@peekdev/mcp 0.1.0-alpha.1

package/dist/native-host/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/native-host/transport.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAI3E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,MAAM,sBAAsB,qBAAqB,qBAAqB,CAC5G,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,MAAgB,OAAO,CAAC,MAAM;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,OAAO,cAAc;IACzB,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,eAAe,GAAkB,IAAI,CAAC;IAC7B,UAAU,CAA6B;IACvC,SAAS,CAAS;IAClB,QAAQ,CAAuC;IAExD,YAAY,SAAqC,EAAE,UAAiC,EAAE;QACpF,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,qBAAqB,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAExF,gEAAgE;QAChE,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,mBAAmB;oBAAE,OAAO;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,gBAAgB,IAAI,CAAC,SAAS,qBAAqB,CAC5F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;gBAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe;gBAAE,OAAO;YAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAE5B,qEAAqE;YACrE,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAqC,EACrC,UAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,cAAc,CAChC,SAAS,EACT,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAClE,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/postinstall.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function runPostinstall(): void;
+//# sourceMappingURL=postinstall.d.ts.map

package/dist/postinstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":";AA0CA,wBAAgB,cAAc,IAAI,IAAI,CAgCrC"}

package/dist/postinstall.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// Postinstall: register the native-messaging host manifest (P2 PRD §A7).
+//
+// CONSENT GATE (P2 PRD §H1 — the April-2026 Hanff/Anthropic precedent): we must
+// NOT silently write files into other vendors' browser directories on `npm
+// install`. So by default this script performs a DRY RUN — it prints exactly
+// what would be written and where, then exits without touching the filesystem.
+// The actual writes happen only when the extension onboarding flow (Phase 3d)
+// re-runs the installer with explicit consent, signalled by
+// PEEK_INSTALL_NATIVE_HOST=1.
+//
+// Either way the script logs what it wrote / would write and where, so the
+// install side-effects are always visible to the user (Task 3.4 requirement).
+import { hostBinaryPath, loadExtensionIds } from './native-host/config.js';
+import { installManifests } from './native-host/installer.js';
+import { buildManifest, resolveInstallTargets, } from './native-host/manifest.js';
+const SUPPORTED = ['darwin', 'linux', 'win32'];
+function isTruthyEnv(value) {
+    if (!value)
+        return false;
+    const v = value.toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes';
+}
+function logResults(results, dryRun) {
+    const verb = dryRun ? 'Would register' : 'Registered';
+    for (const r of results) {
+        const where = r.manifestPath ?? r.registryKey ?? '(unknown target)';
+        if (r.error) {
+            console.log(`  ✗ ${r.browser}: ${where} — ${r.error}`);
+        }
+        else {
+            console.log(`  ${dryRun ? '·' : '✔'} ${verb} ${r.browser}: ${where}`);
+        }
+    }
+}
+export function runPostinstall() {
+    const platform = process.platform;
+    if (!SUPPORTED.includes(platform)) {
+        console.log(`peek: native-host registration is not supported on '${platform}'; skipping.`);
+        return;
+    }
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? '';
+    const ids = loadExtensionIds();
+    const manifest = buildManifest(hostBinaryPath(), ids);
+    const targets = resolveInstallTargets(platform, home);
+    const consented = isTruthyEnv(process.env.PEEK_INSTALL_NATIVE_HOST);
+    const dryRun = !consented;
+    console.log(`peek native messaging host: ${manifest.name}`);
+    console.log(`  host binary: ${manifest.path}`);
+    console.log(manifest.allowed_origins.length > 0
+        ? `  allowed origins: ${manifest.allowed_origins.join(', ')}`
+        : '  allowed origins: (none yet — extension IDs are still placeholders)');
+    const results = installManifests(targets, manifest, { dryRun });
+    logResults(results, dryRun);
+    if (dryRun) {
+        console.log('\npeek: no files were written. The native host is registered during extension\n' +
+            'onboarding (with your consent), or by re-running with PEEK_INSTALL_NATIVE_HOST=1.');
+    }
+}
+// Run when invoked directly (postinstall / manual). Guarded so importing this
+// module for tests does not trigger the side-effect path.
+const invokedDirectly = process.argv[1] !== undefined && import.meta.url === `file://${process.argv[1]}`;
+if (invokedDirectly) {
+    try {
+        runPostinstall();
+    }
+    catch (err) {
+        // A postinstall failure must never break `npm install`.
+        console.log(`peek: postinstall skipped — ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=postinstall.js.map

