@proletariat/cli 0.3.94 → 0.3.96

package/dist/lib/dashboard/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/lib/dashboard/html.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAwpBD,CAAA;AACR,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../src/lib/dashboard/html.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2SD,CAAA;AACR,CAAC"}

package/dist/lib/database/db-safety.d.ts

@@ -3,11 +3,12 @@
  *
  * Provides:
  * - WAL journal mode configuration
- * - Rotating backup (keeps last 5 copies)
+ * - Timestamped backup in .proletariat/backups/ (keeps last 5)
  * - Integrity check on open with auto-recovery
  * - Manual repair via dump/reimport
+ * - Migration of legacy scattered backup files
  *
- * See: PRLT-1081
+ * See: PRLT-1081, PRLT-1154
  */
 import Database from 'better-sqlite3';
 /**
@@ -16,18 +17,56 @@ import Database from 'better-sqlite3';
  * more resistant to corruption than the default journal_mode=delete.
  */
 export declare function enableWALMode(db: Database.Database): void;
+/**
+ * Get the backups directory for a given database path.
+ * The backups directory is always a sibling `backups/` directory
+ * relative to the database file (e.g., `.proletariat/backups/`).
+ */
+export declare function getBackupsDir(dbPath: string): string;
 /**
  * Get the backup path for a given database path and backup number.
+ * Backups are stored in the backups/ directory with timestamps.
+ *
+ * For numbered access (used by backup restore), returns a path
+ * based on sorted backup files in the directory.
+ * Returns null if the backup doesn't exist.
  */
-export declare function getBackupPath(dbPath: string, n: number): string;
+export declare function getBackupPath(dbPath: string, n: number): string | null;
 /**
- * Create a rotating backup of the database file.
- * Keeps the last MAX_BACKUPS copies, numbered 1 (newest) through MAX_BACKUPS (oldest).
- * Rotates existing backups before copying the current database.
+ * Create a timestamped backup of the database file in the backups/ directory.
+ * Keeps the last MAX_BACKUPS copies, deletes older ones.
+ *
+ * Returns the backup path if created, null if source didn't exist.
+ */
+export declare function createRotatingBackup(dbPath: string): string | null;
+/**
+ * Create a manual backup with an optional label.
+ * Unlike auto-backups, manual backups include a "manual" prefix.
+ * Returns the backup path.
+ */
+export declare function createManualBackup(dbPath: string, label?: string): string | null;
+/**
+ * Migrate legacy backup files from the .proletariat/ top level into backups/.
+ *
+ * Handles:
+ * - workspace.db.backup (plain backup)
+ * - workspace.db.backup-YYYYMMDD-HHMMSS (timestamped backups)
+ * - workspace.db.backup.N (numbered backups with -wal/-shm companions)
+ * - workspace.db.corrupt (corrupt file preservations)
  *
- * Returns true if backup was created, false if source didn't exist.
+ * Called on first run after upgrade. Safe to call multiple times.
  */
-export declare function createRotatingBackup(dbPath: string): boolean;
+export declare function migrateExistingBackups(dbPath: string): void;
+/**
+ * List all backup entries with metadata, sorted newest-first.
+ * Used by the repair and backup commands to display backup info.
+ */
+export declare function listBackups(dbPath: string): Array<{
+    path: string;
+    filename: string;
+    size: number;
+    mtime: Date;
+}>;
 export interface IntegrityCheckResult {
     ok: boolean;
     errors: string[];
@@ -42,6 +81,28 @@ export declare function checkIntegrity(db: Database.Database): IntegrityCheckRes
  * Skips checking that the contents of table rows match the indexes.
  */
 export declare function quickCheckIntegrity(db: Database.Database): IntegrityCheckResult;
+export interface SchemaCheckResult {
+    ok: boolean;
+    missingTables: string[];
+    missingColumns: Array<{
+        table: string;
+        column: string;
+    }>;
+}
+/**
+ * Check schema completeness — verify all expected columns exist in all tables.
+ *
+ * Builds the expected schema in a temporary in-memory database from the
+ * canonical CREATE TABLE definitions, then compares actual columns via
+ * PRAGMA table_info(). Only checks tables that already exist in the target
+ * database (PMO tables are skipped if PMO is not initialized).
+ *
+ * This catches the case where PRAGMA integrity_check returns "ok" but
+ * the schema is missing columns added in later migrations.
