@prismshadow/penguin-server 0.2.7 → 0.2.9

package/dist/{chunk-WKJ3ANJP.js → chunk-WL5FUO3A.js}

@@ -11,13 +11,21 @@ CREATE TABLE IF NOT EXISTS users (
   password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
   created_at          TEXT NOT NULL
 );
+-- Server-side sessions backing the HttpOnly cookie: the cookie carries a 32-byte random
+-- token, the row stores only its sha256. A session outlives a restart (it is on disk), which
+-- is why the model is a row and not a signed statement.
 CREATE TABLE IF NOT EXISTS auth_sessions (
   token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
   user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
   created_at TEXT NOT NULL,
-  expires_at TEXT NOT NULL,                  -- 7-day sliding renewal (topped up when <6 days remain)
-  via        TEXT                            -- 'password' | 'desktop'; NULL = legacy row (password)
+  expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
+  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'; NULL = legacy (password)
 );
+-- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
+-- these both scan the whole table.
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+
 CREATE TABLE IF NOT EXISTS projects (
   project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
   owner_user_id TEXT NOT NULL REFERENCES users(user_id),
@@ -114,18 +122,22 @@ CREATE TABLE IF NOT EXISTS goal_state (        -- goal-mode runtime state (GOAL.
 );
 CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
 CREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session \u2194 messaging-channel bot bindings (runtime/messaging/ holds the long connections)
-  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled)
-  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram')
-  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id); one binding per account per channel (idx_messaging_account: one account has one event stream, two Sessions would race it)
-  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as "" (the row and its account identity stay)
+  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled), and enabling is what binds the account to this Session
+  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram' | 'qq' | 'wechat')
+  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id; qq: the bot's App ID; wechat: the scanned bot id); NOT unique \u2014 any number of Sessions may keep the same account saved side by side, each with its own config and last-chat memory; only ENABLING is exclusive (route-enforced, 409 account_enabled_elsewhere: one account has one event stream, two live connections on it would race)
+  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken; qq: appId/appSecret; wechat: botId/botToken/baseUrl/userId); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as "" (the row and its account identity stay)
   enabled          INTEGER NOT NULL DEFAULT 0, -- INTENT state (the connection's runtime status stays in memory): new bindings start disabled \u2014 saving credentials never opens a connection, the explicit state toggle does
-  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it)
+  line_per_message INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = every non-blank line of a relayed assistant reply is sent as its own message (a reply written as spoken lines arrives as spoken lines), 0 = one message per reply. Channel-agnostic, so it lives here rather than in config_json, which each connector owns
+  final_reply_only INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = a run's intermediate assistant messages are held and only its LAST completed one is sent, at the run's end, 0 = every completed assistant message mirrors the moment it completes. Channel-agnostic like the column above and independent of it: with both set, that one final text is the one split per line
+  render_markdown  INTEGER NOT NULL DEFAULT 1, -- delivery preference: 1 = a relayed reply's Markdown is rendered in the channel's own markup (Telegram HTML, a Feishu card, QQ markdown, the subset WeChat itself reads), 0 = the reply's characters are sent as written. DEFAULT 1 because the model writes Markdown and showing it raw was the defect; the per-channel subsets and the plain-text fallback live in the connectors
+  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it); CONNECTOR-OPAQUE, not necessarily a bare chat id \u2014 telegram appends the forum topic (see telegram-connector.ts chatRefOf), so only that channel's connector may interpret it
   last_chat_is_direct INTEGER NOT NULL DEFAULT 1, -- 1 = direct chat (reply by chat id), 0 = group chat (prefer reply-to-message)
+  last_inbound_message_id TEXT,                 -- channel id of the most recently PROCESSED inbound message (NULL until one arrives); the durable half of the bridge's redelivery guard, so a channel replaying an event this server already turned into a Task after a restart does not run it twice
   created_at       TEXT NOT NULL,
   updated_at       TEXT NOT NULL,
   PRIMARY KEY (session_id, channel)
 );
-CREATE UNIQUE INDEX IF NOT EXISTS idx_messaging_account ON messaging_bindings(channel, account_id);
+CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever
 CREATE TABLE IF NOT EXISTS ui_prefs (
   user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
   prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
@@ -163,12 +175,19 @@ CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id
 
 // src/db/database.ts
 var sqlite = process.getBuiltinModule("node:sqlite");
+function openExistingDatabase(dbPath) {
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  return db;
+}
 function openDatabase(dbPath) {
   if (dbPath !== ":memory:") {
     mkdirSync(path.dirname(dbPath), { recursive: true });
   }
   const db = new sqlite.DatabaseSync(dbPath);
   db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA busy_timeout = 5000;");
   db.exec("PRAGMA foreign_keys = ON;");
   db.exec(SCHEMA_SQL);
   ensureColumn(db, "sessions", "client", "TEXT");
@@ -177,7 +196,12 @@ function openDatabase(dbPath) {
   ensureColumn(db, "sessions", "thinking_level", "TEXT");
   ensureColumn(db, "auth_sessions", "via", "TEXT");
   ensureColumn(db, "trace_files", "page_stats", "TEXT");
+  ensureColumn(db, "messaging_bindings", "line_per_message", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
+  ensureColumn(db, "messaging_bindings", "last_inbound_message_id", "TEXT");
   db.exec("DROP INDEX IF EXISTS idx_usage_session");
+  db.exec("DROP INDEX IF EXISTS idx_messaging_account");
   upgradeLastActiveAt(db);
   return db;
 }
@@ -205,45 +229,6 @@ function ensureColumn(db, table, column, ddl) {
   return true;
 }
 
-// src/db/repos/auth-sessions.ts
-var AuthSessionsRepo = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  insert(row) {
-    this.db.prepare(
