@prismshadow/penguin-server 0.2.13 → 0.2.16

package/dist/api/types.js

@@ -1,8 +1,10 @@
 import {
+  MACHINE_PHASES,
   TICKET_SLUG_PATTERN
-} from "../chunk-L2H3K4DT.js";
+} from "../chunk-W7JNIJ25.js";
 import "../chunk-B5IP37ZQ.js";
 export {
+  MACHINE_PHASES,
   TICKET_SLUG_PATTERN
 };
 //# sourceMappingURL=types.js.map

package/dist/auth-token.d.ts

@@ -1,3 +1,6 @@
+/** How a session was established, as stored. NULL on rows formed before the column existed. */
+type SessionViaValue = "password" | "desktop" | "setup" | "cli" | "remote";
+
 /** An hour: long enough for a controller to finish, short enough to forget. */
 declare const CLI_TOKEN_TTL_MS: number;
 /**
@@ -5,6 +8,22 @@ declare const CLI_TOKEN_TTL_MS: number;
  * a token that lives in a file must not outlive an ordinary browser session.
  */
 declare const CLI_TOKEN_MAX_TTL_MS: number;
+/**
+ * What a minted row records about how its session was established.
+ *
+ * `cli` is the default and what `penguin auth token` writes: a session that behaves like a
+ * password one in every way. `desktop` is for the desktop shell signing its own window in
+ * against a server it did not spawn, and says the same thing its one-shot claim token says —
+ * with as much backing, since only an account that can write this file can mint at all.
+ *
+ * The distinction is not cosmetic: a desktop session may set a password without supplying the
+ * current one, because the account the shell created has a password that was generated,
+ * hashed and discarded unseen — there is nothing to supply, and whoever can write to this
+ * data root can already reset that password offline (`penguin server reset-admin-password`).
+ * That allowance is granted by a server running in desktop mode; against any other server the
+ * value records what the session is without widening what it may do (routes/me.ts).
+ */
+type MintedVia = Extract<SessionViaValue, "cli" | "desktop">;
 type MintTokenResult = {
     outcome: "minted";
     token: string;
@@ -24,6 +43,8 @@ declare function mintApiToken(root: string, opts?: {
     ttlMs?: number;
     dbPath?: string;
     now?: Date;
+    /** How the session records its own establishment; `cli` unless told otherwise. */
+    via?: MintedVia;
 }): MintTokenResult;
 
-export { CLI_TOKEN_MAX_TTL_MS, CLI_TOKEN_TTL_MS, type MintTokenResult, mintApiToken };
+export { CLI_TOKEN_MAX_TTL_MS, CLI_TOKEN_TTL_MS, type MintTokenResult, type MintedVia, mintApiToken };

package/dist/auth-token.js

@@ -1,10 +1,10 @@
 import {
   AuthSessionsRepo,
   UsersRepo
-} from "./chunk-TOOTEEM4.js";
+} from "./chunk-G7GY7PJU.js";
 import {
   openExistingDatabase
-} from "./chunk-A3QANMU5.js";
+} from "./chunk-3SFJKLQU.js";
 import "./chunk-B5IP37ZQ.js";
 
 // src/auth-token.ts
@@ -35,7 +35,7 @@ function mintApiToken(root, opts = {}) {
     }
     const { token, expiresAt } = wire(AuthSessionsRepo, { db }).issue({
       userId,
-      via: "cli",
+      via: opts.via ?? "cli",
       now: opts.now ?? /* @__PURE__ */ new Date(),
       ttlMs: opts.ttlMs ?? CLI_TOKEN_TTL_MS,
       maxTtlMs: CLI_TOKEN_MAX_TTL_MS

