@proletariat/cli 0.3.93 → 0.3.95

package/dist/lib/dashboard/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/lib/dashboard/html.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAwpBD,CAAA;AACR,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/lib/dashboard/html.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2SD,CAAA;AACR,CAAC"}

package/dist/lib/database/credential-store.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Credential Store
+ *
+ * Stores API keys and tokens in a separate credentials.db file
+ * that is NOT mounted into agent containers. This prevents agents
+ * from reading or leaking credentials.
+ *
+ * Credentials are stored at {workspacePath}/.proletariat-credentials/credentials.db
+ * while the main workspace.db lives at {workspacePath}/.proletariat/workspace.db.
+ * Only .proletariat/ is mounted into containers, keeping credentials isolated.
+ *
+ * PRLT-1114: Agent secret isolation
+ */
+import Database from 'better-sqlite3';
+/**
+ * Check if a workspace_settings key stores a credential (API key or token).
+ */
+export declare function isCredentialKey(key: string): boolean;
+/**
+ * Get the path to the credentials database for a workspace.
+ */
+export declare function getCredentialDatabasePath(workspacePath: string): string;
+/**
+ * Get a credential value, with automatic migration from workspace.db.
+ *
+ * Resolution order:
+ * 1. Check credentials.db (if available)
+ * 2. Fall back to workspace.db (for backward compatibility)
+ * 3. If found in workspace.db, migrate to credentials.db and delete from workspace.db
+ *
+ * In agent containers, credentials.db won't exist and workspace.db will have
+ * credentials removed — so this returns null, which is the desired behavior.
+ *
+ * For in-memory databases (tests), falls back to workspace_settings directly
+ * since there's no filesystem path to store credentials.db.
+ */
+export declare function getCredential(workspaceDb: Database.Database, key: string): string | null;
+/**
+ * Set a credential value. Always writes to credentials.db.
+ * Also removes from workspace.db if present (migration cleanup).
+ * For in-memory databases (tests), writes to workspace_settings directly.
+ */
+export declare function setCredential(workspaceDb: Database.Database, key: string, value: string): void;
+/**
+ * Delete a credential from both credentials.db and workspace.db.
+ * For in-memory databases (tests), deletes from workspace_settings directly.
+ */
+export declare function deleteCredential(workspaceDb: Database.Database, key: string): void;
+/**
+ * Check if a credential exists in either credentials.db or workspace.db.
+ */
+export declare function hasCredential(workspaceDb: Database.Database, key: string): boolean;
+/**
+ * Close all cached credential database connections.
+ * Call this during cleanup/shutdown.
+ */
+export declare function closeAllCredentialStores(): void;
+/**
+ * Eagerly migrate all known credential keys from workspace.db to credentials.db.
+ * This is safe to call multiple times (idempotent).
+ * Useful during workspace open to proactively move all credentials out.
+ * No-op for in-memory databases (tests).
+ */
+export declare function migrateCredentials(workspaceDb: Database.Database): void;

package/dist/lib/database/credential-store.js

@@ -0,0 +1,306 @@
+/**
+ * Credential Store
+ *
+ * Stores API keys and tokens in a separate credentials.db file
+ * that is NOT mounted into agent containers. This prevents agents
+ * from reading or leaking credentials.
+ *
+ * Credentials are stored at {workspacePath}/.proletariat-credentials/credentials.db
+ * while the main workspace.db lives at {workspacePath}/.proletariat/workspace.db.
+ * Only .proletariat/ is mounted into containers, keeping credentials isolated.
+ *
+ * PRLT-1114: Agent secret isolation
+ */
+import Database from 'better-sqlite3';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const CREDENTIALS_TABLE = 'credentials';
+/** Known credential setting keys that must be stored in credentials.db */
+const CREDENTIAL_KEYS = new Set([
+    'linear.api_key',
+    'jira.api_token',
+    'asana.access_token',
+    'trello.api_key',
+    'trello.api_token',
+    'shortcut.api_token',
+    'monday.api_token',
+    'clickup.api_key',
+]);
+/**
+ * Check if a workspace_settings key stores a credential (API key or token).
+ */
+export function isCredentialKey(key) {
+    return CREDENTIAL_KEYS.has(key);
+}
+/**
+ * Get the path to the credentials database for a workspace.
+ */
+export function getCredentialDatabasePath(workspacePath) {
+    return path.join(workspacePath, '.proletariat-credentials', 'credentials.db');
+}
+/**
+ * Derive the workspace root path from a workspace.db Database instance.
