@rynx-ai/daemon 0.1.11-beta.3 → 0.1.11-beta.30

package/dist/plugin-installer.js

@@ -4,6 +4,7 @@ import { join, resolve } from "node:path";
 import { MARKETPLACE_ID_PATTERN, pluginCliInvocationLeasePid, readPluginRuntimeLeases, removePluginRuntimeLease, } from "@rynx-ai/plugin-sdk";
 import { rynxHome } from "@rynx-ai/core";
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 import { isBuiltInPluginMarketplace } from "./plugin-marketplace.js";
 import { detectPluginSource, inspectPluginPackage, materializePluginPackage, } from "./plugin-package.js";
 import { canonicalPluginId, getPlugin, removePlugin, upsertPlugin, } from "./plugin-store.js";
@@ -117,7 +118,7 @@ export async function preparePluginInstallation(spec, onProgress = () => { }, op
                         promotedByThisTransaction = true;
                     }
                     promotedPath = realpathSync(target);
-                    db().transaction(() => {
+                    transaction(db(), () => {
                         const current = getPlugin(canonicalId);
                         if (!samePluginGeneration(existing, current)) {
                             throw new Error(`plugin "${canonicalId}" changed concurrently; retry`);
@@ -172,7 +173,7 @@ export async function preparePluginInstallation(spec, onProgress = () => { }, op
 }
 export async function uninstallPlugin(identity, onProgress = () => { }, options = {}) {
     let record;
-    const removed = db().transaction(() => {
+    const removed = transaction(db(), () => {
         record = getPlugin(identity);
         if (!record)
             return false;

package/dist/plugin-management-service.js

@@ -295,7 +295,6 @@ function toManagementItem(record, settingsAvailable = false, updateState = "unkn
         enabled: record.enabled,
         runtimeState: record.manifest.runtime ? record.runtimeState : "absent",
         ...(record.runtimeError ? { runtimeError: record.runtimeError } : {}),
-        capabilities: [...record.manifest.capabilities],
         hasSettingsUi: settingsAvailable,
         updatedAt: record.updatedAt,
     };
@@ -322,7 +321,6 @@ function toInstallPreparation(token, expiresAtMs, prepared) {
                     subdirectory: prepared.requestedSource.subdir ?? ".",
                 },
             digest: prepared.integrity,
-            capabilities: [...prepared.manifest.capabilities],
             hasRuntime: Boolean(prepared.manifest.runtime),
             hasSettingsUi: Boolean(prepared.manifest.settings),
             ...(prepared.manifest.runtime ? {

package/dist/plugin-marketplace.js

@@ -3,6 +3,7 @@ import { isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { MARKETPLACE_ID_PATTERN, parsePluginMarketplace, } from "@rynx-ai/plugin-sdk";
 import { rynxHome } from "@rynx-ai/core";
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 import { detectPluginSource, materializePluginPackage, parsePluginSourceSpec, pluginSourceFingerprint, } from "./plugin-package.js";
 export function listPluginMarketplaces() {
     return db().prepare("SELECT * FROM plugin_marketplaces ORDER BY marketplace_id").all().map(toRecord);
@@ -27,7 +28,7 @@ export async function addPluginMarketplace(spec, options = {}) {
             throw new Error(`built-in marketplace "${marketplaceId}" is managed by Rynx`);
         }
         const now = new Date().toISOString();
-        db().transaction(() => {
+        transaction(db(), () => {
             const binding = db().prepare(`SELECT source_fingerprint AS sourceFingerprint
          FROM plugin_marketplace_bindings
          WHERE marketplace_id = ?`).get(marketplaceId);