-      "INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)"
-    ).run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);
-  }
-  findByTokenHash(tokenHash) {
-    const r = this.db.prepare("SELECT * FROM auth_sessions WHERE token_hash = ?").get(tokenHash);
-    if (!r) return null;
-    return {
-      tokenHash: r.token_hash,
-      userId: r.user_id,
-      createdAt: r.created_at,
-      expiresAt: r.expires_at,
-      via: r.via ?? null
-    };
-  }
-  /** Sliding renewal: update the expiration time. */
-  touch(tokenHash, expiresAt) {
-    this.db.prepare("UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?").run(expiresAt, tokenHash);
-  }
-  delete(tokenHash) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE token_hash = ?").run(tokenHash);
-  }
-  /** Opportunistically clean up expired sessions (called during login/validation). */
-  deleteExpired(nowIso) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE expires_at < ?").run(nowIso);
-  }
-  /** Clear all sessions for a user (forces re-login after an admin resets the password). */
-  deleteByUser(userId) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").run(userId);
-  }
-};
-
 // src/db/repos/users.ts
 function mapRow(r) {
   return {
@@ -293,357 +278,83 @@ var UsersRepo = class {
   }
 };
 
-// src/auth/password.ts
-import { randomBytes, scrypt, timingSafeEqual } from "crypto";
-var SCRYPT_COST = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SALT_BYTES = 16;
-var KEY_BYTES = 64;
-function scryptAsync(password, salt, keyLen, n, r, p) {
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, keyLen, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => {
-      if (err) reject(err);
-      else resolve(key);
-    });
-  });
-}
-async function hashPassword(password, cost = SCRYPT_COST) {
-  const salt = randomBytes(SALT_BYTES);
-  const key = await scryptAsync(password, salt, KEY_BYTES, cost, SCRYPT_R, SCRYPT_P);
-  return [
-    "scrypt",
-    String(cost),
-    String(SCRYPT_R),
-    String(SCRYPT_P),
-    salt.toString("base64"),
-    key.toString("base64")
-  ].join("$");
-}
-async function verifyPassword(password, stored) {
-  const parts = stored.split("$");
-  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
-  const n = Number(parts[1]);
-  const r = Number(parts[2]);
-  const p = Number(parts[3]);
-  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
-  let salt;
-  let expected;
-  try {
-    salt = Buffer.from(parts[4], "base64");
-    expected = Buffer.from(parts[5], "base64");
-  } catch {
-    return false;
-  }
-  if (salt.length === 0 || expected.length === 0) return false;
-  let actual;
-  try {
-    actual = await scryptAsync(password, salt, expected.length, n, r, p);
-  } catch {
-    return false;
-  }
-  return actual.length === expected.length && timingSafeEqual(actual, expected);
-}
-
-// src/auth/service.ts
-import { createHash as createHash2, randomBytes as randomBytes3, randomInt } from "crypto";
-
-// src/auth/api-token.ts
-import { createHash, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import fs from "fs";
-import path2 from "path";
-function apiTokenPath(root) {
-  return path2.join(root, "api-token");
-}
-function mintApiToken() {
-  return randomBytes2(32).toString("base64url");
-}
-function storeApiToken(root, token) {
-  try {
-    fs.mkdirSync(root, { recursive: true });
-    const target = apiTokenPath(root);
-    const tmp = `${target}.${process.pid}.tmp`;
-    fs.writeFileSync(tmp, `${token}
-`, { mode: 384 });
-    fs.renameSync(tmp, target);
-  } catch {
-  }
-}
-function tokensEqual(a, b) {
-  const digest = (v) => createHash("sha256").update(v).digest();
-  return timingSafeEqual2(digest(a), digest(b));
-}
-
-// src/http/errors.ts
-var HttpError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "HttpError";
-  }
-  status;
-  code;
-};
-function errorBody(code, message) {
-  return { error: { code, message } };
-}
-function isMissingCredential(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return /missing credentials|api[_ ]?key/i.test(message);
-}
-function modelCredentialMissing(modelId) {
-  return new HttpError(
-    400,
-    "model_credential_missing",
-    `Model ${modelId} has no API key yet. Configure it on the Models page first.`
-  );
-}
-function handleError(err, c) {
-  if (err instanceof HttpError) {
-    return c.json(errorBody(err.code, err.message), err.status);
-  }
-  console.error(`[server] Unhandled exception: ${err.stack ?? err.message}`);
-  return c.json(errorBody("internal", "Internal server error."), 500);
-}
-
-// src/auth/service.ts
-var MIN_PASSWORD_LENGTH = 8;
-var ADMIN_USER_ID = "admin";
-var LOGIN_FREE_ATTEMPTS = 5;
-var LOGIN_BACKOFF_START_MS = 1e3;
-var LOGIN_BACKOFF_CAP_MS = 6e4;
-var LOGIN_FAILURE_IDLE_MS = 15 * 6e4;
-function generateInitialAdminPassword() {
-  return "penguin-" + String(randomInt(0, 1e4)).padStart(4, "0");
-}
-function sha256Hex(value) {
-  return createHash2("sha256").update(value).digest("hex");
-}
-function toUserInfo(row) {
-  return {
-    userId: row.userId,
-    isAdmin: row.isAdmin,
-    passwordIsInitial: row.passwordIsInitial,
-    createdAt: row.createdAt
-  };
+// src/db/repos/auth-sessions.ts
+import { createHash, randomBytes } from "crypto";
+function sessionTokenHash(token) {
+  return createHash("sha256").update(token).digest("hex");
 }
-var AuthService = class {
-  constructor(deps) {
-    this.deps = deps;
-    this.provisioner = deps.provisionInitialProject;
-    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
-    this.hashCost = deps.passwordHashCost ?? SCRYPT_COST;
+var AuthSessionsRepo = class {
+  constructor(db) {
+    this.db = db;
   }
-  deps;
-  /**
-   * What a fresh user is provisioned with is business policy, answered by the CURRENT
-   * App: the platform installs its answer at create over the claimed auth capability
-   * (ordinary capability use, not a registry entry), and each swap's successor overwrites
-   * it. Starts as the constructor-supplied fallback so standalone/test constructions
-   * keep working unchanged.
-   */
-  provisioner;
-  now;
-  hashCost;
+  db;
   /**
-   * Startup seeding (idempotent): creates the built-in admin and adopts
-   * default_project when the users table is empty; if the initial Project fails,
-   * the user row is rolled back and the server retries on next startup.
-   * Returns the initial password when it actually seeded — the caller prints it,
-   * the only place a generated password is ever shown — and null when users
-   * already exist.
+   * Mints a session and returns the raw token for a cookie or the terminal. `maxTtlMs` caps a
+   * caller-supplied lifetime (`--ttl-seconds`): one longer than an ordinary session would make
+   * a leaked token file outlive every other credential, sliding forever. Expired rows are
+   * swept here too, so a cron that only mints does not accumulate them.
