@rynx-ai/daemon 0.1.11-beta.30 → 0.1.11-beta.32

package/bundled-plugins/plugins/lark/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rynx-ai/plugin-channel-lark",
-  "version": "0.1.11-beta.30",
+  "version": "0.1.11-beta.32",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/rynx-ai/rynx.git",

package/dist/chrome-for-testing-http.d.ts

@@ -0,0 +1,9 @@
+export interface ChromeForTestingFetchInit {
+    headers?: HeadersInit;
+    redirect?: RequestRedirect;
+    signal?: AbortSignal | null;
+}
+/** HTTP behavior shared by Chrome for Testing metadata and artifact downloads. */
+export declare function fetchChromeForTesting(url: string, init?: ChromeForTestingFetchInit): Promise<Response>;
+/** Preserve nested network diagnostics instead of reporting only `fetch failed`. */
+export declare function formatChromeForTestingNetworkError(error: unknown): string;

package/dist/chrome-for-testing-http.js

@@ -0,0 +1,58 @@
+import { EnvHttpProxyAgent, fetch as undiciFetch } from "undici";
+import { installedDaemonVersion } from "./entry-path.js";
+const CONNECT_TIMEOUT_MS = 30_000;
+const REQUEST_TIMEOUT_MS = 120_000;
+let dispatcher;
+/** HTTP behavior shared by Chrome for Testing metadata and artifact downloads. */
+export async function fetchChromeForTesting(url, init = {}) {
+    const headers = new Headers(init.headers);
+    if (!headers.has("user-agent")) {
+        headers.set("user-agent", `rynx/${installedDaemonVersion()}`);
+    }
+    const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const signal = init.signal
+        ? AbortSignal.any([init.signal, timeoutSignal])
+        : timeoutSignal;
+    const response = await undiciFetch(url, {
+        dispatcher: dispatcher ??= createDispatcher(),
+        headers: Object.fromEntries(headers.entries()),
+        redirect: init.redirect,
+        signal,
+    });
+    return response;
+}
+/** Preserve nested network diagnostics instead of reporting only `fetch failed`. */
+export function formatChromeForTestingNetworkError(error) {
+    const messages = [];
+    const seen = new Set();
+    let current = error;
+    while (current instanceof Error && !seen.has(current) && messages.length < 8) {
+        seen.add(current);
+        if (current.message && messages.at(-1) !== current.message)
+            messages.push(current.message);
+        current = current.cause;
+    }
+    return messages.join(": ") || String(error);
+}
+function createDispatcher() {
+    const allProxy = firstEnvironmentValue("all_proxy", "ALL_PROXY");
+    const httpProxy = firstEnvironmentValue("http_proxy", "HTTP_PROXY") ?? allProxy;
+    const httpsProxy = firstEnvironmentValue("https_proxy", "HTTPS_PROXY") ?? httpProxy;
+    const noProxy = firstEnvironmentValue("no_proxy", "NO_PROXY");
+    return new EnvHttpProxyAgent({
+        connectTimeout: CONNECT_TIMEOUT_MS,
+        headersTimeout: REQUEST_TIMEOUT_MS,
+        bodyTimeout: REQUEST_TIMEOUT_MS,
+        ...(httpProxy ? { httpProxy } : {}),
+        ...(httpsProxy ? { httpsProxy } : {}),
+        ...(noProxy ? { noProxy } : {}),
+    });
+}
+function firstEnvironmentValue(...names) {
+    for (const name of names) {
+        const value = process.env[name];
+        if (value)
+            return value;
+    }
+    return undefined;
+}

package/dist/chrome-for-testing-release-resolver.js

@@ -7,6 +7,7 @@
  * store computes and records the archive digest when it installs these bytes.
  */
 import { resolveChromeForTestingPlatform, } from "./chrome-for-testing-store.js";
+import { fetchChromeForTesting, formatChromeForTestingNetworkError, } from "./chrome-for-testing-http.js";
 const MANIFEST_BASE_URL = "https://googlechromelabs.github.io/chrome-for-testing/";
 const CHANNEL_MANIFEST_URL = `${MANIFEST_BASE_URL}last-known-good-versions-with-downloads.json`;
 const ARTIFACT_BASE_URL = "https://storage.googleapis.com/chrome-for-testing-public/";
@@ -53,11 +54,17 @@ function validateSelector(selector) {
 }
 async function fetchManifest(manifestUrl, fetchMetadata, signal) {
     assertManifestUrl(manifestUrl);
-    const response = await fetchMetadata(manifestUrl, {
-        signal,
-        redirect: "error",
-        headers: { accept: "application/json" },
-    });
+    let response;
+    try {
+        response = await fetchMetadata(manifestUrl, {
+            signal,
+            redirect: "error",
+            headers: { accept: "application/json" },
+        });
+    }
+    catch (error) {
+        throw new Error(`Chrome for Testing metadata request failed: ${formatChromeForTestingNetworkError(error)}`, { cause: error });
+    }
     if (!response.ok) {
         throw new Error(`Chrome for Testing metadata request failed: HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`);
     }
@@ -210,5 +217,5 @@ function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function defaultFetchMetadata(url, init) {
-    return fetch(url, init);
+    return fetchChromeForTesting(url, init);
 }