package/dist/plugin-store.js

@@ -57,11 +57,11 @@ export function upsertPlugin(rec) {
     db().prepare(`INSERT INTO plugin_installations (
        canonical_id, marketplace_id, plugin_id, source_type, requested_source,
        resolved_revision, source_fingerprint, version, enabled, installed_at,
-       updated_at, install_path, manifest, integrity, capabilities, runtime_state, runtime_error
+       updated_at, install_path, manifest, integrity, runtime_state, runtime_error
      ) VALUES (
        @canonicalId, @marketplaceId, @pluginId, @source, @requestedSource,
        @resolvedRevision, @sourceFingerprint, @version, @enabled, @now,
-       @now, @installPath, @manifest, @integrity, @capabilities, 'stopped', NULL
+       @now, @installPath, @manifest, @integrity, 'stopped', NULL
      )
      ON CONFLICT(canonical_id) DO UPDATE SET
        source_type = excluded.source_type,
@@ -74,7 +74,6 @@ export function upsertPlugin(rec) {
        install_path = excluded.install_path,
        manifest = excluded.manifest,
        integrity = excluded.integrity,
-       capabilities = excluded.capabilities,
        runtime_state = 'stopped',
        runtime_error = NULL`).run({
         canonicalId: rec.canonicalId,
@@ -90,7 +89,6 @@ export function upsertPlugin(rec) {
         installPath: rec.installPath,
         manifest: JSON.stringify(rec.manifest),
         integrity: rec.integrity,
-        capabilities: JSON.stringify(rec.manifest.capabilities),
     });
 }
 export function setPluginEnabled(identity, enabled) {

package/dist/plugin-supervisor.js

@@ -294,7 +294,6 @@ export class PluginSupervisor {
                 daemonInstanceId: this.daemonInstanceId,
                 productVersion: this.productVersion,
                 cliVersion: this.cliVersion,
-                capabilities: state.record.manifest.capabilities,
                 services: this.services,
                 ...(state.record.pluginId === "workspace"
                     && isBuiltInPluginMarketplace(state.record.marketplaceId)
@@ -324,7 +323,6 @@ export class PluginSupervisor {
                 role: "runtime",
                 dataDir,
                 cacheDir,
-                capabilities: state.record.manifest.capabilities,
                 handleHostCall: (method, params, signal) => hostRpc.call(method, params, signal),
                 onStderr: (line) => this.log({
                     level: "info",
@@ -411,7 +409,6 @@ export class PluginSupervisor {
                 daemonInstanceId: this.daemonInstanceId,
                 productVersion: this.productVersion,
                 cliVersion: this.cliVersion,
-                capabilities: state.record.manifest.capabilities,
                 services: this.services,
                 ...(state.record.pluginId === "workspace"
                     && isBuiltInPluginMarketplace(state.record.marketplaceId)
@@ -440,7 +437,6 @@ export class PluginSupervisor {
                 role: "settings",
                 dataDir,
                 cacheDir,
-                capabilities: state.record.manifest.capabilities,
                 handleHostCall: (method, params, signal) => hostRpc.call(method, params, signal),
                 onStderr: (line) => this.log({
                     level: "info",

package/dist/remote-runtime-access-store.d.ts

@@ -1,4 +1,4 @@
-import Database from "better-sqlite3";
+import { type DatabaseSync } from "node:sqlite";
 declare const DEFAULT_AUTHORITIES: readonly ["daemon.full"];
 export type RuntimeAuthority = (typeof DEFAULT_AUTHORITIES)[number];
 export type RemoteRuntimeAccessErrorCode = "invalid_claim" | "claim_expired" | "claim_used" | "grant_not_found" | "grant_revoked" | "grant_identity_mismatch" | "conflict" | "corrupt_state";
@@ -46,7 +46,7 @@ type Clock = () => Date;
 export declare class RemoteRuntimeAccessStore {
     private readonly connection;
     private readonly clock;
-    constructor(connection?: Database.Database, clock?: Clock);
+    constructor(connection?: DatabaseSync, clock?: Clock);
     createPairingClaim(input: CreatePairingClaimInput): RuntimePairingClaim;
     redeemPairingClaim(input: RedeemPairingClaimInput): RuntimeClientGrant;
     resolveActiveGrant(input: ResolveActiveGrantInput): RuntimeClientGrant;