package/dist/postinstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postinstall.js","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4DAA4D;AAC5D,8BAA8B;AAC9B,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAE9E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAsB,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAEL,aAAa,EACb,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,SAAS,GAAiC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAe;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC;QACpE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAA2B,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAA6B,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,uDAAuD,QAAQ,cAAc,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAA6B,EAAE,IAAI,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC;IAE1B,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,sBAAsB,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7D,CAAC,CAAC,sEAAsE,CAC3E,CAAC;IAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE5B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,iFAAiF;YAC/E,mFAAmF,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,MAAM,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,cAAc,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@peekdev/mcp",
+  "version": "0.1.0-alpha.1",
+  "description": "peek native messaging host + stdio MCP server. Owns ~/.peek/sessions.db (better-sqlite3) and bridges the browser extension, CLI, and AI tools to a single local source of truth (ADR-0007).",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "peek-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./db": {
+      "types": "./dist/db/index.d.ts",
+      "import": "./dist/db/index.js"
+    },
+    "./native-host": {
+      "types": "./dist/native-host/index.d.ts",
+      "import": "./dist/native-host/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src/db/migrations",
+    "src/native-host/extension-ids.json",
+    "NOTICE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node ./scripts/postbuild.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "postinstall": "node ./scripts/postinstall-guard.mjs"
+  },
+  "dependencies": {
+    "@cubenest/rrweb-core": "workspace:*",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "better-sqlite3": "^12.10.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^22.10.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cubenest/rrweb-stack.git",
+    "directory": "packages/peek-mcp"
+  },
+  "homepage": "https://github.com/Cubenest/rrweb-stack/tree/main/packages/peek-mcp#readme"
+}

package/src/db/migrations/0001_initial.sql

@@ -0,0 +1,102 @@
+-- 0001_initial — peek native-host SQLite schema (ADR-0007).
+--
+-- The native messaging host owns ~/.peek/sessions.db; the extension writes via
+-- native messaging and the MCP server + CLI read the same file directly. rrweb
+-- event blobs live on disk under ~/.peek/rrweb-events/ (gzipped, one per
+-- session); this DB stores session metadata, the chunk index into those blobs,
+-- and the extracted console / network / audit rows that the MCP tools query.
+--
+-- Conventions: UTC ISO-8601 strings for timestamps (text); epoch-millis
+-- integers where a monotonic ordering key is wanted (`ts_ms`). All foreign keys
+-- reference sessions(id) and cascade on delete so `peek sessions delete` is a
+-- single statement.
+
+-- One row per recorded browser session.
+CREATE TABLE sessions (
+  id              TEXT PRIMARY KEY,            -- e.g. "s_8nQ..."
+  created_at      TEXT NOT NULL,               -- UTC ISO-8601 of first event
+  updated_at      TEXT NOT NULL,               -- UTC ISO-8601 of last append
+  url             TEXT,                        -- initial top-frame URL
+  title           TEXT,                        -- initial document title
+  origin          TEXT,                        -- scheme://host[:port] of `url`
+  user_agent      TEXT,
+  -- Path to the gzipped rrweb event blob for this session, relative to
+  -- ~/.peek/rrweb-events/ (the native host owns the absolute base).
+  events_blob_path TEXT,
+  event_count     INTEGER NOT NULL DEFAULT 0,  -- total rrweb events recorded
+  bytes           INTEGER NOT NULL DEFAULT 0,  -- on-disk size of the blob
+  status          TEXT NOT NULL DEFAULT 'active' -- 'active' | 'finalized'
+);
+
+CREATE INDEX idx_sessions_created_at ON sessions (created_at);
+CREATE INDEX idx_sessions_origin ON sessions (origin);
+
+-- Index of rrweb event chunks appended over native messaging. The events
+-- themselves are persisted to the gzipped blob; a chunk row records the byte
+-- range + event range so a reader can seek without parsing the whole blob.
+CREATE TABLE events_chunks (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id  TEXT NOT NULL REFERENCES sessions (id) ON DELETE CASCADE,
+  seq         INTEGER NOT NULL,                -- 0-based chunk order within session
+  start_ts_ms INTEGER NOT NULL,               -- epoch-millis of first event in chunk
+  end_ts_ms   INTEGER NOT NULL,               -- epoch-millis of last event in chunk
+  event_count INTEGER NOT NULL,
+  byte_offset INTEGER NOT NULL,               -- offset into the gzipped blob
+  byte_length INTEGER NOT NULL,
+  created_at  TEXT NOT NULL,
+  UNIQUE (session_id, seq)
+);
+
+CREATE INDEX idx_events_chunks_session ON events_chunks (session_id, seq);
+
+-- Console messages extracted from the rrweb console plugin
+-- (EventType=6, plugin "rrweb/console@1") for fast MCP queries.
+CREATE TABLE console_events (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id  TEXT NOT NULL REFERENCES sessions (id) ON DELETE CASCADE,
+  ts_ms       INTEGER NOT NULL,               -- epoch-millis of the log
+  level       TEXT NOT NULL,                  -- 'log'|'info'|'warn'|'error'|'debug'|...
+  message     TEXT NOT NULL,                  -- joined payload text
+  stack       TEXT,                           -- trace, when present
+  url         TEXT                            -- page URL at time of log
+);
+
+CREATE INDEX idx_console_events_session ON console_events (session_id, ts_ms);
+CREATE INDEX idx_console_events_level ON console_events (session_id, level);
+
+-- Network activity captured via CDP (chrome.debugger) / console-error fallback.
+CREATE TABLE network_events (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id    TEXT NOT NULL REFERENCES sessions (id) ON DELETE CASCADE,
+  ts_ms         INTEGER NOT NULL,             -- epoch-millis of request start
+  method        TEXT NOT NULL,                -- GET/POST/...
+  url           TEXT NOT NULL,
+  status        INTEGER,                      -- HTTP status; NULL if failed/pending
+  status_text   TEXT,
+  request_id    TEXT,                         -- CDP requestId, for correlation
+  resource_type TEXT,                         -- 'xhr'|'fetch'|'document'|...
+  duration_ms   INTEGER,                      -- response time, when known
+  error_text    TEXT                          -- net error string, when failed
+);
+
+CREATE INDEX idx_network_events_session ON network_events (session_id, ts_ms);
+CREATE INDEX idx_network_events_status ON network_events (session_id, status);
+
+-- Append-only audit log of every AI-driven act-tool call (ADR-0010 / PRD §H3).
+-- Mirrors the JSONL shape written to ~/.peek/audit.log; kept in SQLite too so
+-- `peek audit log --since 1h --tool ... --client ...` is an indexed query.
+CREATE TABLE audit_log (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts           TEXT NOT NULL,                 -- UTC ISO-8601 of the action
+  tool         TEXT NOT NULL,                 -- e.g. 'execute_action'
+  args_json    TEXT,                          -- JSON of the tool args
+  approval_ts  TEXT,                          -- when the user approved
+  approver     TEXT,                          -- 'user' | ...
+  client       TEXT,                          -- 'claude-code' | 'cursor' | ...
+  session_id   TEXT REFERENCES sessions (id) ON DELETE SET NULL,
+  result       TEXT                           -- 'ok' | 'error' | ...
+);
+
+CREATE INDEX idx_audit_log_ts ON audit_log (ts);
+CREATE INDEX idx_audit_log_tool ON audit_log (tool);
+CREATE INDEX idx_audit_log_client ON audit_log (client);