package/dist/auth-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth-token.ts"],"sourcesContent":["/**\n * Mints an API session by inserting a row into the root's `web.db` — no running server needed.\n * Authorized by being able to read and write that root, which already holds every credential\n * the token could reach. On a multi-user box that means the OS account running the server;\n * everyone else signs in with `penguin auth login --server <url>`.\n */\nimport path from \"node:path\";\nimport fs from \"node:fs\";\nimport { openExistingDatabase } from \"./db/database.js\";\nimport { AuthSessionsRepo } from \"./db/repos/auth-sessions.js\";\nimport { UsersRepo } from \"./db/repos/users.js\";\nimport { wire } from \"@prismshadow/penguin-core/kernel\";\n\n/** An hour: long enough for a controller to finish, short enough to forget. */\nexport const CLI_TOKEN_TTL_MS = 60 * 60_000;\n\n/**\n * Ceiling on a caller-supplied `--ttl-seconds`, matching the default session TTL (config.ts):\n * a token that lives in a file must not outlive an ordinary browser session.\n */\nexport const CLI_TOKEN_MAX_TTL_MS = 30 * 24 * 60 * 60_000;\n\nexport type MintTokenResult =\n  | { outcome: \"minted\"; token: string; userId: string; expiresAt: string }\n  /** No web.db on this root — the server has never run here, so there is no account to mint for. */\n  | { outcome: \"no_server\" }\n  | { outcome: \"failed\"; detail: string };\n\n/**\n * Turns a failure into something the person at the terminal can act on. Both cases are\n * ordinary situations, not crashes: a database owned by another OS account, and one written\n * by an older release (minting deliberately does not migrate — see openExistingDatabase).\n */\nfunction explain(err: unknown, dbPath: string): string {\n  const message = err instanceof Error ? err.message : String(err);\n  if (message.includes(\"no column named via\")) {\n    return `${dbPath} predates this release — start the server once (\\`penguin web\\`) to upgrade it`;\n  }\n  if (message.includes(\"unable to open database\")) {\n    return (\n      `cannot open ${dbPath} — minting needs the data root's own OS account; ` +\n      \"otherwise sign in with `penguin auth login --server <url>`\"\n    );\n  }\n  return message;\n}\n\n/** Issues an API session token for the data root at `root`. */\nexport function mintApiToken(\n  root: string,\n  opts: { userId?: string; ttlMs?: number; dbPath?: string; now?: Date } = {},\n): MintTokenResult {\n  const userId = opts.userId ?? \"admin\";\n  const dbPath = opts.dbPath ?? path.join(root, \"web.db\");\n  // Existence check first: openExistingDatabase would otherwise create an empty file, and a\n  // root with no web.db has no account to mint for.\n  if (!fs.existsSync(dbPath)) return { outcome: \"no_server\" };\n\n  let db: ReturnType<typeof openExistingDatabase> | null = null;\n  try {\n    db = openExistingDatabase(dbPath);\n    if (wire(UsersRepo, { db: db }).findById(userId) === null) {\n      return { outcome: \"failed\", detail: `no such account: ${userId}` };\n    }\n    // The repo is the single minting point (token shape, hash, TTL ceiling), so a CLI-minted\n    // row cannot drift from one the server issues itself.\n    const { token, expiresAt } = wire(AuthSessionsRepo, { db: db }).issue({\n      userId,\n      via: \"cli\",\n      now: opts.now ?? new Date(),\n      ttlMs: opts.ttlMs ?? CLI_TOKEN_TTL_MS,\n      maxTtlMs: CLI_TOKEN_MAX_TTL_MS,\n    });\n    return { outcome: \"minted\", token, userId, expiresAt };\n  } catch (err) {\n    return { outcome: \"failed\", detail: explain(err, dbPath) };\n  } finally {\n    db?.close();\n  }\n}\n"],"mappings":";;;;;;;;;;AAMA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAIf,SAAS,YAAY;AAGd,IAAM,mBAAmB,KAAK;AAM9B,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAanD,SAAS,QAAQ,KAAc,QAAwB;AACrD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,QAAQ,SAAS,qBAAqB,GAAG;AAC3C,WAAO,GAAG,MAAM;AAAA,EAClB;AACA,MAAI,QAAQ,SAAS,yBAAyB,GAAG;AAC/C,WACE,eAAe,MAAM;AAAA,EAGzB;AACA,SAAO;AACT;AAGO,SAAS,aACd,MACA,OAAyE,CAAC,GACzD;AACjB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,SAAS,KAAK,UAAU,KAAK,KAAK,MAAM,QAAQ;AAGtD,MAAI,CAAC,GAAG,WAAW,MAAM,EAAG,QAAO,EAAE,SAAS,YAAY;AAE1D,MAAI,KAAqD;AACzD,MAAI;AACF,SAAK,qBAAqB,MAAM;AAChC,QAAI,KAAK,WAAW,EAAE,GAAO,CAAC,EAAE,SAAS,MAAM,MAAM,MAAM;AACzD,aAAO,EAAE,SAAS,UAAU,QAAQ,oBAAoB,MAAM,GAAG;AAAA,IACnE;AAGA,UAAM,EAAE,OAAO,UAAU,IAAI,KAAK,kBAAkB,EAAE,GAAO,CAAC,EAAE,MAAM;AAAA,MACpE;AAAA,MACA,KAAK;AAAA,MACL,KAAK,KAAK,OAAO,oBAAI,KAAK;AAAA,MAC1B,OAAO,KAAK,SAAS;AAAA,MACrB,UAAU;AAAA,IACZ,CAAC;AACD,WAAO,EAAE,SAAS,UAAU,OAAO,QAAQ,UAAU;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,UAAU,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,EAC3D,UAAE;AACA,QAAI,MAAM;AAAA,EACZ;AACF;","names":[]}
+{"version":3,"sources":["../src/auth-token.ts"],"sourcesContent":["/**\n * Mints an API session by inserting a row into the root's `web.db` — no running server needed.\n * Authorized by being able to read and write that root, which already holds every credential\n * the token could reach. On a multi-user box that means the OS account running the server;\n * everyone else signs in with `penguin auth login --server <url>`.\n */\nimport path from \"node:path\";\nimport fs from \"node:fs\";\nimport { openExistingDatabase } from \"./db/database.js\";\nimport { AuthSessionsRepo } from \"./db/repos/auth-sessions.js\";\nimport type { SessionViaValue } from \"./db/repos/auth-sessions.js\";\nimport { UsersRepo } from \"./db/repos/users.js\";\nimport { wire } from \"@prismshadow/penguin-core/kernel\";\n\n/** An hour: long enough for a controller to finish, short enough to forget. */\nexport const CLI_TOKEN_TTL_MS = 60 * 60_000;\n\n/**\n * Ceiling on a caller-supplied `--ttl-seconds`, matching the default session TTL (config.ts):\n * a token that lives in a file must not outlive an ordinary browser session.\n */\nexport const CLI_TOKEN_MAX_TTL_MS = 30 * 24 * 60 * 60_000;\n\n/**\n * What a minted row records about how its session was established.\n *\n * `cli` is the default and what `penguin auth token` writes: a session that behaves like a\n * password one in every way. `desktop` is for the desktop shell signing its own window in\n * against a server it did not spawn, and says the same thing its one-shot claim token says —\n * with as much backing, since only an account that can write this file can mint at all.\n *\n * The distinction is not cosmetic: a desktop session may set a password without supplying the\n * current one, because the account the shell created has a password that was generated,\n * hashed and discarded unseen — there is nothing to supply, and whoever can write to this\n * data root can already reset that password offline (`penguin server reset-admin-password`).\n * That allowance is granted by a server running in desktop mode; against any other server the\n * value records what the session is without widening what it may do (routes/me.ts).\n */\nexport type MintedVia = Extract<SessionViaValue, \"cli\" | \"desktop\">;\n\nexport type MintTokenResult =\n  | { outcome: \"minted\"; token: string; userId: string; expiresAt: string }\n  /** No web.db on this root — the server has never run here, so there is no account to mint for. */\n  | { outcome: \"no_server\" }\n  | { outcome: \"failed\"; detail: string };\n\n/**\n * Turns a failure into something the person at the terminal can act on. Both cases are\n * ordinary situations, not crashes: a database owned by another OS account, and one written\n * by an older release (minting deliberately does not migrate — see openExistingDatabase).