+ *
+ * See: PRLT-1131
+ */
+export declare function checkSchemaCompleteness(db: Database.Database): SchemaCheckResult;
 export interface RepairResult {
     success: boolean;
     method: 'dump-reimport' | 'backup-restore' | 'none';
@@ -54,6 +115,6 @@ export interface RepairResult {
  * 1. Try dump/reimport — opens the corrupt DB, dumps all SQL, creates a new DB
  * 2. If dump fails, fall back to the most recent backup
  *
- * The original corrupt file is preserved as dbPath.corrupt for forensics.
+ * The original corrupt file is preserved in backups/ for forensics.
  */
 export declare function repairDatabase(dbPath: string): RepairResult;

package/dist/lib/database/db-safety.js

@@ -3,15 +3,18 @@
  *
  * Provides:
  * - WAL journal mode configuration
- * - Rotating backup (keeps last 5 copies)
+ * - Timestamped backup in .proletariat/backups/ (keeps last 5)
  * - Integrity check on open with auto-recovery
  * - Manual repair via dump/reimport
+ * - Migration of legacy scattered backup files
  *
- * See: PRLT-1081
+ * See: PRLT-1081, PRLT-1154
  */
 import Database from 'better-sqlite3';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { CREATE_TABLES_SQL } from './workspace-schema.js';
+import { PMO_TABLE_SCHEMAS } from '../pmo/schema.js';
 const MAX_BACKUPS = 5;
 /**
  * Enable WAL journal mode on a database connection.
@@ -21,53 +24,314 @@ const MAX_BACKUPS = 5;
 export function enableWALMode(db) {
     db.pragma('journal_mode = WAL');
 }
+/**
+ * Get the backups directory for a given database path.
+ * The backups directory is always a sibling `backups/` directory
+ * relative to the database file (e.g., `.proletariat/backups/`).
+ */
+export function getBackupsDir(dbPath) {
+    return path.join(path.dirname(dbPath), 'backups');
+}
 /**
  * Get the backup path for a given database path and backup number.
+ * Backups are stored in the backups/ directory with timestamps.
+ *
+ * For numbered access (used by backup restore), returns a path
+ * based on sorted backup files in the directory.
+ * Returns null if the backup doesn't exist.
  */
 export function getBackupPath(dbPath, n) {
-    return `${dbPath}.backup.${n}`;
+    const backupsDir = getBackupsDir(dbPath);
+    if (!fs.existsSync(backupsDir)) {
+        return null;
+    }
+    const backups = listBackupFiles(backupsDir);
+    if (n < 1 || n > backups.length) {
+        return null;
+    }
+    // backups are sorted newest-first, so n=1 is the most recent
+    return backups[n - 1];
+}
+/**
+ * List backup files in the backups directory, sorted newest-first.
+ * Only returns .db files (excludes -wal, -shm, and .corrupt files).
+ */
+function listBackupFiles(backupsDir) {
+    if (!fs.existsSync(backupsDir)) {
+        return [];
+    }
+    const files = fs.readdirSync(backupsDir)
+        .filter(f => f.endsWith('.db') && !f.endsWith('.corrupt.db'))
+        .map(f => path.join(backupsDir, f))
+        .sort((a, b) => {
+        // Sort by filename descending (newest first).
+        // Filenames encode timestamps (workspace-YYYYMMDD-HHMMSS-mmm.db)
+        // so lexicographic order matches chronological order.
+        return path.basename(b).localeCompare(path.basename(a));
+    });
+    return files;
+}
+/**
+ * Generate a unique timestamped backup filename.
+ * Checks the backups directory to avoid filename collisions.
+ */
+function generateUniqueBackupPath(backupsDir, prefix = 'workspace') {
+    const ts = formatTimestamp(new Date());
+    const baseName = `${prefix}-${ts}`;
+    const candidate = path.join(backupsDir, `${baseName}.db`);
+    if (!fs.existsSync(candidate)) {
+        return candidate;
+    }
+    // If collision, append a counter
+    for (let i = 1; i < 100; i++) {
+        const alt = path.join(backupsDir, `${baseName}-${i}.db`);
+        if (!fs.existsSync(alt)) {
+            return alt;
+        }
+    }
+    // Extremely unlikely fallback
+    return path.join(backupsDir, `${baseName}-${Date.now()}.db`);
 }
 /**
- * Create a rotating backup of the database file.