package/src/db/migrations/0002_network_bodies.sql

@@ -0,0 +1,15 @@
+-- 0002_network_bodies — persist Deep capture masked bodies (ADR-0010, PRD §A.8).
+--
+-- The extension already masks request/response bodies via `maskNetMessage` in
+-- the ISOLATED-world relay (packages/peek-extension/src/relay/mask.ts) BEFORE
+-- forwarding them on `network.append`. Without these columns the native host
+-- silently drops the masked bodies on the floor — the user's yellow-banner
+-- consent for Deep capture yields no persisted body data, defeating the
+-- whole reason `webRequest` is insufficient under MV3 (PRD §A.9).
+--
+-- Columns are TEXT (the relay produces strings via `redactBody`) and nullable
+-- — Basic capture, request-only records, and error records leave them NULL.
+-- SQLite's ALTER TABLE ADD COLUMN is non-destructive: existing rows get NULL
+-- for the new columns, fresh DBs land with them from the start.
+ALTER TABLE network_events ADD COLUMN request_body_redacted TEXT;
+ALTER TABLE network_events ADD COLUMN response_body_redacted TEXT;

package/src/native-host/extension-ids.json

@@ -0,0 +1,6 @@
+{
+  "$comment": "Extension IDs whose chrome-extension:// origin is allowed to message the peek native host (ADR-0007). Wildcards are forbidden by Chrome, so every supported store + the dev-mode unpacked-load ID is listed explicitly and all three go into the SAME manifest's allowed_origins (the Edge 'first registry location wins' gotcha — see P2 PRD §A7). Pre-publish, `dev` is the unpacked-load ID printed at chrome://extensions; replace `chromeWebStore` and `edgeAddons` with the assigned IDs once the products land in their stores.",
+  "chromeWebStore": "PLACEHOLDER_CHROME_WEB_STORE_ID",
+  "edgeAddons": "PLACEHOLDER_EDGE_ADDONS_ID",
+  "dev": "PLACEHOLDER_DEV_UNPACKED_ID"
+}