package/dist/remote-runtime-access-store.js

@@ -1,5 +1,6 @@
 import { createHash, createPublicKey, randomBytes, timingSafeEqual, } from "node:crypto";
 import { db } from "./db.js";
+import { hasSqlitePrimaryCode, SQLITE_CONSTRAINT, transaction } from "./sqlite.js";
 const CLAIM_SECRET_HASH_DOMAIN = "rynx-runtime-pairing-claim-secret-v1\0";
 const DEFAULT_AUTHORITIES = Object.freeze(["daemon.full"]);
 const MIN_TTL_MS = 1_000;
@@ -35,7 +36,7 @@ export class RemoteRuntimeAccessStore {
         const created = this.now();
         const createdAt = created.toISOString();
         const expiresAt = new Date(created.getTime() + ttlMs).toISOString();
-        const create = this.connection.transaction(() => {
+        const create = transaction(this.connection, () => {
             this.deleteRetainedExpiredClaims(created);
             this.connection
                 .prepare(`INSERT INTO runtime_pairing_claims
@@ -60,7 +61,7 @@ export class RemoteRuntimeAccessStore {
         const clientId = validId(input.clientId, "clientId", "invalid_claim");
         const clientPublicKey = canonicalEd25519PublicKey(input.clientPublicKey, "invalid_claim");
         const requestedLabel = optionalLabel(input.label, "invalid_claim");
-        const redeem = this.connection.transaction(() => {
+        const redeem = transaction(this.connection, () => {
             const now = this.now().toISOString();
             const claim = this.connection
                 .prepare(`SELECT claim_id, secret_hash, authorities, client_label, created_at, expires_at,
@@ -124,7 +125,7 @@ export class RemoteRuntimeAccessStore {
         const grantId = validId(input.grantId, "grantId", "grant_not_found");
         const clientId = validId(input.clientId, "clientId", "grant_identity_mismatch");
         const clientPublicKey = canonicalEd25519PublicKey(input.clientPublicKey, "grant_identity_mismatch");
-        const resolve = this.connection.transaction(() => {
+        const resolve = transaction(this.connection, () => {
             const row = this.connection
                 .prepare(`SELECT grant_id, client_id, client_public_key, client_label, authorities,
                   created_at, revoked_at, last_used_at
@@ -180,7 +181,7 @@ export class RemoteRuntimeAccessStore {
     revokeClientGrant(grantIdInput) {
         const grantId = validId(grantIdInput, "grantId", "grant_not_found");
         const revokedAt = this.now().toISOString();
-        const revoke = this.connection.transaction(() => {
+        const revoke = transaction(this.connection, () => {
             const revoked = this.connection
                 .prepare(`UPDATE runtime_client_grants
            SET revoked_at = ?
@@ -382,11 +383,7 @@ function grantFromRow(row) {
     };
 }
 function isSqliteConstraint(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        typeof error.code === "string" &&
-        error.code.startsWith("SQLITE_CONSTRAINT"));
+    return hasSqlitePrimaryCode(error, SQLITE_CONSTRAINT);
 }
 function accessError(code, message, cause) {
     return new RemoteRuntimeAccessError(code, message, cause === undefined ? undefined : { cause });

package/dist/remote-runtime-connection-manager.js

@@ -1465,7 +1465,7 @@ function nonNegativeInteger(value, fallback, field) {
     return value;
 }
 function parseCallTimeout(value) {
-    if (value === undefined)
+    if (value === undefined || value === null)
         return undefined;
     if (!Number.isSafeInteger(value) ||
         value < MIN_CALL_TIMEOUT_MS ||

package/dist/remote-runtime-target-store.d.ts

@@ -1,4 +1,4 @@
-import Database from "better-sqlite3";
+import { type DatabaseSync } from "node:sqlite";
 export interface RemoteRuntimeTarget {
     daemonId: string;
     displayName: string;
@@ -40,7 +40,7 @@ export interface CommitRemoteRuntimePendingEnrollmentOptions {
 export declare class RemoteRuntimeTargetStore {
     private readonly connection;
     private readonly clock;
-    constructor(connection?: Database.Database, clock?: () => Date);
+    constructor(connection?: DatabaseSync, clock?: () => Date);
     add(input: AddRemoteRuntimeTargetInput): RemoteRuntimeTarget;
     addPendingEnrollment(input: AddRemoteRuntimePendingEnrollmentInput): RemoteRuntimePendingEnrollment;
     getPendingEnrollment(claimIdInput: string): RemoteRuntimePendingEnrollment | undefined;