\n */\nfunction explain(err: unknown, dbPath: string): string {\n  const message = err instanceof Error ? err.message : String(err);\n  if (message.includes(\"no column named via\")) {\n    return `${dbPath} predates this release — start the server once (\\`penguin web\\`) to upgrade it`;\n  }\n  if (message.includes(\"unable to open database\")) {\n    return (\n      `cannot open ${dbPath} — minting needs the data root's own OS account; ` +\n      \"otherwise sign in with `penguin auth login --server <url>`\"\n    );\n  }\n  return message;\n}\n\n/** Issues an API session token for the data root at `root`. */\nexport function mintApiToken(\n  root: string,\n  opts: {\n    userId?: string;\n    ttlMs?: number;\n    dbPath?: string;\n    now?: Date;\n    /** How the session records its own establishment; `cli` unless told otherwise. */\n    via?: MintedVia;\n  } = {},\n): MintTokenResult {\n  const userId = opts.userId ?? \"admin\";\n  const dbPath = opts.dbPath ?? path.join(root, \"web.db\");\n  // Existence check first: openExistingDatabase would otherwise create an empty file, and a\n  // root with no web.db has no account to mint for.\n  if (!fs.existsSync(dbPath)) return { outcome: \"no_server\" };\n\n  let db: ReturnType<typeof openExistingDatabase> | null = null;\n  try {\n    db = openExistingDatabase(dbPath);\n    if (wire(UsersRepo, { db: db }).findById(userId) === null) {\n      return { outcome: \"failed\", detail: `no such account: ${userId}` };\n    }\n    // The repo is the single minting point (token shape, hash, TTL ceiling), so a CLI-minted\n    // row cannot drift from one the server issues itself.\n    const { token, expiresAt } = wire(AuthSessionsRepo, { db: db }).issue({\n      userId,\n      via: opts.via ?? \"cli\",\n      now: opts.now ?? new Date(),\n      ttlMs: opts.ttlMs ?? CLI_TOKEN_TTL_MS,\n      maxTtlMs: CLI_TOKEN_MAX_TTL_MS,\n    });\n    return { outcome: \"minted\", token, userId, expiresAt };\n  } catch (err) {\n    return { outcome: \"failed\", detail: explain(err, dbPath) };\n  } finally {\n    db?.close();\n  }\n}\n"],"mappings":";;;;;;;;;;AAMA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAKf,SAAS,YAAY;AAGd,IAAM,mBAAmB,KAAK;AAM9B,IAAM,uBAAuB,KAAK,KAAK,KAAK;AA8BnD,SAAS,QAAQ,KAAc,QAAwB;AACrD,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,MAAI,QAAQ,SAAS,qBAAqB,GAAG;AAC3C,WAAO,GAAG,MAAM;AAAA,EAClB;AACA,MAAI,QAAQ,SAAS,yBAAyB,GAAG;AAC/C,WACE,eAAe,MAAM;AAAA,EAGzB;AACA,SAAO;AACT;AAGO,SAAS,aACd,MACA,OAOI,CAAC,GACY;AACjB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,SAAS,KAAK,UAAU,KAAK,KAAK,MAAM,QAAQ;AAGtD,MAAI,CAAC,GAAG,WAAW,MAAM,EAAG,QAAO,EAAE,SAAS,YAAY;AAE1D,MAAI,KAAqD;AACzD,MAAI;AACF,SAAK,qBAAqB,MAAM;AAChC,QAAI,KAAK,WAAW,EAAE,GAAO,CAAC,EAAE,SAAS,MAAM,MAAM,MAAM;AACzD,aAAO,EAAE,SAAS,UAAU,QAAQ,oBAAoB,MAAM,GAAG;AAAA,IACnE;AAGA,UAAM,EAAE,OAAO,UAAU,IAAI,KAAK,kBAAkB,EAAE,GAAO,CAAC,EAAE,MAAM;AAAA,MACpE;AAAA,MACA,KAAK,KAAK,OAAO;AAAA,MACjB,KAAK,KAAK,OAAO,oBAAI,KAAK;AAAA,MAC1B,OAAO,KAAK,SAAS;AAAA,MACrB,UAAU;AAAA,IACZ,CAAC;AACD,WAAO,EAAE,SAAS,UAAU,OAAO,QAAQ,UAAU;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,UAAU,QAAQ,QAAQ,KAAK,MAAM,EAAE;AAAA,EAC3D,UAAE;AACA,QAAI,MAAM;AAAA,EACZ;AACF;","names":[]}

package/dist/{chunk-A3QANMU5.js → chunk-3SFJKLQU.js}

@@ -345,6 +345,243 @@ var MIGRATIONS = [
         DROP TABLE IF EXISTS org_desk_notices;
       `);
     }
+  },