+ * workspace.db is at {workspacePath}/.proletariat/workspace.db
+ * Returns empty string for in-memory databases (used in tests).
+ */
+function deriveWorkspacePath(db) {
+    const dbName = db.name;
+    // In-memory or unnamed databases don't have a filesystem path
+    if (!dbName || dbName === ':memory:' || dbName === '')
+        return '';
+    return path.dirname(path.dirname(dbName));
+}
+/**
+ * Open or create the credentials database.
+ * Creates the directory and schema if they don't exist.
+ */
+function openCredentialDb(workspacePath) {
+    const dbPath = getCredentialDatabasePath(workspacePath);
+    const dir = path.dirname(dbPath);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    const credDb = new Database(dbPath);
+    credDb.pragma('journal_mode = WAL');
+    credDb.pragma('foreign_keys = ON');
+    credDb.pragma('busy_timeout = 5000');
+    credDb.exec(`
+    CREATE TABLE IF NOT EXISTS ${CREDENTIALS_TABLE} (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    )
+  `);
+    return credDb;
+}
+// Cache open credential db connections keyed by workspace path
+const credentialDbCache = new Map();
+/**
+ * Get a cached credential database connection.
+ * Returns null if credentials.db cannot be opened (e.g., in agent containers
+ * where the credentials directory is not mounted).
+ */
+function getCachedCredentialDb(workspacePath, autoCreate) {
+    const cached = credentialDbCache.get(workspacePath);
+    if (cached) {
+        try {
+            cached.pragma('journal_mode');
+            return cached;
+        }
+        catch {
+            credentialDbCache.delete(workspacePath);
+        }
+    }
+    const dbPath = getCredentialDatabasePath(workspacePath);
+    const dir = path.dirname(dbPath);
+    // If the credentials directory doesn't exist and we're not auto-creating,
+    // return null. This is expected in agent containers where only .proletariat/
+    // is mounted, not .proletariat-credentials/.
+    if (!autoCreate && !fs.existsSync(dir)) {
+        return null;
+    }
+    try {
+        const credDb = openCredentialDb(workspacePath);
+        credentialDbCache.set(workspacePath, credDb);
+        return credDb;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get a credential value, with automatic migration from workspace.db.
+ *
+ * Resolution order:
+ * 1. Check credentials.db (if available)
+ * 2. Fall back to workspace.db (for backward compatibility)
+ * 3. If found in workspace.db, migrate to credentials.db and delete from workspace.db
+ *
+ * In agent containers, credentials.db won't exist and workspace.db will have
+ * credentials removed — so this returns null, which is the desired behavior.
+ *
+ * For in-memory databases (tests), falls back to workspace_settings directly
+ * since there's no filesystem path to store credentials.db.
+ */
+export function getCredential(workspaceDb, key) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        try {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            return row?.value ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    // Check credentials.db first (don't auto-create just for reads)
+    const credDb = getCachedCredentialDb(workspacePath, false);
+    if (credDb) {
+        const row = credDb
+            .prepare(`SELECT value FROM ${CREDENTIALS_TABLE} WHERE key = ?`)
+            .get(key);
+        if (row)
+            return row.value;
+    }
+    // Fall back to workspace.db (backward compatibility + auto-migration)
+    let fallbackValue = null;
+    try {
+        const fallbackRow = workspaceDb
+            .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+            .get(key);
+        fallbackValue = fallbackRow?.value ?? null;
+    }
+    catch {
+        // workspace.db may not have the table yet
+    }
+    if (fallbackValue) {
+        // Auto-migrate: move credential to credentials.db (auto-create on write)
+        const writeDb = getCachedCredentialDb(workspacePath, true);
+        if (writeDb) {
+            writeDb
+                .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+                .run(key, fallbackValue);
+        }
+        // Remove from workspace.db so agents can't see it
+        try {
+            workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+        }
+        catch {
+            // workspace.db may be read-only in containers
+        }
+        return fallbackValue;
+    }
+    return null;
+}
+/**
+ * Set a credential value. Always writes to credentials.db.
+ * Also removes from workspace.db if present (migration cleanup).
+ * For in-memory databases (tests), writes to workspace_settings directly.
+ */
+export function setCredential(workspaceDb, key, value) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        workspaceDb.prepare(`
+      INSERT INTO workspace_settings (key, value)
+      VALUES (?, ?)
