thinking_delta", "tool_execution_updated"].includes(input.command.event.type)));
+}

package/dist/data/telemetry-maintenance-worker.js

@@ -0,0 +1,40 @@
+import { statSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { parentPort, workerData, threadId } from "node:worker_threads";
+import { pruneTelemetryRetention } from "./telemetry-retention.js";
+import { TelemetryMaintenance } from "./telemetry-maintenance.js";
+if (!parentPort)
+    throw Error("Maintenance requires a worker");
+const db = new DatabaseSync(workerData.path);
+db.exec("PRAGMA busy_timeout=10; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON");
+const maintenance = new TelemetryMaintenance(db);
+let timer, failures = 0, delay = 25;
+let checkpointAfter = 0, checkpoint;
+function observeCheckpoint() { if (Date.now() < checkpointAfter)
+    return; checkpointAfter = Date.now() + 5000; const started = performance.now(); const row = db.prepare("PRAGMA wal_checkpoint(PASSIVE)").get(); let walBytes = 0; try {
+    walBytes = statSync(workerData.path + "-wal").size;
+}
+catch { } checkpoint = { durationMs: performance.now() - started, busy: row.busy, logPages: row.log, checkpointedPages: row.checkpointed, walBytes, pendingSince: row.log > row.checkpointed ? (checkpoint?.pendingSince ?? Date.now()) : undefined }; }
+function schedule() { if (timer || maintenance.status()?.status !== "running")
+    return; timer = setTimeout(() => { timer = undefined; try {
+    maintenance.step();
+    observeCheckpoint();
+    delay = 25;
+}
+catch {
+    failures++;
+    delay = Math.min(1000, delay * 2);
+} schedule(); }, delay); timer.unref(); }
+parentPort.on("message", (request) => {
+    try {
+        const { action, cutoff } = request.command;
+        const value = action === "preview" ? ["live", "diagnostic", "provider_event", "payload_preview", "incident"].map(retentionClass => pruneTelemetryRetention(db, { retentionClass: retentionClass, before: cutoff, apply: false })) : action === "start" ? maintenance.start(cutoff) : action === "status" ? maintenance.status() : maintenance.control(action);
+        if (action === "start" || action === "resume")
+            schedule();
+        parentPort.postMessage({ id: request.id, value: value ?? null, worker: { pid: process.pid, threadId, failures, delay, checkpoint, status: value } });
+    }
+    catch {
+        parentPort.postMessage({ id: request.id, error: { code: "storage_maintenance_failed", message: "Telemetry maintenance command failed" } });
+    }
+});
+parentPort.postMessage({ ready: true, worker: { pid: process.pid, threadId, failures, delay, checkpoint, status: maintenance.status() } });