+  {
+    version: 9,
+    name: "model-promotions",
+    // Additive: one new table, nothing existing touched. A predecessor build never reads it
+    // and prices every row at the number in its Project file, so a rollback survives it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+          project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+          provider   TEXT NOT NULL,
+          model_id   TEXT NOT NULL,
+          discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (project_id, provider, model_id)
+        );
+      `);
+    },
+    // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
+    // at the Project files' list prices until the next "sync presets" or Penguin Go sync
+    // writes them back.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS model_promotions");
+    }
+  },
+  {
+    version: 10,
+    name: "model-provider-auth-tokens",
+    // Additive: one new table, nothing existing touched. A predecessor build never reads it;
+    // the access token already written into .project_config.toml keeps working until it
+    // expires, so rollback only loses silent refresh state.
+    // KEEP until every supported upgrade starts from schema 10 or newer. The release that
+    // raises the minimum database baseline past 9 owns removing this migration block and its
+    // version-9 fixture; the table itself remains while provider token refresh uses it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+          project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+          provider                TEXT NOT NULL,
+          refresh_token           TEXT NOT NULL,
+          access_token_expires_at TEXT,
+          updated_at              TEXT NOT NULL,
+          PRIMARY KEY (project_id, provider)
+        );
+      `);
+    },
+    // LOSES every stored refresh token and access-token expiry. Existing access tokens in
+    // Project files remain until they expire; users re-authorize to restore silent refresh.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
+    }
+  },
+  {
+    version: 11,
+    name: "sessions-sandbox",
+    // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
+    // the Session is created, so a later settings change leaves running Sessions alone.
+    // NULL = a row from before this column: it takes the settings in force at its next
+    // command and keeps them from then on. Swap-safe: a pushed platform boots against the
+    // runtime's already-open database, so the column has to arrive by a migration.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "sessions", "sandbox", "TEXT");
+    },
+    // Not a DROP: schema.ts declares the column, and dropping it would put every Session
+    // back under whatever the settings say.
+    down() {
+    }
+  },
+  {
+    version: 12,
+    name: "machines-columns",
+    // A machines table can predate migration 4 — a data root that ran the machines line
+    // before it was released kept forwards, not sessions — and that migration's IF NOT
+    // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
+    // insert. Adds what is missing, nullable; a platform rolled back to 4 declared these
+    // columns itself, so there is nothing for it to mind.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "machines", "session_pid", "INTEGER");
+      ensureColumn(db, "machines", "platform", "TEXT");
+    },
+    // Nothing to undo: what this added, 4 already declares, and a column it found in place
+    // was never this migration's to take away.