+      ON CONFLICT(key) DO UPDATE SET value = excluded.value
+    `).run(key, value);
+        return;
+    }
+    const credDb = getCachedCredentialDb(workspacePath, true);
+    if (!credDb) {
+        throw new Error(`Cannot open credential store at ${getCredentialDatabasePath(workspacePath)}`);
+    }
+    credDb
+        .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+        .run(key, value);
+    // Clean up from workspace.db if it was there
+    try {
+        workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+    }
+    catch {
+        // workspace.db may be read-only in containers
+    }
+}
+/**
+ * Delete a credential from both credentials.db and workspace.db.
+ * For in-memory databases (tests), deletes from workspace_settings directly.
+ */
+export function deleteCredential(workspaceDb, key) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    // In-memory databases (tests) — use workspace_settings directly
+    if (!workspacePath) {
+        try {
+            workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+        }
+        catch {
+            // Table may not exist
+        }
+        return;
+    }
+    const credDb = getCachedCredentialDb(workspacePath, false);
+    if (credDb) {
+        credDb.prepare(`DELETE FROM ${CREDENTIALS_TABLE} WHERE key = ?`).run(key);
+    }
+    // Also delete from workspace.db in case it's still there
+    try {
+        workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+    }
+    catch {
+        // workspace.db may be read-only
+    }
+}
+/**
+ * Check if a credential exists in either credentials.db or workspace.db.
+ */
+export function hasCredential(workspaceDb, key) {
+    return getCredential(workspaceDb, key) !== null;
+}
+/**
+ * Close all cached credential database connections.
+ * Call this during cleanup/shutdown.
+ */
+export function closeAllCredentialStores() {
+    for (const [, db] of credentialDbCache) {
+        try {
+            db.close();
+        }
+        catch {
+            // Ignore close errors
+        }
+    }
+    credentialDbCache.clear();
+}
+/**
+ * Eagerly migrate all known credential keys from workspace.db to credentials.db.
+ * This is safe to call multiple times (idempotent).
+ * Useful during workspace open to proactively move all credentials out.
+ * No-op for in-memory databases (tests).
+ */
+export function migrateCredentials(workspaceDb) {
+    const workspacePath = deriveWorkspacePath(workspaceDb);
+    if (!workspacePath)
+        return; // In-memory databases (tests)
+    // Check if any credentials exist in workspace.db
+    let hasAny = false;
+    try {
+        for (const key of CREDENTIAL_KEYS) {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            if (row) {
+                hasAny = true;
+                break;
+            }
+        }
+    }
+    catch {
+        return; // workspace_settings table may not exist
+    }
+    if (!hasAny)
+        return;
+    // Open/create credentials.db and migrate
+    const credDb = getCachedCredentialDb(workspacePath, true);
+    if (!credDb)
+        return;
+    for (const key of CREDENTIAL_KEYS) {
+        try {
+            const row = workspaceDb
+                .prepare('SELECT value FROM workspace_settings WHERE key = ?')
+                .get(key);
+            if (row) {
+                credDb
+                    .prepare(`INSERT OR REPLACE INTO ${CREDENTIALS_TABLE} (key, value) VALUES (?, ?)`)
+                    .run(key, row.value);
+                workspaceDb.prepare('DELETE FROM workspace_settings WHERE key = ?').run(key);
+            }
+        }
+        catch {
+            // Skip individual key failures
+        }
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/lib/database/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/lib/database/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAEvC,0EAA0E;AAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,0BAA0B,EAAE,gBAAgB,CAAC,CAAA;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,EAAqB;IAChD,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAA;IACtB,8DAA8D;IAC9D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAClC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAEpC,MAAM,CAAC,IAAI,CAAC;iCACmB,iBAAiB;;;;GAI/C,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6B,CAAA;AAE9D;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,aAAqB,EAAE,UAAmB;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YAC7B,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhC,0EAA0E;IAC1E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAC9C,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW;IACvE,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM;aACf,OAAO,CAAC,qBAAqB,iBAAiB,gBAAgB,CAAC;aAC/D,GAAG,CAAC,GAAG,CAAkC,CAAA;QAC5C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,CAAA;IAC3B,CAAC;IAED,sEAAsE;IACtE,IAAI,aAAa,GAAkB,IAAI,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,WAAW;aAC5B,OAAO,CAAC,oDAAoD,CAAC;aAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;QAC5C,aAAa,GAAG,WAAW,EAAE,KAAK,IAAI,IAAI,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