    */
-  async seedAdmin() {
-    if (this.deps.users.count() > 0) return null;
-    const password = this.deps.seedAdminPassword ?? generateInitialAdminPassword();
-    if (password.length < MIN_PASSWORD_LENGTH) {
-      throw new Error(
-        `PENGUIN_SEED_ADMIN_PASSWORD must be at least ${MIN_PASSWORD_LENGTH} characters.`
-      );
-    }
-    const user = {
-      userId: ADMIN_USER_ID,
-      passwordHash: await hashPassword(password, this.hashCost),
-      isAdmin: true,
-      passwordIsInitial: true,
-      createdAt: this.now().toISOString()
-    };
-    this.deps.users.insert(user);
-    try {
-      await this.provisioner(user, true);
-    } catch (err) {
-      this.deps.users.delete(user.userId);
-      throw err;
-    }
-    return password;
-  }
-  /** Installs the current App's provisioning policy (see the `provisioner` field). */
-  setProvisioner(provision) {
-    this.provisioner = provision;
-  }
-  /** Whether the built-in admin still runs on its initial password (drives the startup reminder notice). */
-  adminPasswordIsInitial() {
-    return this.deps.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;
-  }
-  /** Consecutive login failures per userId (see the throttling comment on the constants). */
-  loginFailures = /* @__PURE__ */ new Map();
-  /** The wait imposed after `failures` consecutive failures (0 while within the free attempts). */
-  loginDelayMs(failures) {
-    const excess = failures - LOGIN_FREE_ATTEMPTS;
-    if (excess <= 0) return 0;
-    return Math.min(LOGIN_BACKOFF_START_MS * 2 ** (excess - 1), LOGIN_BACKOFF_CAP_MS);
-  }
-  async login(userId, password) {
-    const nowMs = this.now().getTime();
-    for (const [key, entry] of this.loginFailures) {
-      if (nowMs - entry.lastFailureAt > LOGIN_FAILURE_IDLE_MS) this.loginFailures.delete(key);
-    }
-    const failed = this.loginFailures.get(userId);
-    if (failed) {
-      const readyAt = failed.lastFailureAt + this.loginDelayMs(failed.failures);
-      if (nowMs < readyAt) {
-        throw new HttpError(
-          429,
-          "too_many_attempts",
-          `Too many failed sign-in attempts. Try again in ${Math.ceil((readyAt - nowMs) / 1e3)}s.`
-        );
-      }
-    }
-    const row = this.deps.users.findById(userId);
-    const ok = row !== null && await verifyPassword(password, row.passwordHash);
-    if (!row || !ok) {
-      this.loginFailures.set(userId, {
-        failures: (failed?.failures ?? 0) + 1,
-        lastFailureAt: this.now().getTime()
-      });
-      throw new HttpError(401, "invalid_credentials", "Incorrect username or password.");
-    }
-    this.loginFailures.delete(userId);
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
-    return { user: toUserInfo(row), token: this.issueSession(row.userId, "password") };
+  issue(opts) {
+    const ttlMs = Math.max(1e3, Math.min(opts.ttlMs, opts.maxTtlMs ?? opts.ttlMs));
+    const token = randomBytes(32).toString("base64url");
+    const createdAt = opts.now.toISOString();
+    const expiresAt = new Date(opts.now.getTime() + ttlMs).toISOString();
+    this.deleteExpired(createdAt);
+    this.insert({
+      tokenHash: sessionTokenHash(token),
+      userId: opts.userId,
+      createdAt,
+      expiresAt,
+      via: opts.via
+    });
+    return { token, expiresAt };
   }
-  /**
-   * Desktop-mode sign-in: issues an admin session WITHOUT a password check — the caller
-   * (the desktop-login route) has already redeemed the shell's one-shot token, which is
-   * the credential here. Throws if the admin has not been seeded yet (desktop-login runs
-   * after startup seeding, so this only trips on a broken deployment).
-   */
-  loginDesktop() {
-    const row = this.deps.users.findById(ADMIN_USER_ID);
-    if (!row) {
-      throw new HttpError(500, "internal", "Built-in admin has not been seeded.");
-    }
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
-    return { user: toUserInfo(row), token: this.issueSession(row.userId, "desktop") };
+  insert(row) {
+    this.db.prepare(
+      "INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)"
+    ).run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);
   }
-  /** Self password change (user settings): validates the old password, and on success clears the initial-password flag; the current session remains valid. */
-  async changePassword(userId, oldPassword, newPassword) {
-    const row = this.deps.users.findById(userId);
-    if (!row || !await verifyPassword(oldPassword, row.passwordHash)) {
-      throw new HttpError(400, "password_mismatch", "Current password is incorrect.");
-    }
-    if (newPassword.length < MIN_PASSWORD_LENGTH) {
-      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
-    }
-    this.deps.users.updatePassword(userId, await hashPassword(newPassword, this.hashCost), false);
-    this.deps.onPasswordChanged?.(userId);
+  findByTokenHash(tokenHash) {
+    const r = this.db.prepare("SELECT * FROM auth_sessions WHERE token_hash = ?").get(tokenHash);
+    if (!r) return null;
+    return {
+      tokenHash: r.token_hash,
+      userId: r.user_id,
+      createdAt: r.created_at,
+      expiresAt: r.expires_at,
+      via: r.via ?? null
+    };
   }
-  /**
-   * Desktop-session password set: no old-password check. Only reachable for sessions
-   * established via desktop-login (the me route gates on sessionVia) — the seed password
-   * of a desktop-created root is random and never shown, so its holder has nothing to
-   * type into an old-password field; the shell's token already proved machine ownership.
-   */
-  async setPasswordDesktop(userId, newPassword) {
-    if (newPassword.length < MIN_PASSWORD_LENGTH) {
-      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
-    }
-    this.deps.users.updatePassword(userId, await hashPassword(newPassword, this.hashCost), false);
-    this.deps.onPasswordChanged?.(userId);
+  /** Sliding renewal: update the expiration time. */
+  touch(tokenHash, expiresAt) {
+    this.db.prepare("UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?").run(expiresAt, tokenHash);
   }
-  logout(token) {
-    this.deps.authSessions.delete(sha256Hex(token));
+  delete(tokenHash) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE token_hash = ?").run(tokenHash);
   }
-  /**
-   * The boot-scoped local API token (`<root>/api-token`, see auth/api-token.ts): held in
-   * memory by the process that minted it. Null until the startup assembly installs it
-   * (standalone/test constructions without one simply never authenticate a Bearer
-   * header).
-   */
-  apiToken = null;
-  /** Installs the boot's local API token (called once by the startup assembly). */
-  setLocalApiToken(token) {
-    this.apiToken = token;
+  /** Opportunistically clean up expired sessions (called during login/validation). */
+  deleteExpired(nowIso) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE expires_at < ?").run(nowIso);
   }
-  /** The current boot's local API token (what control-env injection hands to tool subprocesses); null when none was installed. */
-  localApiToken() {
-    return this.apiToken;
+  /** Clear all sessions for a user (forces re-login after an admin resets the password). */
+  deleteByUser(userId) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").run(userId);
   }
   /**
-   * Validates a Bearer token against the boot's local API token (constant-time compare):
-   * a match authenticates as the built-in admin — holding the token proves filesystem
-   * access to the data root, which is admin authority (see auth/api-token.ts). Returns
-   * null on mismatch, when no token is installed, or when the admin row is missing.