+    down() {
+    }
+  },
+  {
+    version: 13,
+    name: "browser-extensions",
+    // Additive: one new table and its index. The Chrome backend's pairings — one row per
+    // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
+    // build never reads the table, so a rollback survives it; the paired extensions then simply
+    // fail to connect until a build that knows them is back.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+          extension_id TEXT PRIMARY KEY,
+          user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+          token_hash   TEXT NOT NULL UNIQUE,
+          name         TEXT NOT NULL,
+          version      TEXT NOT NULL,
+          created_at   TEXT NOT NULL,
+          last_seen_at TEXT,
+          revoked_at   TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+      `);
+    },
+    // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
+    // Browser panel) before agents can drive it.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_browser_extensions_user;
+        DROP TABLE IF EXISTS browser_extensions;
+      `);
+    }
+  },
+  {
+    version: 14,
+    name: "agent-api",
+    // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
+    // keyless access, the approval mode API Sessions are created with) and its keys, stored
+    // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
+    // rollback survives it: callers get 404 until a build that knows the tables is back.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+          project_id    TEXT NOT NULL,
+          agent_id      TEXT NOT NULL,
+          enabled       INTEGER NOT NULL DEFAULT 0,
+          open          INTEGER NOT NULL DEFAULT 0,
+          approval_mode TEXT NOT NULL DEFAULT 'allow-all',
+          updated_at    TEXT NOT NULL,
+          PRIMARY KEY (project_id, agent_id)
+        );
+        CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+          key_id       TEXT PRIMARY KEY,
+          project_id   TEXT NOT NULL,
+          agent_id     TEXT NOT NULL,
+          token_hash   TEXT NOT NULL UNIQUE,
+          prefix       TEXT NOT NULL,
+          name         TEXT NOT NULL,
+          created_by   TEXT NOT NULL REFERENCES users(user_id),
+          created_at   TEXT NOT NULL,
+          last_used_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
+      `);
+    },
+    // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
+    // again (404 to its callers), and every caller needs a newly created key once it is back
+    // on — no file holds a copy of either.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_agent_api_keys_agent;
+        DROP TABLE IF EXISTS agent_api_keys;
+        DROP TABLE IF EXISTS agent_api;
+      `);
+    }
+  },
+  {
+    version: 15,
+    name: "messaging-conversations",
+    // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
+    // context token every send must echo, how many sends it has funded, and replies held for
+    // the user's next message. A predecessor build never reads it and keeps its tokens in
+    // memory as it always did, so a rollback survives it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+          channel    TEXT NOT NULL,
+          account_id TEXT NOT NULL,
+          chat_id    TEXT NOT NULL,
+          state_json TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (channel, account_id, chat_id)
+        );
+      `);
+    },
+    // LOSES every stored context token and every held reply: replies sent before each user's
+    // next message are refused again, and what was held never arrives.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS messaging_conversations");
+    }
+  },
+  {
+    version: 16,
+    name: "sessions-kept-at",
+    // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
+    // archive it. The listing rule files a background Session (api / schedule / cli) away unless
+    // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
+    // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
+    // so the column has to arrive by a migration.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "sessions", "kept_at", "TEXT");
+    },
+    // Not a DROP: schema.ts declares the column, and dropping it would file every kept
+    // background Session away again.
+    down() {
+    }
+  },
+  {
+    version: 17,
+    name: "agent-api-session-settings",
+    // Retain until the minimum supported database version exceeds 16; the maintainer raising
+    // that baseline removes this upgrade after all supported data roots have these columns.
+    // Nullable additions preserve existing keys, exposure, approvals and new-Session defaults.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "agent_api", "provider", "TEXT");
+      ensureColumn(db, "agent_api", "model_id", "TEXT");
+      ensureColumn(db, "agent_api", "thinking_level", "TEXT");
+      ensureColumn(db, "agent_api", "workspace", "TEXT");
+    },
+    // Keep the saved defaults on rollback; older builds ignore the additional columns.
+    down() {
+    }
+  },
+  {
+    version: 18,
+    name: "agent-api-concurrency",
+    // Retain until the minimum supported database version exceeds 17. The maintainer raising
+    // that baseline removes this upgrade once every supported data root has the column.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "agent_api", "max_concurrent_runs", "INTEGER NOT NULL DEFAULT 4");
+    },
+    // Keep the configured limit on rollback; older builds ignore this column.