,yEAAyE;QACzE,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;iBACJ,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;iBACjF,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QAC5B,CAAC;QACD,kDAAkD;QAClD,IAAI,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW,EAAE,KAAa;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,WAAW,CAAC,OAAO,CAAC;;;;KAInB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,MAAM;SACH,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;SACjF,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAElB,6CAA6C;IAC7C,IAAI,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA8B,EAAE,GAAW;IAC1E,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAEtD,gEAAgE;IAChE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,eAAe,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,WAA8B,EAAE,GAAW;IACvE,OAAO,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,aAAa;QAAE,OAAM,CAAC,8BAA8B;IAEzD,iDAAiD;IACjD,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,GAAG,IAAI,CAAA;gBACb,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAM,CAAC,yCAAyC;IAClD,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,yCAAyC;IACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM;QAAE,OAAM;IAEnB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW;iBACpB,OAAO,CAAC,oDAAoD,CAAC;iBAC7D,GAAG,CAAC,GAAG,CAAkC,CAAA;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM;qBACH,OAAO,CAAC,0BAA0B,iBAAiB,6BAA6B,CAAC;qBACjF,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACtB,WAAW,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/database/db-safety.d.ts

@@ -3,11 +3,12 @@
  *
  * Provides:
  * - WAL journal mode configuration
- * - Rotating backup (keeps last 5 copies)
+ * - Timestamped backup in .proletariat/backups/ (keeps last 5)
  * - Integrity check on open with auto-recovery
  * - Manual repair via dump/reimport
+ * - Migration of legacy scattered backup files
  *
- * See: PRLT-1081
+ * See: PRLT-1081, PRLT-1154
  */
 import Database from 'better-sqlite3';
 /**
@@ -16,18 +17,56 @@ import Database from 'better-sqlite3';
  * more resistant to corruption than the default journal_mode=delete.
  */
 export declare function enableWALMode(db: Database.Database): void;
+/**
+ * Get the backups directory for a given database path.
+ * The backups directory is always a sibling `backups/` directory
+ * relative to the database file (e.g., `.proletariat/backups/`).
+ */
+export declare function getBackupsDir(dbPath: string): string;
 /**
  * Get the backup path for a given database path and backup number.
+ * Backups are stored in the backups/ directory with timestamps.
+ *
+ * For numbered access (used by backup restore), returns a path
+ * based on sorted backup files in the directory.
+ * Returns null if the backup doesn't exist.
  */
-export declare function getBackupPath(dbPath: string, n: number): string;
+export declare function getBackupPath(dbPath: string, n: number): string | null;
 /**
- * Create a rotating backup of the database file.
- * Keeps the last MAX_BACKUPS copies, numbered 1 (newest) through MAX_BACKUPS (oldest).
- * Rotates existing backups before copying the current database.
+ * Create a timestamped backup of the database file in the backups/ directory.
+ * Keeps the last MAX_BACKUPS copies, deletes older ones.
  *
- * Returns true if backup was created, false if source didn't exist.
+ * Returns the backup path if created, null if source didn't exist.
+ */
+export declare function createRotatingBackup(dbPath: string): string | null;
+/**
+ * Create a manual backup with an optional label.
+ * Unlike auto-backups, manual backups include a "manual" prefix.
+ * Returns the backup path.
+ */
+export declare function createManualBackup(dbPath: string, label?: string): string | null;
+/**
+ * Migrate legacy backup files from the .proletariat/ top level into backups/.
+ *
+ * Handles:
+ * - workspace.db.backup (plain backup)
+ * - workspace.db.backup-YYYYMMDD-HHMMSS (timestamped backups)
+ * - workspace.db.backup.N (numbered backups with -wal/-shm companions)
+ * - workspace.db.corrupt (corrupt file preservations)
+ *
+ * Called on first run after upgrade. Safe to call multiple times.
+ */
+export declare function migrateExistingBackups(dbPath: string): void;
+/**
+ * List all backup entries with metadata, sorted newest-first.
+ * Used by the repair and backup commands to display backup info.
  */
-export declare function createRotatingBackup(dbPath: string): boolean;
+export declare function listBackups(dbPath: string): Array<{
+    path: string;
+    filename: string;
+    size: number;
+    mtime: Date;
+}>;
 export interface IntegrityCheckResult {
     ok: boolean;
     errors: string[];
@@ -54,6 +93,6 @@ export interface RepairResult {
  * 1. Try dump/reimport — opens the corrupt DB, dumps all SQL, creates a new DB
  * 2. If dump fails, fall back to the most recent backup
  *
- * The original corrupt file is preserved as dbPath.corrupt for forensics.
+ * The original corrupt file is preserved in backups/ for forensics.
  */
 export declare function repairDatabase(dbPath: string): RepairResult;