- * Keeps the last MAX_BACKUPS copies, numbered 1 (newest) through MAX_BACKUPS (oldest).
- * Rotates existing backups before copying the current database.
+ * Create a timestamped backup of the database file in the backups/ directory.
+ * Keeps the last MAX_BACKUPS copies, deletes older ones.
  *
- * Returns true if backup was created, false if source didn't exist.
+ * Returns the backup path if created, null if source didn't exist.
  */
 export function createRotatingBackup(dbPath) {
     if (!fs.existsSync(dbPath)) {
-        return false;
+        return null;
+    }
+    const backupsDir = getBackupsDir(dbPath);
+    fs.mkdirSync(backupsDir, { recursive: true });
+    const backupPath = generateUniqueBackupPath(backupsDir);
+    // Copy current database as timestamped backup
+    try {
+        fs.copyFileSync(dbPath, backupPath);
+        // Also copy WAL and SHM files if they exist (for WAL-mode databases)
+        const walPath = `${dbPath}-wal`;
+        const shmPath = `${dbPath}-shm`;
+        if (fs.existsSync(walPath)) {
+            fs.copyFileSync(walPath, `${backupPath}-wal`);
+        }
+        if (fs.existsSync(shmPath)) {
+            fs.copyFileSync(shmPath, `${backupPath}-shm`);
+        }
     }
-    // Rotate existing backups: delete oldest, shift others up
-    const oldest = getBackupPath(dbPath, MAX_BACKUPS);
-    if (fs.existsSync(oldest)) {
-        fs.unlinkSync(oldest);
+    catch {
+        // Backup failure is not fatal — log and continue
+        return null;
     }
-    for (let i = MAX_BACKUPS - 1; i >= 1; i--) {
-        const src = getBackupPath(dbPath, i);
-        const dst = getBackupPath(dbPath, i + 1);
-        if (fs.existsSync(src)) {
-            fs.renameSync(src, dst);
+    // Rotate: delete older backups beyond MAX_BACKUPS
+    rotateBackups(backupsDir);
+    return backupPath;
+}
+/**
+ * Delete older backups beyond MAX_BACKUPS.
+ * Keeps the newest MAX_BACKUPS .db files, deletes the rest
+ * (along with their -wal and -shm companions).
+ */
+function rotateBackups(backupsDir) {
+    const backups = listBackupFiles(backupsDir);
+    // Keep the first MAX_BACKUPS, delete the rest
+    for (let i = MAX_BACKUPS; i < backups.length; i++) {
+        const bp = backups[i];
+        try {
+            fs.unlinkSync(bp);
+            // Also clean up WAL and SHM companions
+            for (const suffix of ['-wal', '-shm']) {
+                const companion = `${bp}${suffix}`;
+                if (fs.existsSync(companion)) {
+                    fs.unlinkSync(companion);
+                }
+            }
+        }
+        catch {
+            // Best-effort cleanup
         }
     }
-    // Copy current database as backup.1 (newest)
+}
+/**
+ * Create a manual backup with an optional label.
+ * Unlike auto-backups, manual backups include a "manual" prefix.
+ * Returns the backup path.
+ */
+export function createManualBackup(dbPath, label) {
+    if (!fs.existsSync(dbPath)) {
+        return null;
+    }
+    const backupsDir = getBackupsDir(dbPath);
+    fs.mkdirSync(backupsDir, { recursive: true });
+    const suffix = label ? `-${label}` : '';
+    const backupPath = generateUniqueBackupPath(backupsDir, `workspace-manual${suffix}`);
     try {
-        fs.copyFileSync(dbPath, getBackupPath(dbPath, 1));
-        // Also copy WAL and SHM files if they exist (for WAL-mode databases)
+        fs.copyFileSync(dbPath, backupPath);
         const walPath = `${dbPath}-wal`;
         const shmPath = `${dbPath}-shm`;
         if (fs.existsSync(walPath)) {
-            fs.copyFileSync(walPath, `${getBackupPath(dbPath, 1)}-wal`);
+            fs.copyFileSync(walPath, `${backupPath}-wal`);
         }
         if (fs.existsSync(shmPath)) {
-            fs.copyFileSync(shmPath, `${getBackupPath(dbPath, 1)}-shm`);
+            fs.copyFileSync(shmPath, `${backupPath}-shm`);
         }
-        return true;
+        return backupPath;
     }
     catch {
-        // Backup failure is not fatal — log and continue
+        return null;
+    }
+}
+/**
+ * Migrate legacy backup files from the .proletariat/ top level into backups/.