+    down() {
+    }
   }
 ];
 var LATEST_VERSION = MIGRATIONS.reduce((n, m) => Math.max(n, m.version), 0);
@@ -386,6 +623,24 @@ function migrate(db, { swapPath = false } = {}) {
 }
 
 // src/db/schema.ts
+var MODEL_PROMOTIONS_SQL = `
+CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider   TEXT NOT NULL,
+  model_id   TEXT NOT NULL,
+  discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),  -- fraction off the row's list price: billed = list \xD7 (1 \u2212 discount)
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider, model_id)
+);`;
+var MODEL_PROVIDER_AUTH_TOKENS_SQL = `
+CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+  project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider                TEXT NOT NULL,
+  refresh_token           TEXT NOT NULL,
+  access_token_expires_at TEXT,
+  updated_at              TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider)
+);`;
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS users (
   user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
@@ -404,7 +659,7 @@ CREATE TABLE IF NOT EXISTS auth_sessions (
   user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
   created_at TEXT NOT NULL,
   expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
-  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'; NULL = legacy (password)
+  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'|'remote'; NULL = legacy (password)
 );
 -- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
 -- these both scan the whole table.
@@ -422,6 +677,8 @@ CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are
   created_at TEXT NOT NULL,
   PRIMARY KEY (project_id, user_id)
 );
+${MODEL_PROMOTIONS_SQL}
+${MODEL_PROVIDER_AUTH_TOKENS_SQL}
 CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
   project_id TEXT NOT NULL,
   agent_id   TEXT NOT NULL,
@@ -432,19 +689,21 @@ CREATE TABLE IF NOT EXISTS sessions (
   session_id    TEXT PRIMARY KEY,
   project_id    TEXT NOT NULL,
   agent_id      TEXT NOT NULL,
-  provider      TEXT NOT NULL,                     -- provider group of the session model (paired with model_id as a model reference)
-  model_id      TEXT NOT NULL,                     -- upstream model id (sent to AgentHub as-is; never concatenate <provider>/<id>)
+  provider      TEXT NOT NULL,                     -- provider group of the session's CURRENT model (paired with model_id as a model reference; moves with each in-session switch)
+  model_id      TEXT NOT NULL,                     -- upstream model id of the current model (sent to MMSP as-is; never concatenate <provider>/<id>)
   workspace     TEXT NOT NULL,
   approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
   thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config
   title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
-  archived_at   TEXT,                                -- archive time; NULL=not archived (shown by default; archived ones move under "Archived")
-  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace); NULL = legacy row, treated as web
+  archived_at   TEXT,                                -- the user archived it (ISO time); NULL = not archived by hand (the listing rule may still file it away)
+  kept_at       TEXT,                                -- "keep in sidebar": set when the user unarchives, cleared when they archive; NULL = the listing rule decides (a background source is archived, a user Session is active). Never written by a run.
+  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace) | 'org' (company mode) | 'api' (an Agent API run); NULL = legacy row, treated as web
   has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
   fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted
+  sandbox       TEXT,                                -- the Session's sandbox policy snapshot (JSON SandboxSettings); NULL = legacy row, snapshotted at its next command
   last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill
   created_at    TEXT NOT NULL
-);                                            -- the subagent/schedule/benchmark SOURCE is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row)
+);                                            -- the Session's SOURCE (user/api/schedule/subagent/cli/company) is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row), read for the source only where the Trace records none ('org' \u2192 company)
 CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
 CREATE TABLE IF NOT EXISTS usage_records (
   id                INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -471,7 +730,7 @@ CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the
   project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
   agent_id   TEXT,
   session_id TEXT,
-  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging
+  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging | organization | id_suggest | plugin
   kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
   code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
   status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
@@ -509,10 +768,55 @@ CREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session \u2194 messaging-chan
   PRIMARY KEY (session_id, channel)
 );
 CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever
+CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+  channel    TEXT NOT NULL,                     -- messaging channel discriminator (only 'wechat' writes rows today)
+  account_id TEXT NOT NULL,                     -- the bot, as messaging_bindings.account_id names it
+  chat_id    TEXT NOT NULL,                     -- the connector's own chat id (wechat: the user's ilink_user_id)
+  state_json TEXT NOT NULL,                     -- connector-owned JSON (wechat: {contextToken, tokenAt, spent, held, heldSince}); the token is a conversation handle at rest, same trade-off as config_json's credentials
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (channel, account_id, chat_id)
+);
 CREATE TABLE IF NOT EXISTS ui_prefs (
   user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
   prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
 );
+CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+  extension_id TEXT PRIMARY KEY,              -- random id shown in the Web App's list
+  user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  token_hash   TEXT NOT NULL UNIQUE,          -- sha256(token) hex; the extension alone holds the token
+  name         TEXT NOT NULL,                 -- how the extension names this Chrome ("Chrome 130 on macOS")
+  version      TEXT NOT NULL,                 -- the extension's version, as of its last hello
+  created_at   TEXT NOT NULL,
+  last_seen_at TEXT,                          -- last connect or disconnect; NULL = never connected
+  revoked_at   TEXT                           -- set by Revoke; a revoked token's socket is closed 4003
+);
+CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  enabled       INTEGER NOT NULL DEFAULT 0,     -- the API tab's switch; off = every /api/amsp request for it is 404 agent_not_found
+  open          INTEGER NOT NULL DEFAULT 0,     -- keyless access: a request without Authorization is accepted; off = 401 unauthorized
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- copied onto each new API Session
+  provider      TEXT,                         -- NULL pair follows the Project default model
+  model_id      TEXT,
+  thinking_level TEXT,                        -- NULL follows Agent/Project configuration
+  workspace     TEXT,                         -- NULL creates a temporary Workspace
+  max_concurrent_runs INTEGER NOT NULL DEFAULT 4,
+  updated_at    TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+  key_id       TEXT PRIMARY KEY,                -- 16 base64url chars, shown in the list
+  project_id   TEXT NOT NULL,
+  agent_id     TEXT NOT NULL,
+  token_hash   TEXT NOT NULL UNIQUE,            -- sha256(key) hex
+  prefix       TEXT NOT NULL,                   -- the key's first 16 characters ("penguin_" + 8), shown in the list
+  name         TEXT NOT NULL,                   -- 1-64 characters
+  created_by   TEXT NOT NULL REFERENCES users(user_id),
+  created_at   TEXT NOT NULL,
+  last_used_at TEXT                             -- stamped once per run request that authenticated with it; NULL = never
+);
+CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
 CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
   key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
   value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
@@ -550,10 +854,10 @@ CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at
   session_id TEXT PRIMARY KEY,
   project_id TEXT NOT NULL,
   agent_id   TEXT NOT NULL,
-  source     TEXT,                           -- session_meta origin: 'subagent' | 'schedule' | 'benchmark' | NULL = user-created (or head not yet readable)
+  source     TEXT,                           -- session_meta source as the head carried it: 'user' | 'api' | 'schedule' | 'subagent' | 'cli' | 'company'; NULL = the head records none (written before the source was required: read as 'company' for an 'org' row, else 'user' \u2014 readRecordedSource); 'benchmark' from older rows reads as 'cli' (normalizeSessionSource; meaningless while meta_read = 0)
   workspace  TEXT NOT NULL DEFAULT '',
   title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
-  provider   TEXT,                           -- model reference from session_meta (CLI adoption reads it from here; NULL = meta unreadable / legacy without provider)
+  provider   TEXT,                           -- model reference from session_meta: the model the Session was created on (CLI adoption reads it from here, and the runtime's own answer corrects the row at load; NULL = meta unreadable / legacy without provider)
   model_id   TEXT,
   first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
   meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
@@ -666,6 +970,7 @@ function openDatabase(dbPath) {
   ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
   ensureColumn(db, "sessions", "fork_count", "INTEGER NOT NULL DEFAULT 0");
   ensureColumn(db, "sessions", "thinking_level", "TEXT");
+  ensureColumn(db, "sessions", "sandbox", "TEXT");
   ensureColumn(db, "auth_sessions", "via", "TEXT");
   ensureColumn(db, "trace_files", "page_stats", "TEXT");
   ensureColumn(db, "messaging_bindings", "line_per_message", "INTEGER NOT NULL DEFAULT 0");
@@ -708,4 +1013,4 @@ export {
   openDatabaseReadOnly,
   openDatabase
 };
-//# sourceMappingURL=chunk-A3QANMU5.js.map
+//# sourceMappingURL=chunk-3SFJKLQU.js.map