package/dist/remote-runtime-target-store.js

@@ -1,5 +1,6 @@
 import { createPublicKey } from "node:crypto";
 import { db } from "./db.js";
+import { hasSqlitePrimaryCode, SQLITE_CONSTRAINT, transaction } from "./sqlite.js";
 const OPAQUE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/;
 const CREDENTIAL_REF_PATTERN = /^credential_[A-Za-z0-9_-]{24}$/;
 const MAX_DISPLAY_NAME_CHARS = 128;
@@ -13,7 +14,7 @@ export class RemoteRuntimeTargetStore {
     add(input) {
         const normalized = normalizeTargetInput(input);
         const now = validNow(this.clock()).toISOString();
-        const insert = this.connection.transaction(() => {
+        const insert = transaction(this.connection, () => {
             this.connection.prepare(`INSERT INTO runtime_targets
            (daemon_id, display_name, identity_public_key, credential_ref, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?)`).run(normalized.daemonId, normalized.displayName, normalized.identityPublicKey, normalized.credentialRef, now, now);
@@ -67,7 +68,7 @@ export class RemoteRuntimeTargetStore {
     }
     removePendingEnrollment(claimIdInput) {
         const claimId = validId(claimIdInput, "claimId");
-        const remove = this.connection.transaction(() => {
+        const remove = transaction(this.connection, () => {
             const pending = this.getPendingEnrollment(claimId);
             if (!pending)
                 return undefined;
@@ -82,7 +83,7 @@ export class RemoteRuntimeTargetStore {
         const claimId = validId(claimIdInput, "claimId");
         const normalized = normalizeTargetInput(input);
         const now = validNow(this.clock()).toISOString();
-        const commit = this.connection.transaction(() => {
+        const commit = transaction(this.connection, () => {
             const pending = this.getPendingEnrollment(claimId);
             if (!pending)
                 throw new Error("pending Runtime enrollment was not found");
@@ -134,7 +135,7 @@ export class RemoteRuntimeTargetStore {
     }
     remove(daemonIdInput) {
         const daemonId = validId(daemonIdInput, "daemonId");
-        const remove = this.connection.transaction(() => {
+        const remove = transaction(this.connection, () => {
             const target = this.get(daemonId);
             if (!target)
                 return undefined;
@@ -321,6 +322,5 @@ function validNow(value) {
     return value;
 }
 function isSqliteConstraint(error) {
-    return typeof error === "object" && error !== null && "code" in error &&
-        typeof error.code === "string" && error.code.startsWith("SQLITE_CONSTRAINT");
+    return hasSqlitePrimaryCode(error, SQLITE_CONSTRAINT);
 }

package/dist/session-emulator-binding-store.js

@@ -1,5 +1,6 @@
 import { SessionEmulatorBindingConflictError, } from "@rynx-ai/server";
 import { db } from "./db.js";
+import { hasSqlitePrimaryCode, SQLITE_CONSTRAINT, transaction } from "./sqlite.js";
 export class SqliteSessionEmulatorBindingStore {
     get(sessionId) {
         const row = db().prepare(`SELECT session_id, binding_id, backend, device_id, device_name, attached_at
@@ -13,7 +14,7 @@ export class SqliteSessionEmulatorBindingStore {
     }
     bind(record) {
         const connection = db();
-        const replace = connection.transaction(() => {
+        const replace = transaction(connection, () => {
             connection.prepare("DELETE FROM session_emulator_bindings WHERE session_id = ?")
                 .run(record.sessionId);
             connection.prepare(`INSERT INTO session_emulator_bindings
@@ -40,7 +41,7 @@ export class SqliteSessionEmulatorBindingStore {
         return db().prepare("DELETE FROM session_emulator_bindings WHERE session_id = ?").run(sessionId).changes > 0;
     }
     releaseDevice(backend, deviceId) {
-        return db().prepare("DELETE FROM session_emulator_bindings WHERE backend = ? AND device_id = ?").run(backend, deviceId).changes;
+        return Number(db().prepare("DELETE FROM session_emulator_bindings WHERE backend = ? AND device_id = ?").run(backend, deviceId).changes);
     }
 }
 function bindingRecord(row) {
@@ -54,8 +55,5 @@ function bindingRecord(row) {
     };
 }
 function isSqliteConstraint(error) {
-    if (!error || typeof error !== "object")
-        return false;
-    const code = error.code;
-    return typeof code === "string" && code.startsWith("SQLITE_CONSTRAINT");
+    return hasSqlitePrimaryCode(error, SQLITE_CONSTRAINT);
 }