+ *
+ * Handles:
+ * - workspace.db.backup (plain backup)
+ * - workspace.db.backup-YYYYMMDD-HHMMSS (timestamped backups)
+ * - workspace.db.backup.N (numbered backups with -wal/-shm companions)
+ * - workspace.db.corrupt (corrupt file preservations)
+ *
+ * Called on first run after upgrade. Safe to call multiple times.
+ */
+export function migrateExistingBackups(dbPath) {
+    const proletariatDir = path.dirname(dbPath);
+    const backupsDir = getBackupsDir(dbPath);
+    const dbBasename = path.basename(dbPath); // workspace.db
+    let files;
+    try {
+        files = fs.readdirSync(proletariatDir);
+    }
+    catch {
+        return;
+    }
+    // Find legacy backup/corrupt files at the top level
+    const legacyFiles = files.filter(f => {
+        // Match workspace.db.backup*, workspace.db.corrupt*
+        if (f.startsWith(`${dbBasename}.backup`) || f.startsWith(`${dbBasename}.corrupt`)) {
+            return true;
+        }
+        // Match workspace.db.repair-temp (leftover from failed repairs)
+        if (f === `${dbBasename}.repair-temp`) {
+            return true;
+        }
         return false;
+    });
+    if (legacyFiles.length === 0) {
+        return;
     }
+    // Ensure backups directory exists
+    fs.mkdirSync(backupsDir, { recursive: true });
+    for (const file of legacyFiles) {
+        const srcPath = path.join(proletariatDir, file);
+        let destName;
+        if (file.endsWith('.corrupt') || file.includes('.corrupt')) {
+            // Corrupt files → workspace-corrupt-TIMESTAMP.db or just move as-is
+            const stat = fs.statSync(srcPath);
+            const ts = formatTimestamp(stat.mtime);
+            destName = `workspace-corrupt-${ts}.db`;
+        }
+        else if (file === `${dbBasename}.backup`) {
+            // Plain backup → workspace-migrated-TIMESTAMP.db
+            const stat = fs.statSync(srcPath);
+            const ts = formatTimestamp(stat.mtime);
+            destName = `workspace-migrated-${ts}.db`;
+        }
+        else if (file.match(/\.backup-\d{8}-\d{6}$/)) {
+            // Timestamped backup (workspace.db.backup-20260106-112422)
+            const match = file.match(/\.backup-(\d{8}-\d{6})$/);
+            destName = `workspace-migrated-${match[1]}.db`;
+        }
+        else if (file.match(/\.backup\.\d+$/)) {
+            // Numbered backup (workspace.db.backup.1)
+            const stat = fs.statSync(srcPath);
+            const ts = formatTimestamp(stat.mtime);
+            destName = `workspace-migrated-${ts}.db`;
+        }
+        else if (file.match(/\.backup\.\d+-(wal|shm)$/)) {
+            // WAL/SHM companion for numbered backup — these follow their .db file
+            // Skip them here; they'll be handled when we move the main backup
+            continue;
+        }
+        else if (file === `${dbBasename}.repair-temp`) {
+            // Leftover repair temp file — just move it
+            destName = 'workspace-repair-temp.db';
+        }
+        else {
+            // Fallback: use file modification time
+            const stat = fs.statSync(srcPath);
+            const ts = formatTimestamp(stat.mtime);
+            destName = `workspace-legacy-${ts}.db`;
+        }
+        const destPath = path.join(backupsDir, destName);
+        // Don't overwrite existing files in backups/
+        if (fs.existsSync(destPath)) {
+            // Add a suffix to avoid collision
+            const ext = path.extname(destName);
+            const base = destName.slice(0, -ext.length);
+            const uniqueDest = path.join(backupsDir, `${base}-${Date.now()}${ext}`);
+            try {
+                fs.renameSync(srcPath, uniqueDest);
+            }
+            catch {
+                // Best-effort migration
+            }
+        }
+        else {
+            try {
+                fs.renameSync(srcPath, destPath);
+            }
+            catch {
+                // Best-effort migration
+            }
+        }
+        // Also move WAL/SHM companions if they exist
+        for (const suffix of ['-wal', '-shm']) {
+            const companionSrc = `${srcPath}${suffix}`;
+            if (fs.existsSync(companionSrc)) {
+                const companionDest = `${destPath}${suffix}`;
+                try {
+                    fs.renameSync(companionSrc, companionDest);
+                }
+                catch {
+                    // Best-effort
+                }
+            }
+        }
+    }
+    // After migration, rotate to keep only MAX_BACKUPS
+    rotateBackups(backupsDir);
+}
+/**
+ * Format a Date as YYYYMMDD-HHMMSS-mmm for backup filenames.