+   * Clear a user's sessions of one kind. Used to end EVERY first-login session when a password
+   * is set: an earlier boot's link may still be live in someone's scrollback, and a `setup`
+   * session may change the password without knowing the old one.
    */
-  authenticateApiToken(token) {
-    if (this.apiToken === null || token.length === 0) return null;
-    if (!tokensEqual(token, this.apiToken)) return null;
-    const user = this.deps.users.findById(ADMIN_USER_ID);
-    return user === null ? null : { user, via: "token" };
-  }
-  /** Validates the cookie token: returns null if expired/unknown; sliding renewal once less than 6 days remain. */
-  authenticateWithMeta(token) {
-    const tokenHash = sha256Hex(token);
-    const session = this.deps.authSessions.findByTokenHash(tokenHash);
-    if (!session) return null;
-    const now = this.now();
-    const expiresAt = Date.parse(session.expiresAt);
-    if (!(expiresAt > now.getTime())) {
-      this.deps.authSessions.delete(tokenHash);
-      return null;
-    }
-    if (expiresAt - now.getTime() < this.deps.sessionRenewMs) {
-      this.deps.authSessions.touch(
-        tokenHash,
-        new Date(now.getTime() + this.deps.sessionTtlMs).toISOString()
-      );
-    }
-    const user = this.deps.users.findById(session.userId);
-    if (!user) return null;
-    return { user, via: session.via === "desktop" ? "desktop" : "password" };
-  }
-  issueSession(userId, via) {
-    const token = randomBytes3(32).toString("base64url");
-    const now = this.now();
-    this.deps.authSessions.insert({
-      tokenHash: sha256Hex(token),
-      userId,
-      createdAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + this.deps.sessionTtlMs).toISOString(),
-      via
-    });
-    return token;
+  deleteByUserAndVia(userId, via) {
+    this.db.prepare("DELETE FROM auth_sessions WHERE user_id = ? AND via = ?").run(userId, via);
   }
 };
 
 export {
+  openExistingDatabase,
   openDatabase,
-  AuthSessionsRepo,
   UsersRepo,
-  HttpError,
-  errorBody,
-  isMissingCredential,
-  modelCredentialMissing,
-  handleError,
-  mintApiToken,
-  storeApiToken,
-  SCRYPT_COST,
-  hashPassword,
-  MIN_PASSWORD_LENGTH,
-  ADMIN_USER_ID,
-  generateInitialAdminPassword,
-  toUserInfo,
-  AuthService
+  sessionTokenHash,
+  AuthSessionsRepo
 };
-//# sourceMappingURL=chunk-WKJ3ANJP.js.map
+//# sourceMappingURL=chunk-WL5FUO3A.js.map

package/dist/chunk-WL5FUO3A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/database.ts","../src/db/schema.ts","../src/db/repos/users.ts","../src/db/repos/auth-sessions.ts"],"sourcesContent":["/**\n * SQLite connection & initialization (node:sqlite DatabaseSync).\n *\n * Single process, single writer: a synchronous API is sufficient and avoids a connection\n * pool; WAL mode and foreign key constraints are enabled. Table-creation SQL runs on open\n * (idempotent), with no migration branches (product not yet released).\n */\nimport { mkdirSync } from \"node:fs\";\nimport path from \"node:path\";\nimport type { DatabaseSync } from \"node:sqlite\";\nimport { SCHEMA_SQL } from \"./schema.js\";\n\n// Fetch the runtime module via process.getBuiltinModule (node >=22.3): avoids static\n// resolution of `node:sqlite` by bundlers/vite (some tools' builtin lists don't yet\n// recognize this experimental module).\nconst sqlite = process.getBuiltinModule(\"node:sqlite\");\n\n/**\n * Opens an EXISTING database for a narrow write, without running any schema work.\n *\n * `openDatabase` migrates — CREATE TABLE, several ensureColumn calls, a DROP INDEX and a backfill.\n * That is right for the process that owns the database and wrong for a short-lived CLI writing\n * one row (`penguin auth token`): after `penguin update` the CLI on disk can be NEWER than the\n * running server, and migrating under a live server's prepared statements is not something a\n * token mint should do. The caller has already established that the file exists.\n */\nexport function openExistingDatabase(dbPath: string): DatabaseSync {\n  const db = new sqlite.DatabaseSync(dbPath);\n  db.exec(\"PRAGMA foreign_keys = ON;\");\n  // Wait for the live server's write lock instead of failing SQLITE_BUSY at once.\n  db.exec(\"PRAGMA busy_timeout = 5000;\");\n  return db;\n}\n\n/** Open (creating if necessary) the database: ensure the parent directory exists, set PRAGMAs, run table creation. */\nexport function openDatabase(dbPath: string): DatabaseSync {\n  if (dbPath !== \":memory:\") {\n    mkdirSync(path.dirname(dbPath), { recursive: true });\n  }\n  const db = new sqlite.DatabaseSync(dbPath);\n  db.exec(\"PRAGMA journal_mode = WAL;\");\n  // A second connection (the CLI minting a token while the server runs) waits for the write\n  // lock rather than failing SQLITE_BUSY at once.\n  db.exec(\"PRAGMA busy_timeout = 5000;\");\n  db.exec(\"PRAGMA foreign_keys = ON;\");\n  db.exec(SCHEMA_SQL);\n  // Columns added to the schema after a web.db was formed: CREATE TABLE IF NOT EXISTS never\n  // touches an existing table, so they are ALTERed in here. Keep the list in sync with\n  // schema.ts; drop entries only in a release allowed to break existing web.db files.\n  ensureColumn(db, \"sessions\", \"client\", \"TEXT\");\n  ensureColumn(db, \"sessions\", \"has_trace\", \"INTEGER NOT NULL DEFAULT 0\");\n  ensureColumn(db, \"sessions\", \"fork_count\", \"INTEGER NOT NULL DEFAULT 0\");\n  ensureColumn(db, \"sessions\", \"thinking_level\", \"TEXT\");\n  // A v0.2.0 web.db has auth_sessions without `via`; CREATE TABLE IF NOT EXISTS never adds a\n  // column, so every INSERT would fail \"no column named via\" until this runs.\n  ensureColumn(db, \"auth_sessions\", \"via\", \"TEXT\");\n  ensureColumn(db, \"trace_files\", \"page_stats\", \"TEXT\");\n  ensureColumn(db, \"messaging_bindings\", \"line_per_message\", \"INTEGER NOT NULL DEFAULT 0\");\n  ensureColumn(db, \"messaging_bindings\", \"final_reply_only\", \"INTEGER NOT NULL DEFAULT 0\");\n  // DEFAULT 1, unlike every other added flag here: this one's default is the CORRECTED\n  // behaviour, not the previous one. Sending the model's Markdown as characters was the\n  // defect, so an existing binding starts rendering it — a visible change to every relayed\n  // message, recorded in the release's backward-compatibility entry.