package/dist/chrome-for-testing-store.d.ts

@@ -48,6 +48,8 @@ export interface ChromeForTestingArtifactStoreOptions {
     arch?: string;
     fetchArtifact?: ChromeForTestingArtifactFetcher;
     extractZip?: ChromeForTestingZipExtractor;
+    /** Injectable only so download retries can be tested without real delays. */
+    retryDelay?: (attempt: number, signal?: AbortSignal) => Promise<void>;
     maxArchiveBytes?: number;
     now?: () => Date;
     /** Defaults to ~/.rynx/browser/profiles/headless-chromium. */

package/dist/chrome-for-testing-store.js

@@ -6,12 +6,14 @@
  * explicitly pinned build or an already-resolved official release.
  */
 import { createHash } from "node:crypto";
-import { accessSync, chmodSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, writeSync, } from "node:fs";
+import { accessSync, chmodSync, closeSync, existsSync, ftruncateSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, writeSync, } from "node:fs";
 import { constants as fsConstants } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { DatabaseSync } from "node:sqlite";
+import { setTimeout as delay } from "node:timers/promises";
 import extractZipArchive from "@electron-internal/extract-zip";
 import { rynxHome } from "@rynx-ai/core";
+import { fetchChromeForTesting, formatChromeForTestingNetworkError, } from "./chrome-for-testing-http.js";
 import { hasSqlitePrimaryCode, SQLITE_BUSY, SQLITE_LOCKED } from "./sqlite.js";
 const BUILD_OWNER_FILE = ".rynx-cft-owner.json";
 const STAGING_OWNER_FILE = ".rynx-cft-staging-owner.json";
@@ -20,8 +22,9 @@ const STORE_LOCK_FILE = ".rynx-cft-store.sqlite";
 const MAX_METADATA_BYTES = 8 * 1024;
 const DEFAULT_MAX_ARCHIVE_BYTES = 1_024 * 1_024 * 1_024;
 const DEFAULT_STAGING_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const DOWNLOAD_PROGRESS_PERCENT_STEP = 10;
+const DOWNLOAD_PROGRESS_PERCENT_STEP = 5;
 const DOWNLOAD_PROGRESS_BYTES_STEP = 16 * 1_024 * 1_024;
+const DOWNLOAD_MAX_ATTEMPTS = 3;
 const STAGING_NAME_PATTERN = /^install-([A-Za-z0-9]{6})$/;
 const HEADLESS_PROFILE_NAME_PATTERN = /^session-([a-f0-9]{64})$/;
 const VERSION_PATTERN = /^\d{1,6}\.\d{1,6}\.\d{1,6}\.\d{1,6}$/;
@@ -68,6 +71,7 @@ export function createChromeForTestingArtifactStore(options = {}) {
     const rootDir = resolve(options.rootDir ?? join(rynxHome(), "cache", "browser", "chrome-for-testing"));
     const fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact;
     const extractZip = options.extractZip ?? defaultExtractZip;
+    const retryDelay = options.retryDelay ?? defaultDownloadRetryDelay;
     const maxArchiveBytes = options.maxArchiveBytes ?? DEFAULT_MAX_ARCHIVE_BYTES;
     const now = options.now ?? (() => new Date());
     const headlessProfileRoot = resolve(options.headlessProfileRoot ?? join(rynxHome(), "browser", "profiles", "headless-chromium"));
@@ -139,6 +143,7 @@ export function createChromeForTestingArtifactStore(options = {}) {
                 maxArchiveBytes,
                 signal: installOptions.signal,
                 onProgress: installOptions.onProgress,
+                retryDelay,
             });
             throwIfAborted(installOptions.signal);
             const build = { ...release, sha256 };
@@ -450,9 +455,54 @@ function validateDownloadMetadata(input, platform) {
     return { version: input.version, platform: input.platform, url: url.href };
 }
 async function downloadArchive(options) {
-    const response = await options.fetchArtifact(options.url, { signal: options.signal });
+    const descriptor = openSync(options.destination, "wx", 0o600);
+    try {
+        for (let attempt = 1; attempt <= DOWNLOAD_MAX_ATTEMPTS; attempt += 1) {
+            try {
+                if (attempt > 1)
+                    ftruncateSync(descriptor, 0);
+                return await downloadArchiveAttempt(options, descriptor);
+            }
+            catch (error) {
+                throwIfAborted(options.signal);
+                if (!(error instanceof RetryableDownloadError) || attempt === DOWNLOAD_MAX_ATTEMPTS) {
+                    throw error;
+                }
+                options.onProgress?.(`Chrome for Testing 下载失败，正在重试 (${attempt + 1}/${DOWNLOAD_MAX_ATTEMPTS})`);
+                try {
+                    await options.retryDelay(attempt, options.signal);
+                }
+                catch (delayError) {
+                    throwIfAborted(options.signal);
+                    throw delayError;
+                }
+            }
+        }
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    throw new Error("Chrome for Testing download failed");
+}
+async function downloadArchiveAttempt(options, descriptor) {
+    let response;
+    try {
+        response = await options.fetchArtifact(options.url, { signal: options.signal });
+    }
+    catch (error) {