+ * Includes milliseconds to avoid collisions when called multiple times per second.
+ */
+function formatTimestamp(date) {
+    return [
+        date.getFullYear(),
+        String(date.getMonth() + 1).padStart(2, '0'),
+        String(date.getDate()).padStart(2, '0'),
+        '-',
+        String(date.getHours()).padStart(2, '0'),
+        String(date.getMinutes()).padStart(2, '0'),
+        String(date.getSeconds()).padStart(2, '0'),
+        '-',
+        String(date.getMilliseconds()).padStart(3, '0'),
+    ].join('');
+}
+/**
+ * List all backup entries with metadata, sorted newest-first.
+ * Used by the repair and backup commands to display backup info.
+ */
+export function listBackups(dbPath) {
+    const backupsDir = getBackupsDir(dbPath);
+    const backups = listBackupFiles(backupsDir);
+    return backups.map(bp => {
+        const stat = fs.statSync(bp);
+        return {
+            path: bp,
+            filename: path.basename(bp),
+            size: stat.size,
+            mtime: stat.mtime,
+        };
+    });
 }
 /**
  * Run PRAGMA integrity_check on a database.
@@ -107,6 +371,91 @@ export function quickCheckIntegrity(db) {
         };
     }
 }
+/**
+ * Check schema completeness — verify all expected columns exist in all tables.
+ *
+ * Builds the expected schema in a temporary in-memory database from the
+ * canonical CREATE TABLE definitions, then compares actual columns via
+ * PRAGMA table_info(). Only checks tables that already exist in the target
+ * database (PMO tables are skipped if PMO is not initialized).
+ *
+ * This catches the case where PRAGMA integrity_check returns "ok" but
+ * the schema is missing columns added in later migrations.
+ *
+ * See: PRLT-1131
+ */
+export function checkSchemaCompleteness(db) {
+    let expected = null;
+    try {
+        // Build expected schema in a temporary in-memory database
+        expected = new Database(':memory:');
+        expected.exec(CREATE_TABLES_SQL);
+        // Only check PMO tables if PMO is initialized in the actual database
+        const hasPMO = !!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='pmo_projects'").get();
+        if (hasPMO) {
+            for (const sql of Object.values(PMO_TABLE_SCHEMAS)) {
+                try {
+                    expected.exec(sql);
+                }
+                catch {
+                    // Some PMO tables may have FK references that fail in the
+                    // isolated in-memory DB — skip those; the column check on
+                    // tables that DO exist is still valuable.
+                }
+            }
+        }
+        // Get all expected tables from the reference database
+        const expectedTables = expected.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+        const missingTables = [];
+        const missingColumns = [];
+        for (const { name: table } of expectedTables) {
+            // Check if table exists in actual database
+            const actualTable = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(table);
+            if (!actualTable) {
+                // Only report core workspace tables as missing.
+                // PMO tables may legitimately not exist if PMO was partially initialized.
+                const coreWorkspaceTables = new Set([
+                    'workspace', 'repositories', 'agents', 'agent_themes',
+                    'agent_theme_names', 'agent_worktrees', 'workspace_settings', 'media_items',
+                ]);
+                if (coreWorkspaceTables.has(table)) {
+                    missingTables.push(table);
+                }
+                continue;
+            }
+            // Compare columns
+            const expectedCols = expected.prepare(`PRAGMA table_info('${table}')`).all();
+            const actualCols = db.prepare(`PRAGMA table_info('${table}')`).all();
+            const actualColSet = new Set(actualCols.map(c => c.name));
+            for (const { name: col } of expectedCols) {
+                if (!actualColSet.has(col)) {
+                    missingColumns.push({ table, column: col });
+                }
+            }
+        }
+        expected.close();
+        expected = null;
+        return {
+            ok: missingTables.length === 0 && missingColumns.length === 0,
+            missingTables,
+            missingColumns,
+        };
+    }
+    catch (error) {
+        if (expected) {
+            try {
+                expected.close();
+            }
+            catch { /* cleanup — safe to ignore */ }
+        }
+        // If schema check itself fails, report as a single error
+        return {
+            ok: false,
+            missingTables: [],
+            missingColumns: [{ table: '(unknown)', column: error instanceof Error ? error.message : String(error) }],
+        };
+    }
+}
 /**
  * Attempt to repair a corrupted database.