package/dist/session-fork-store.d.ts

@@ -30,6 +30,7 @@ export declare class SqliteSessionForkStore implements MachineSessionForkStorePo
         items: SessionItem[];
     }): void;
     private publishTarget;
+    private publishTargetUnchecked;
     markError(operationId: string, error: string): void;
     listReserved(): MachineSessionForkOperationRecord[];
     hasReservedSource(sessionId: string): boolean;

package/dist/session-fork-store.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, mkdirSync, } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, rmSync, } from "node:fs";
+import { extname, join } from "node:path";
 import { newSessionId, newSessionItemId, normalizeSessionTitle, resolvedExecutionSnapshotSchema, rynxHome, sessionWorkspaceSnapshotSchema, } from "@rynx-ai/core";
 import { MachineSessionServiceFailure, } from "@rynx-ai/server";
 import { db } from "./db.js";
+import { scalar, transaction } from "./sqlite.js";
 const FORK_COLS = [
     "operation_id",
     "request_hash",
@@ -39,9 +40,8 @@ export class SqliteSessionForkStore {
         }
         const now = new Date().toISOString();
         let targetSessionId = newSessionId();
-        while (db().prepare("SELECT 1 FROM sessions WHERE id = ?").pluck().get(targetSessionId) ||
-            db().prepare("SELECT 1 FROM session_fork_operations WHERE target_session_id = ?")
-                .pluck().get(targetSessionId)) {
+        while (scalar(db().prepare("SELECT 1 FROM sessions WHERE id = ?")).get(targetSessionId) ||
+            scalar(db().prepare("SELECT 1 FROM session_fork_operations WHERE target_session_id = ?")).get(targetSessionId)) {
             targetSessionId = newSessionId();
         }
         try {
@@ -94,6 +94,19 @@ export class SqliteSessionForkStore {
         this.publishTarget(input);
     }
     publishTarget(input) {
+        try {
+            this.publishTargetUnchecked(input);
+        }
+        catch (error) {
+            const published = scalar(db().prepare("SELECT 1 FROM sessions WHERE id = ?"))
+                .get(input.target.id);
+            if (!published) {
+                rmSync(this.sessionDirectory(input.target.id), { recursive: true, force: true });
+            }
+            throw error;
+        }
+    }
+    publishTargetUnchecked(input) {
         const itemIds = new Map();
         for (const item of input.items)
             itemIds.set(item.id, newSessionItemId(item.type));
@@ -130,7 +143,7 @@ export class SqliteSessionForkStore {
             };
         });
         const conn = db();
-        conn.transaction(() => {
+        transaction(conn, () => {
             if (input.operationId) {
                 const current = this.read(input.operationId);
                 if (current?.state === "completed")
@@ -152,16 +165,33 @@ export class SqliteSessionForkStore {
            source, created_at, updated_at
          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(input.target.id, JSON.stringify(sessionWorkspaceSnapshotSchema.parse(input.target.workspace)), JSON.stringify(resolvedExecutionSnapshotSchema.parse(input.target.execution)), normalizeSessionTitle(input.target.title) ?? null, input.target.forkedFromSessionId ?? null, input.target.source, input.target.createdAt, input.target.updatedAt ?? input.target.createdAt);
             const insertResource = conn.prepare(`INSERT INTO session_resources (
-           id, session_id, client_upload_id, upload_id, filename, media_type,
+           id, session_id, client_upload_id, upload_id, kind, filename, media_type,
            byte_length, uploaded_bytes, sha256, width, height, state,
            message_item_id, created_at, committed_at
          ) VALUES (
-           @id, @session_id, @client_upload_id, @upload_id, @filename, @media_type,
+           @id, @session_id, @client_upload_id, @upload_id, @kind, @filename, @media_type,
            @byte_length, @uploaded_bytes, @sha256, @width, @height, 'committed',
            @message_item_id, @created_at, @committed_at
          )`);
-            for (const resource of resources)
-                insertResource.run(resource);
+            for (const resource of resources) {
+                insertResource.run({
+                    id: resource.id,
+                    session_id: resource.session_id,
+                    client_upload_id: resource.client_upload_id,
+                    upload_id: resource.upload_id,
+                    kind: resource.kind,
+                    filename: resource.filename,
+                    media_type: resource.media_type,
+                    byte_length: resource.byte_length,