\n  ensureColumn(db, \"messaging_bindings\", \"render_markdown\", \"INTEGER NOT NULL DEFAULT 1\");\n  ensureColumn(db, \"messaging_bindings\", \"last_inbound_message_id\", \"TEXT\");\n  // Superseded by idx_usage_session_ts (session_id, ts), which SCHEMA_SQL just created on\n  // this database: the old index is a strict prefix of it, so every query it served is\n  // served identically. Dropping is safe — an index is derived, never data.\n  db.exec(\"DROP INDEX IF EXISTS idx_usage_session\");\n  // The uniqueness index of the old binding model, where a bot account belonged to one\n  // Session forever and a second Session could not even SAVE its credentials. Enabling a\n  // connection is the binding now, so exclusivity is checked per enable (the state route's\n  // 409 account_enabled_elsewhere) and the same account may sit saved on many Sessions —\n  // which this index would reject. SCHEMA_SQL has just created idx_messaging_by_account\n  // over the same columns, so the by-account lookup stays indexed. Dropping is safe: an\n  // index is derived, never data. It is however ONE-WAY — an older build recreates the\n  // unique index on open, which fails outright once duplicate (channel, account_id) rows\n  // exist, so a downgrade after two Sessions saved the same bot needs those rows removed.\n  db.exec(\"DROP INDEX IF EXISTS idx_messaging_account\");\n  upgradeLastActiveAt(db);\n  return db;\n}\n\n/**\n * One-time `sessions.last_active_at` upgrade, ALTER + backfill in a single transaction.\n *\n * The backfill runs **only in the open that actually adds the column** (SQLite's ALTER\n * TABLE ADD COLUMN is transactional, so a crash mid-upgrade rolls back to \"no column\" and\n * the next open redoes both halves — never a half-migrated table, and never a full\n * `sessions` scan on the millions of opens that follow). Legacy rows take the session's\n * most recent request timestamp — usage_records, covered by idx_usage_session_ts, the\n * closest persisted proxy for \"last Trace activity\" — else their own created_at.\n */\nfunction upgradeLastActiveAt(db: DatabaseSync): void {\n  db.exec(\"BEGIN\");\n  try {\n    if (ensureColumn(db, \"sessions\", \"last_active_at\", \"TEXT\")) {\n      db.exec(\n        `UPDATE sessions SET last_active_at = COALESCE(\n           (SELECT MAX(ts) FROM usage_records WHERE usage_records.session_id = sessions.session_id),\n           created_at\n         )`,\n      );\n    }\n    db.exec(\"COMMIT\");\n  } catch (err) {\n    db.exec(\"ROLLBACK\");\n    throw err;\n  }\n}\n\n/**\n * Idempotent per-column upgrade for databases formed before the column existed.\n * Returns whether this call actually ALTERed the table (false = the column was already\n * there), so a caller can gate one-time backfill work on it.\n */\nfunction ensureColumn(db: DatabaseSync, table: string, column: string, ddl: string): boolean {\n  const cols = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[];\n  if (cols.some((c) => c.name === column)) return false;\n  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);\n  return true;\n}\n","/**\n * SQLite table-creation SQL.\n *\n * SQLite stores only indexes and aggregates: users / login sessions / Project authorization /\n * Agent & Session indexes / usage summaries / error records / UI preferences. Agent State,\n * Trace, and Workspace still follow the local directory-based storage rules.\n * Product not yet released: no migration branches — everything is CREATE IF NOT EXISTS, formed\n * once. The one exception: columns added to an existing table after release of a web.db are\n * ALTERed in by the idempotent per-column guard in database.ts (ensureColumn), since CREATE\n * TABLE IF NOT EXISTS never touches an existing table. A *reshaped* index follows the same\n * rule under a new name, with the superseded one dropped on open (idx_usage_session →\n * idx_usage_session_ts): CREATE INDEX IF NOT EXISTS never rebuilds an existing index either.\n */\n\nexport const SCHEMA_SQL = `\nCREATE TABLE IF NOT EXISTS users (\n  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$\n  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)\n  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)\n  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it\n  created_at          TEXT NOT NULL\n);\n-- Server-side sessions backing the HttpOnly cookie: the cookie carries a 32-byte random\n-- token, the row stores only its sha256. A session outlives a restart (it is on disk), which\n-- is why the model is a row and not a signed statement.\nCREATE TABLE IF NOT EXISTS auth_sessions (\n  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token\n  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain\n  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'; NULL = legacy (password)\n);\n-- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without\n-- these both scan the whole table.\nCREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);\nCREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);\n\nCREATE TABLE IF NOT EXISTS projects (\n  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml\n  owner_user_id TEXT NOT NULL REFERENCES users(user_id),\n  created_at    TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here\n  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,\n  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (project_id, user_id)\n);\nCREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml\n  project_id TEXT NOT NULL,\n  agent_id   TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (project_id, agent_id)\n);\nCREATE TABLE IF NOT EXISTS sessions (\n  session_id    TEXT PRIMARY KEY,\n  project_id    TEXT NOT NULL,\n  agent_id      TEXT NOT NULL,\n  provider      TEXT NOT NULL,                     -- provider group of the session model (paired with model_id as a model reference)\n  model_id      TEXT NOT NULL,                     -- upstream model id (sent to AgentHub as-is; never concatenate <provider>/<id>)\n  workspace     TEXT NOT NULL,\n  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask\n  thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config\n  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows \"New chat\")\n  archived_at   TEXT,                                -- archive time; NULL=not archived (shown by default; archived ones move under \"Archived\")\n  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace); NULL = legacy row, treated as web\n  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)\n  fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted\n  last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill\n  created_at    TEXT NOT NULL\n);                                            -- the schedule/subagent SOURCE is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); \"client\" is a different, DB-only axis (who created the row)\nCREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);\nCREATE TABLE IF NOT EXISTS usage_records (\n  id                INTEGER PRIMARY KEY AUTOINCREMENT,\n  ts                TEXT NOT NULL,\n  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)\n  project_id        TEXT NOT NULL,\n  agent_id          TEXT NOT NULL,\n  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)\n  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session\n  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id\n  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)\n  cache_read        INTEGER NOT NULL,\n  cache_write       INTEGER NOT NULL,\n  output            INTEGER NOT NULL,\n  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)\n  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)\n);                                            -- cost is not stored: computed at query time from current pricing\nCREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);\nCREATE INDEX IF NOT EXISTS idx_usage_session_ts ON usage_records(session_id, ts);  -- (session_id) alone was idx_usage_session (dropped on open): ts makes the last_active_at backfill's MAX(ts) a covering index scan instead of a random row lookup per usage record\nCREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's \"Errors\" tab)\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  ts         TEXT NOT NULL,\n  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)\n  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context\n  agent_id   TEXT,\n  session_id TEXT,\n  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging\n  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)\n  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...\n  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources\n  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)\n);\nCREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);\nCREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)\n  project_id      TEXT NOT NULL,\n  agent_id        TEXT NOT NULL,\n  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier\n  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)\n  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state\n  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)\n  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)\n  last_fired_at   TEXT,                        -- last actual fire time (for display)\n  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired\n  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)\n  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy\n  PRIMARY KEY (project_id, agent_id, name)\n);\nCREATE TABLE IF NOT EXISTS goal_state (        -- goal-mode runtime state (GOAL.yaml on disk is the model-facing protocol; this row is what the UI reads)\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,  -- one row per goal run; a Session may run goals repeatedly, latest row wins for display\n  session_id  TEXT NOT NULL,\n  project_id  TEXT NOT NULL,\n  agent_id    TEXT NOT NULL,\n  objective   TEXT NOT NULL,\n  status      TEXT NOT NULL,               -- active | complete | blocked | budget_limited | aborted (aborted is server-side only; on-disk status stays active)\n  budget      INTEGER NOT NULL,            -- token budget; -1 = unlimited\n  used        INTEGER NOT NULL DEFAULT 0,  -- uncached input + output, refreshed per round (mirrors the runner's accounting)\n  rounds      INTEGER NOT NULL DEFAULT 0,\n  created_at  TEXT NOT NULL,\n  updated_at  TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);\nCREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session ↔ messaging-channel bot bindings (runtime/messaging/ holds the long connections)\n  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled), and enabling is what binds the account to this Session\n  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram' | 'qq' | 'wechat')\n  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id; qq: the bot's App ID; wechat: the scanned bot id); NOT unique — any number of Sessions may keep the same account saved side by side, each with its own config and last-chat memory; only ENABLING is exclusive (route-enforced, 409 account_enabled_elsewhere: one account has one event stream, two live connections on it would race)\n  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken; qq: appId/appSecret; wechat: botId/botToken/baseUrl/userId); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as \"\" (the row and its account identity stay)\n  enabled          INTEGER NOT NULL DEFAULT 0, -- INTENT state (the connection's runtime status stays in memory): new bindings start disabled — saving credentials never opens a connection, the explicit state toggle does\n  line_per_message INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = every non-blank line of a relayed assistant reply is sent as its own message (a reply written as spoken lines arrives as spoken lines), 0 = one message per reply. Channel-agnostic, so it lives here rather than in config_json, which each connector owns\n  final_reply_only INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = a run's intermediate assistant messages are held and only its LAST completed one is sent, at the run's end, 0 = every completed assistant message mirrors the moment it completes. Channel-agnostic like the column above and independent of it: with both set, that one final text is the one split per line\n  render_markdown  INTEGER NOT NULL DEFAULT 1, -- delivery preference: 1 = a relayed reply's Markdown is rendered in the channel's own markup (Telegram HTML, a Feishu card, QQ markdown, the subset WeChat itself reads), 0 = the reply's characters are sent as written. DEFAULT 1 because the model writes Markdown and showing it raw was the defect; the per-channel subsets and the plain-text fallback live in the connectors\n  