  *
@@ -114,7 +463,7 @@ export function quickCheckIntegrity(db) {
  * 1. Try dump/reimport — opens the corrupt DB, dumps all SQL, creates a new DB
  * 2. If dump fails, fall back to the most recent backup
  *
- * The original corrupt file is preserved as dbPath.corrupt for forensics.
+ * The original corrupt file is preserved in backups/ for forensics.
  */
 export function repairDatabase(dbPath) {
     // Try dump/reimport first
@@ -133,6 +482,17 @@ export function repairDatabase(dbPath) {
         message: `Could not repair database. Dump failed: ${dumpResult.message}. No usable backups found.`,
     };
 }
+/**
+ * Move a corrupt database file to the backups/ directory with a corrupt prefix.
+ * Returns the destination path.
+ */
+function moveCorruptToBackups(dbPath) {
+    const backupsDir = getBackupsDir(dbPath);
+    fs.mkdirSync(backupsDir, { recursive: true });
+    const corruptPath = generateUniqueBackupPath(backupsDir, 'workspace-corrupt');
+    fs.renameSync(dbPath, corruptPath);
+    return corruptPath;
+}
 /**
  * Attempt recovery via .dump and reimport.
  * Opens the corrupt database, extracts as much SQL as possible,
@@ -189,12 +549,9 @@ function attemptDumpReimport(dbPath) {
         corruptDb = null;
         newDb.close();
         newDb = null;
-        // Swap files: corrupt → .corrupt, repaired → original
-        const corruptBackupPath = `${dbPath}.corrupt`;
-        if (fs.existsSync(corruptBackupPath)) {
-            fs.unlinkSync(corruptBackupPath);
-        }
-        fs.renameSync(dbPath, corruptBackupPath);
+        // Move corrupt file to backups/ directory
+        const corruptBackupPath = moveCorruptToBackups(dbPath);
+        // Move repaired database into place
         fs.renameSync(tempPath, dbPath);
         // Clean up old WAL/SHM files from the corrupt database
         for (const suffix of ['-wal', '-shm']) {
@@ -238,14 +595,13 @@ function attemptDumpReimport(dbPath) {
 }
 /**
  * Attempt recovery by restoring from the most recent valid backup.
- * Tries backups 1 through MAX_BACKUPS, validates each with integrity_check.
+ * Tries backups from newest to oldest, validates each with integrity_check.
  */
 function attemptBackupRestore(dbPath) {
-    for (let i = 1; i <= MAX_BACKUPS; i++) {
-        const backupPath = getBackupPath(dbPath, i);
-        if (!fs.existsSync(backupPath)) {
-            continue;
-        }
+    const backupsDir = getBackupsDir(dbPath);
+    const backups = listBackupFiles(backupsDir);
+    for (let i = 0; i < backups.length; i++) {
+        const backupPath = backups[i];
         // Validate the backup
         let backupDb = null;
         try {
@@ -257,11 +613,7 @@ function attemptBackupRestore(dbPath) {
                 continue;
             }
             // Backup is valid — swap it in
-            const corruptBackupPath = `${dbPath}.corrupt`;
-            if (fs.existsSync(corruptBackupPath)) {
-                fs.unlinkSync(corruptBackupPath);
-            }
-            fs.renameSync(dbPath, corruptBackupPath);
+            const corruptBackupPath = moveCorruptToBackups(dbPath);
             fs.copyFileSync(backupPath, dbPath);
             // Clean up old WAL/SHM files
             for (const suffix of ['-wal', '-shm']) {
@@ -273,7 +625,7 @@ function attemptBackupRestore(dbPath) {
             return {
                 success: true,
                 method: 'backup-restore',
-                message: `Restored from backup.${i}. Corrupt file saved as ${path.basename(corruptBackupPath)}.`,
+                message: `Restored from ${path.basename(backupPath)}. Corrupt file saved as ${path.basename(corruptBackupPath)}.`,
             };
         }
         catch {