+                    uploaded_bytes: resource.uploaded_bytes,
+                    sha256: resource.sha256,
+                    width: resource.width,
+                    height: resource.height,
+                    message_item_id: resource.message_item_id,
+                    created_at: resource.created_at,
+                    committed_at: resource.committed_at,
+                });
+            }
             const insertItem = conn.prepare(`INSERT INTO session_items (
            id, session_id, position, response_id, type, status,
            data, created_by, created_at
@@ -203,9 +233,9 @@ export class SqliteSessionForkStore {
         ORDER BY created_at`).all().map(toOperation);
     }
     hasReservedSource(sessionId) {
-        return Boolean(db().prepare(`SELECT 1
+        return Boolean(scalar(db().prepare(`SELECT 1
          FROM session_fork_operations
-        WHERE source_session_id = ? AND state = 'reserved'`).pluck().get(sessionId));
+        WHERE source_session_id = ? AND state = 'reserved'`)).get(sessionId));
     }
     markTargetDeleted(sessionId) {
         const now = new Date().toISOString();
@@ -234,7 +264,7 @@ export class SqliteSessionForkStore {
         return join(this.resourceRoot, key);
     }
     resourcePath(row) {
-        return join(this.sessionDirectory(row.session_id), `${row.id}.${extension(row.media_type)}`);
+        return join(this.sessionDirectory(row.session_id), `${row.id}.${extension(row)}`);
     }
 }
 function toOperation(row) {
@@ -252,22 +282,40 @@ function toOperation(row) {
 function referencedResourceIds(items) {
     const ids = new Set();
     for (const item of items) {
-        if (item.type !== "message" || item.data.role !== "user")
-            continue;
-        for (const part of item.data.content) {
-            if (part.type === "input_image")
-                ids.add(part.resourceId);
+        if (item.type === "message" && item.data.role === "user") {
+            for (const part of item.data.content) {
+                if ((part.type === "input_image" || part.type === "input_file") &&
+                    typeof part.resourceId === "string")
+                    ids.add(part.resourceId);
+            }
         }
+        if (item.type === "function_call_output" &&
+            item.data.generatedImage &&
+            typeof item.data.generatedImage.resourceId === "string")
+            ids.add(item.data.generatedImage.resourceId);
     }
     return [...ids];
 }
 function remapItemResources(item, resources) {
     const cloned = structuredClone(item);
-    if (cloned.type !== "message" || cloned.data.role !== "user")
-        return cloned;
-    cloned.data.content = cloned.data.content.map((part) => part.type === "input_image"
-        ? { ...part, resourceId: resources.get(part.resourceId) ?? part.resourceId }
-        : part);
+    if (cloned.type === "message" && cloned.data.role === "user") {
+        cloned.data.content = cloned.data.content.map((part) => {
+            if ((part.type === "input_image" || part.type === "input_file") &&
+                typeof part.resourceId === "string") {
+                return { ...part, resourceId: resources.get(part.resourceId) ?? part.resourceId };
+            }
+            return part;
+        });
+    }
+    if (cloned.type === "function_call_output" &&
+        cloned.data.generatedImage &&
+        typeof cloned.data.generatedImage.resourceId === "string") {
+        const resourceId = cloned.data.generatedImage.resourceId;
+        cloned.data.generatedImage = {
+            ...cloned.data.generatedImage,
+            resourceId: resources.get(resourceId) ?? resourceId,
+        };
+    }
     return cloned;
 }
 function deterministicId(prefix, targetSessionId, sourceId) {
@@ -276,13 +324,19 @@ function deterministicId(prefix, targetSessionId, sourceId) {
         .digest("hex");
     return `${prefix}_${digest.slice(0, 40)}`;
 }
-function extension(mediaType) {
-    switch (mediaType) {
-        case "image/png":
+function extension(row) {
+    if (row.kind === "image") {
+        if (row.media_type === "image/png")
             return "png";
-        case "image/jpeg":
+        if (row.media_type === "image/jpeg")
             return "jpg";
-        case "image/webp":
+        if (row.media_type === "image/webp")
             return "webp";
+        if (row.media_type === "image/gif")
+            return "gif";
+        if (row.media_type === "image/svg+xml")
+            return "svg";
     }
+    const value = extname(row.filename).slice(1).toLowerCase();
+    return /^[a-z0-9][a-z0-9._-]{0,15}$/.test(value) ? value : "bin";
 }