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it); CONNECTOR-OPAQUE, not necessarily a bare chat id — telegram appends the forum topic (see telegram-connector.ts chatRefOf), so only that channel's connector may interpret it\n  last_chat_is_direct INTEGER NOT NULL DEFAULT 1, -- 1 = direct chat (reply by chat id), 0 = group chat (prefer reply-to-message)\n  last_inbound_message_id TEXT,                 -- channel id of the most recently PROCESSED inbound message (NULL until one arrives); the durable half of the bridge's redelivery guard, so a channel replaying an event this server already turned into a Task after a restart does not run it twice\n  created_at       TEXT NOT NULL,\n  updated_at       TEXT NOT NULL,\n  PRIMARY KEY (session_id, channel)\n);\nCREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever\nCREATE TABLE IF NOT EXISTS ui_prefs (\n  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,\n  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON\n);\nCREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)\n  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'\n  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default\n);\nCREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence — consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404\n  project_id TEXT NOT NULL,\n  agent_id   TEXT NOT NULL,\n  session_id TEXT NOT NULL,\n  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)\n  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)\n  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)\n  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes\n  PRIMARY KEY (project_id, agent_id, session_id, file_index)\n);\nCREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);\nCREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);\nCREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)\n  session_id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  agent_id   TEXT NOT NULL,\n  source     TEXT,                           -- session_meta origin: 'subagent' | 'schedule' | NULL = user-created (or head not yet readable)\n  workspace  TEXT NOT NULL DEFAULT '',\n  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)\n  provider   TEXT,                           -- model reference from session_meta (CLI adoption reads it from here; NULL = meta unreadable / legacy without provider)\n  model_id   TEXT,\n  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)\n  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session\n);\nCREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);\n`;\n","/**\n * users table repo: pure SQL wrapper, no business rules.\n * user_id is the login name (a semantic id, specified at creation, immutable).\n */\nimport type { DatabaseSync } from \"node:sqlite\";\n\nexport interface UserRow {\n  userId: string;\n  passwordHash: string;\n  isAdmin: boolean;\n  /** Still using the initial password (seeded / set by an admin); cleared to 0 once the user changes it. */\n  passwordIsInitial: boolean;\n  createdAt: string;\n}\n\nfunction mapRow(r: Record<string, unknown>): UserRow {\n  return {\n    userId: r.user_id as string,\n    passwordHash: r.password_hash as string,\n    isAdmin: (r.is_admin as number) === 1,\n    passwordIsInitial: (r.password_is_initial as number) === 1,\n    createdAt: r.created_at as string,\n  };\n}\n\nexport class UsersRepo {\n  constructor(private readonly db: DatabaseSync) {}\n\n  insert(row: UserRow): void {\n    this.db\n      .prepare(\n        \"INSERT INTO users (user_id, password_hash, is_admin, password_is_initial, created_at) VALUES (?, ?, ?, ?, ?)\",\n      )\n      .run(\n        row.userId,\n        row.passwordHash,\n        row.isAdmin ? 1 : 0,\n        row.passwordIsInitial ? 1 : 0,\n        row.createdAt,\n      );\n  }\n\n  findById(userId: string): UserRow | null {\n    const r = this.db.prepare(\"SELECT * FROM users WHERE user_id = ?\").get(userId);\n    return r ? mapRow(r) : null;\n  }\n\n  /** All users (for the admin user backend), ordered by creation time ascending. */\n  list(): UserRow[] {\n    const rows = this.db.prepare(\"SELECT * FROM users ORDER BY created_at ASC, user_id ASC\").all();\n    return rows.map(mapRow);\n  }\n\n  count(): number {\n    const r = this.db.prepare(\"SELECT COUNT(*) AS n FROM users\").get();\n    return (r?.n as number) ?? 0;\n  }\n\n  /** Update the password hash; isInitial marks whether the password was set by someone else (seed / admin). */\n  updatePassword(userId: string, passwordHash: string, isInitial: boolean): void {\n    this.db\n      .prepare(\"UPDATE users SET password_hash = ?, password_is_initial = ? WHERE user_id = ?\")\n      .run(passwordHash, isInitial ? 1 : 0, userId);\n  }\n\n  /** Used by admin user deletion and account-creation compensation paths (owned Projects must be cleaned up first). */\n  delete(userId: string): void {\n    this.db.prepare(\"DELETE FROM users WHERE user_id = ?\").run(userId);\n  }\n}\n","/**\n * auth_sessions table repo (server-side sessions backing the HttpOnly cookie). Stores only\n * sha256(token); the raw token appears only in the cookie. `issue()` is the ONE minting point,\n * so a CLI-minted row cannot drift from one the server issues itself.\n */\nimport { createHash, randomBytes } from \"node:crypto\";\nimport type { DatabaseSync } from \"node:sqlite\";\n\n/** How a session was established, as stored. NULL on rows formed before the column existed. */\nexport type SessionViaValue = \"password\" | \"desktop\" | \"setup\" | \"cli\";\n\nexport interface AuthSessionRow {\n  tokenHash: string;\n  userId: string;\n  createdAt: string;\n  expiresAt: string;\n  via: SessionViaValue | null;\n}\n\n/** sha256 hex of a raw session token — the only form the database ever holds. */\nexport function sessionTokenHash(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"hex\");\n}\n\nexport class AuthSessionsRepo {\n  constructor(private readonly db: DatabaseSync) {}\n\n  /**\n   * Mints a session and returns the raw token for a cookie or the terminal. `maxTtlMs` caps a\n   * caller-supplied lifetime (`--ttl-seconds`): one longer than an ordinary session would make\n   * a leaked token file outlive every other credential, sliding forever. Expired rows are\n   * swept here too, so a cron that only mints does not accumulate them.\n   */\n  issue(opts: {\n    userId: string;\n    via: SessionViaValue;\n    now: Date;\n    ttlMs: number;\n    maxTtlMs?: number;\n  }): { token: string; expiresAt: string } {\n    const ttlMs = Math.max(1_000, Math.min(opts.ttlMs, opts.maxTtlMs ?? opts.ttlMs));\n    const token = randomBytes(32).toString(\"base64url\");\n    const createdAt = opts.now.toISOString();\n    const expiresAt = new Date(opts.now.getTime() + ttlMs).toISOString();\n    this.deleteExpired(createdAt);\n    this.insert({\n      tokenHash: sessionTokenHash(token),\n      userId: opts.userId,\n      createdAt,\n      expiresAt,\n      via: opts.via,\n    });\n    return { token, expiresAt };\n  }\n\n  insert(row: AuthSessionRow): void {\n    this.db\n      .prepare(\n        \"INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)\",\n      )\n      .run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);\n  }\n\n  findByTokenHash(tokenHash: string): AuthSessionRow | null {\n    const r = this.db.prepare(\"SELECT * FROM auth_sessions WHERE token_hash = ?\").get(tokenHash);\n    if (!r) return null;\n    return {\n      tokenHash: r.token_hash as string,\n      userId: r.user_id as string,\n      createdAt: r.created_at as string,\n      expiresAt: r.expires_at as string,\n      via: (r.via as SessionViaValue | null) ?? null,\n    };\n  }\n\n  /** Sliding renewal: update the expiration time. */\n  touch(tokenHash: string, expiresAt: string): void {\n    this.db\n      .prepare(\"UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?\")\n      .run(expiresAt, tokenHash);\n  }\n\n  delete(tokenHash: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE token_hash = ?\").run(tokenHash);\n  }\n\n  /** Opportunistically clean up expired sessions (called during login/validation). */\n  deleteExpired(nowIso: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE expires_at < ?\").run(nowIso);\n  }\n\n  /** Clear all sessions for a user (forces re-login after an admin resets the password). */\n  deleteByUser(userId: string): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE user_id = ?\").run(userId);\n  }\n\n  /**\n   * Clear a user's sessions of one kind. Used to end EVERY first-login session when a password\n   * is set: an earlier boot's link may still be live in someone's scrollback, and a `setup`\n   * session may change the password without knowing the old one.\n   */\n  deleteByUserAndVia(userId: string, via: SessionViaValue): void {\n    this.db.prepare(\"DELETE FROM auth_sessions WHERE user_id = ? AND via = ?\").run(userId, via);\n  }\n}\n"],"mappings":";AAOA,SAAS,iBAAiB;AAC1B,OAAO,UAAU;;;ACMV,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ADC1B,IAAM,SAAS,QAAQ,iBAAiB,aAAa;AAW9C,SAAS,qBAAqB,QAA8B;AACjE,QAAM,KAAK,IAAI,OAAO,aAAa,MAAM;AACzC,KAAG,KAAK,2BAA2B;AAEnC,KAAG,KAAK,6BAA6B;AACrC,SAAO;AACT;AAGO,SAAS,aAAa,QAA8B;AACzD,MAAI,WAAW,YAAY;AACzB,cAAU,KAAK,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EACrD;AACA,QAAM,KAAK,IAAI,OAAO,aAAa,MAAM;AACzC,KAAG,KAAK,4BAA4B;AAGpC,KAAG,KAAK,6BAA6B;AACrC,KAAG,KAAK,2BAA2B;AACnC,KAAG,KAAK,UAAU;AAIlB,eAAa,IAAI,YAAY,UAAU,MAAM;AAC7C,eAAa,IAAI,YAAY,aAAa,4BAA4B;AACtE,eAAa,IAAI,YAAY,cAAc,4BAA4B;AACvE,eAAa,IAAI,YAAY,kBAAkB,MAAM;AAGrD,eAAa,IAAI,iBAAiB,OAAO,MAAM;AAC/C,eAAa,IAAI,eAAe,cAAc,MAAM;AACpD,eAAa,IAAI,sBAAsB,oBAAoB,4BAA4B;AACvF,eAAa,IAAI,sBAAsB,oBAAoB,4BAA4B;AAKvF,eAAa,IAAI,sBAAsB,mBAAmB,4BAA4B;AACtF,eAAa,IAAI,sBAAsB,2BAA2B,MAAM;AAIxE,KAAG,KAAK,wCAAwC;AAUhD,KAAG,KAAK,4CAA4C;AACpD,sBAAoB,EAAE;AACtB,SAAO;AACT;AAYA,SAAS,oBAAoB,IAAwB;AACnD,KAAG,KAAK,OAAO;AACf,MAAI;AACF,QAAI,aAAa,IAAI,YAAY,kBAAkB,MAAM,GAAG;AAC1D,SAAG;AAAA,QACD;AAAA;AAAA;AAAA;AAAA,MAIF;AAAA,IACF;AACA,OAAG,KAAK,QAAQ;AAAA,EAClB,SAAS,KAAK;AACZ,OAAG,KAAK,UAAU;AAClB,UAAM;AAAA,EACR;AACF;AAOA,SAAS,aAAa,IAAkB,OAAe,QAAgB,KAAsB;AAC3F,QAAM,OAAO,GAAG,QAAQ,qBAAqB,KAAK,GAAG,EAAE,IAAI;AAC3D,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,EAAG,QAAO;AAChD,KAAG,KAAK,eAAe,KAAK,eAAe,MAAM,IAAI,GAAG,EAAE;AAC1D,SAAO;AACT;;;AE1GA,SAAS,OAAO,GAAqC;AACnD,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,cAAc,EAAE;AAAA,IAChB,SAAU,EAAE,aAAwB;AAAA,IACpC,mBAAoB,EAAE,wBAAmC;AAAA,IACzD,WAAW,EAAE;AAAA,EACf;AACF;AAEO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,IAAkB;AAAlB;AAAA,EAAmB;AAAA,EAAnB;AAAA,EAE7B,OAAO,KAAoB;AACzB,SAAK,GACF;AAAA,MACC;AAAA,IACF,EACC;AAAA,MACC,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,IAAI,UAAU,IAAI;AAAA,MAClB,IAAI,oBAAoB,IAAI;AAAA,MAC5B,IAAI;AAAA,IACN;AAAA,EACJ;AAAA,EAEA,SAAS,QAAgC;AACvC,UAAM,IAAI,KAAK,GAAG,QAAQ,uCAAuC,EAAE,IAAI,MAAM;AAC7E,WAAO,IAAI,OAAO,CAAC,IAAI;AAAA,EACzB;AAAA;AAAA,EAGA,OAAkB;AAChB,UAAM,OAAO,KAAK,GAAG,QAAQ,0DAA0D,EAAE,IAAI;AAC7F,WAAO,KAAK,IAAI,MAAM;AAAA,EACxB;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,KAAK,GAAG,QAAQ,iCAAiC,EAAE,IAAI;AACjE,WAAQ,GAAG,KAAgB;AAAA,EAC7B;AAAA;AAAA,EAGA,eAAe,QAAgB,cAAsB,WAA0B;AAC7E,SAAK,GACF,QAAQ,+EAA+E,EACvF,IAAI,cAAc,YAAY,IAAI,GAAG,MAAM;AAAA,EAChD;AAAA;AAAA,EAGA,OAAO,QAAsB;AAC3B,SAAK,GAAG,QAAQ,qCAAqC,EAAE,IAAI,MAAM;AAAA,EACnE;AACF;;;AChEA,SAAS,YAAY,mBAAmB;AAejC,SAAS,iBAAiB,OAAuB;AACtD,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAkB;AAAlB;AAAA,EAAmB;AAAA,EAAnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7B,MAAM,MAMmC;AACvC,UAAM,QAAQ,KAAK,IAAI,KAAO,KAAK,IAAI,KAAK,OAAO,KAAK,YAAY,KAAK,KAAK,CAAC;AAC/E,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAClD,UAAM,YAAY,KAAK,IAAI,YAAY;AACvC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,YAAY;AACnE,SAAK,cAAc,SAAS;AAC5B,SAAK,OAAO;AAAA,MACV,WAAW,iBAAiB,KAAK;AAAA,MACjC,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,KAAK,KAAK;AAAA,IACZ,CAAC;AACD,WAAO,EAAE,OAAO,UAAU;AAAA,EAC5B;AAAA,EAEA,OAAO,KAA2B;AAChC,SAAK,GACF;AAAA,MACC;AAAA,IACF,EACC,IAAI,IAAI,WAAW,IAAI,QAAQ,IAAI,WAAW,IAAI,WAAW,IAAI,GAAG;AAAA,EACzE;AAAA,EAEA,gBAAgB,WAA0C;AACxD,UAAM,IAAI,KAAK,GAAG,QAAQ,kDAAkD,EAAE,IAAI,SAAS;AAC3F,QAAI,CAAC,EAAG,QAAO;AACf,WAAO;AAAA,MACL,WAAW,EAAE;AAAA,MACb,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,KAAM,EAAE,OAAkC;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WAAmB,WAAyB;AAChD,SAAK,GACF,QAAQ,8DAA8D,EACtE,IAAI,WAAW,SAAS;AAAA,EAC7B;AAAA,EAEA,OAAO,WAAyB;AAC9B,SAAK,GAAG,QAAQ,gDAAgD,EAAE,IAAI,SAAS;AAAA,EACjF;AAAA;AAAA,EAGA,cAAc,QAAsB;AAClC,SAAK,GAAG,QAAQ,gDAAgD,EAAE,IAAI,MAAM;AAAA,EAC9E;AAAA;AAAA,EAGA,aAAa,QAAsB;AACjC,SAAK,GAAG,QAAQ,6CAA6C,EAAE,IAAI,MAAM;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,QAAgB,KAA4B;AAC7D,SAAK,GAAG,QAAQ,yDAAyD,EAAE,IAAI,QAAQ,GAAG;AAAA,EAC5F;AACF;","names":[]}