package/dist/session-launch-operations.js

@@ -1,5 +1,6 @@
 import { newSessionId } from "@rynx-ai/core";
 import { db } from "./db.js";
+import { scalar, transaction } from "./sqlite.js";
 import { createSessionMeta } from "./session-meta-store.js";
 const MAX_ID_LENGTH = 512;
 const SHA256_PATTERN = /^[a-fA-F0-9]{64}$/;
@@ -58,7 +59,7 @@ export function replayPluginSessionLaunch(input) {
         throw new SessionLaunchOperationTargetDeletedError(pluginId, scopeId, operationId, existing.session_id);
     }
     if (!sessionExists(existing.session_id)) {
-        db().transaction(() => {
+        transaction(db(), () => {
             tombstoneOperations(existing.session_id, new Date().toISOString());
         }).immediate();
         throw new SessionLaunchOperationTargetDeletedError(pluginId, scopeId, operationId, existing.session_id);
@@ -81,7 +82,7 @@ export function ensurePluginSessionLaunch(input) {
     const rawRequestHash = input.rawRequestHash
         ? requiredRequestHash(input.rawRequestHash)
         : requestHash;
-    const ensure = db().transaction(() => {
+    const ensure = transaction(db(), () => {
         const existing = readOperation(pluginId, scopeId, operationId);
         if (existing) {
             if (existing.request_hash !== requestHash &&
@@ -139,14 +140,14 @@ function readOperation(pluginId, scopeId, operationId) {
         .get(pluginId, scopeId, operationId);
 }
 function sessionExists(sessionId) {
-    return Boolean(db().prepare("SELECT 1 FROM sessions WHERE id = ?").pluck().get(sessionId));
+    return Boolean(scalar(db().prepare("SELECT 1 FROM sessions WHERE id = ?")).get(sessionId));
 }
 function tombstoneOperations(sessionId, now) {
-    return db()
+    return Number(db()
         .prepare(`UPDATE plugin_session_launch_operations
        SET state = 'deleted', updated_at = ?, deleted_at = ?
        WHERE session_id = ? AND state = 'active'`)
-        .run(now, now, sessionId).changes;
+        .run(now, now, sessionId).changes);
 }
 function requiredId(value, label) {
     const normalized = value?.trim();

package/dist/session-log-store.d.ts

@@ -14,6 +14,7 @@ export declare class SqliteSessionLogStore implements SessionLogStore {
         afterId?: string;
         limit?: number;
     }): Promise<SessionItem[]>;
+    get(sessionId: string, itemId: string): Promise<SessionItem | undefined>;
     snapshot(sessionId: string): Promise<SessionItem[]>;
     listSessions(opts?: {
         limit?: number;

package/dist/session-log-store.js

@@ -1,4 +1,5 @@
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 function toItem(row) {
     return {
         id: row.id,
@@ -21,7 +22,7 @@ export class SqliteSessionLogStore {
          (id, session_id, position, response_id, type, status, data, created_by, created_at)
        VALUES (@id, @session_id, @position, @response_id, @type, @status, @data, @created_by, @created_at)`);
         const maxStmt = conn.prepare("SELECT MAX(position) AS max FROM session_items WHERE session_id = ?");
-        const tx = conn.transaction((batch) => {
+        const tx = transaction(conn, (batch) => {
             const { max } = maxStmt.get(sessionId);
             let next = (max ?? -1) + 1;
             return batch.map((item) => {
@@ -37,9 +38,18 @@ export class SqliteSessionLogStore {
                     created_by: stored.createdBy ?? null,
                     created_at: stored.createdAt,
                 });
-                if (stored.type === "message" && stored.data.role === "user") {
-                    const resourceIds = stored.data.content.flatMap((part) => part.type === "input_image" ? [part.resourceId] : []);
-                    const operationIds = new Set();
+                const resourceIds = stored.type === "message" && stored.data.role === "user"
+                    ? stored.data.content.flatMap((part) => (part.type === "input_image" || part.type === "input_file") &&
+                        "resourceId" in part && part.resourceId
+                        ? [part.resourceId]
+                        : [])
+                    : stored.type === "function_call_output" &&
+                        stored.data.generatedImage &&
+                        "resourceId" in stored.data.generatedImage &&
+                        stored.data.generatedImage.resourceId
+                        ? [stored.data.generatedImage.resourceId]
+                        : [];
+                if (resourceIds.length > 0) {
                     for (const resourceId of resourceIds) {
                         const resource = conn.prepare(`SELECT state, message_item_id
                  FROM session_resources
@@ -47,23 +57,12 @@ export class SqliteSessionLogStore {
                         if (!resource ||
                             resource.state === "uploading" ||
                             (resource.message_item_id && resource.message_item_id !== stored.id)) {
-                            throw new Error(`Session image resource ${resourceId} is not committable`);
+                            throw new Error(`Session resource ${resourceId} is not committable`);
                         }
                         conn.prepare(`UPDATE session_resources
                   SET state = 'committed', message_item_id = ?,
                       committed_at = COALESCE(committed_at, ?)
                 WHERE id = ? AND session_id = ?`).run(stored.id, stored.createdAt, resourceId, sessionId);
-                        const operation = conn.prepare(`SELECT client_message_id
-                 FROM session_message_operation_resources
-                WHERE session_id = ? AND resource_id = ?`).get(sessionId, resourceId);
-                        if (operation)
-                            operationIds.add(operation.client_message_id);
-                    }
-                    for (const clientMessageId of operationIds) {
-                        conn.prepare(`UPDATE session_message_operations
-                  SET state = 'mirrored', error = NULL, updated_at = ?
-                WHERE session_id = ? AND client_message_id = ?
-                  AND state IN ('injecting', 'injected', 'outcome_unknown')`).run(stored.createdAt, sessionId, clientMessageId);
                     }
                 }
                 return stored;
@@ -92,6 +91,10 @@ export class SqliteSessionLogStore {
             .all(sessionId, afterPosition, limit);
         return rows.map(toItem);
     }
+    async get(sessionId, itemId) {
+        const row = db().prepare("SELECT * FROM session_items WHERE session_id = ? AND id = ?").get(sessionId, itemId);
+        return row ? toItem(row) : undefined;
+    }
     async snapshot(sessionId) {
         const rows = db()
             .prepare("SELECT * FROM session_items WHERE session_id = ? ORDER BY position ASC")

package/dist/session-meta-store.d.ts

@@ -18,6 +18,11 @@ export declare function listSessionMetas(): StoredSessionMeta[];
 export declare function getSessionMeta(id: string): StoredSessionMeta | undefined;
 export declare function createSessionMeta(meta: StoredSessionMeta): void;
 export declare function setSessionTitle(id: string, title: string): void;
+export declare function setSessionExecution(id: string, execution: MachineSessionRecord["execution"]): void;
 export declare function removeSessionMeta(id: string): void;
 /** {@link SessionRegistry} over the same `sessions` table. */
 export declare const sessionRegistry: SessionRegistry;
+/** Generic plugin-principal ownership, including descendants forked from a
+ * plugin-created Session. Portal authorization calls this on every request so
+ * a grant cannot cross into console or another plugin's Sessions. */
+export declare function sessionBelongsToPlugin(pluginId: string, sessionId: string): boolean;