+        throw new RetryableDownloadError(`Chrome for Testing download failed: ${formatChromeForTestingNetworkError(error)}`, { cause: error });
+    }
     if (!response.ok) {
-        throw new Error(`Chrome for Testing download failed: HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`);
+        try {
+            await response.body?.cancel();
+        }
+        catch {
+            // The status code remains the useful failure when response cleanup fails.
+        }
+        const error = new Error(`Chrome for Testing download failed: HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`);
+        if (response.status >= 500)
+            throw new RetryableDownloadError(error.message, { cause: error });
+        throw error;
     }
     if (!response.body)
         throw new Error("Chrome for Testing download returned no response body");
@@ -461,15 +511,20 @@ async function downloadArchive(options) {
         throw new Error(`Chrome for Testing archive exceeds ${options.maxArchiveBytes} bytes`);
     }
     const hash = createHash("sha256");
-    const descriptor = openSync(options.destination, "wx", 0o600);
     let bytes = 0;
-    let nextPercent = DOWNLOAD_PROGRESS_PERCENT_STEP;
+    let lastReportedPercent = 0;
     let nextBytes = DOWNLOAD_PROGRESS_BYTES_STEP;
     const reader = response.body.getReader();
     try {
         while (true) {
             throwIfAborted(options.signal);
-            const next = await reader.read();
+            let next;
+            try {
+                next = await reader.read();
+            }
+            catch (error) {
+                throw new RetryableDownloadError(`Chrome for Testing download failed: ${formatChromeForTestingNetworkError(error)}`, { cause: error });
+            }
             if (next.done)
                 break;
             const chunk = Buffer.from(next.value);
@@ -478,24 +533,24 @@ async function downloadArchive(options) {
                 throw new Error(`Chrome for Testing archive exceeds ${options.maxArchiveBytes} bytes`);
             }
             hash.update(chunk);
-            writeAll(descriptor, chunk);
+            writeAll(descriptor, chunk, bytes - chunk.byteLength);
             if (length !== undefined && length > 0) {
                 const completed = Math.min(100, Math.floor(bytes * 100 / length));
-                while (nextPercent <= completed) {
-                    options.onProgress?.(`Chrome for Testing 下载进度：${nextPercent}%`);
-                    nextPercent += DOWNLOAD_PROGRESS_PERCENT_STEP;
+                if (completed >= lastReportedPercent + DOWNLOAD_PROGRESS_PERCENT_STEP) {
+                    lastReportedPercent = completed;
+                    options.onProgress?.(`Chrome for Testing 下载进度：${formatDownloadMegabytes(bytes)} / ` +
+                        `${formatDownloadMegabytes(length)} (${completed}%)`);
                 }
             }
             else {
                 while (nextBytes <= bytes) {
-                    options.onProgress?.(`Chrome for Testing 已下载：${formatDownloadBytes(nextBytes)}`);
+                    options.onProgress?.(`Chrome for Testing 已下载：${formatDownloadMegabytes(nextBytes)}`);
                     nextBytes += DOWNLOAD_PROGRESS_BYTES_STEP;
                 }
             }
         }
     }
     finally {
-        closeSync(descriptor);
         reader.releaseLock();
     }
     const actual = hash.digest("hex");
@@ -504,13 +559,18 @@ async function downloadArchive(options) {
     }
     return actual;
 }
-function formatDownloadBytes(bytes) {
-    return `${Math.floor(bytes / (1_024 * 1_024))} MiB`;
+class RetryableDownloadError extends Error {
+}
+async function defaultDownloadRetryDelay(attempt, signal) {
+    await delay(2 ** attempt * 1_000, undefined, { signal });
+}
+function formatDownloadMegabytes(bytes) {
+    return `${(bytes / (1_024 * 1_024)).toFixed(1)} MB`;
 }
-function writeAll(descriptor, value) {
+function writeAll(descriptor, value, position) {
     let offset = 0;
     while (offset < value.byteLength) {
-        const written = writeSync(descriptor, value, offset, value.byteLength - offset);
+        const written = writeSync(descriptor, value, offset, value.byteLength - offset, position + offset);
         if (written <= 0)
             throw new Error("Chrome for Testing archive write made no progress");
         offset += written;
@@ -841,7 +901,7 @@ function throwIfAborted(signal) {
         throw new Error("Chrome for Testing installation aborted");
 }
 async function defaultFetchArtifact(url, init) {
-    return fetch(url, { signal: init.signal, redirect: "follow" });
+    return fetchChromeForTesting(url, { signal: init.signal, redirect: "follow" });
 }
 async function defaultExtractZip(archivePath, destination) {
     await extractZipArchive(archivePath, { dir: destination });

package/dist/daemon-server.js

@@ -17,8 +17,8 @@ import { REMOTE_RUNTIME_CORE_PROTOCOL } from "@rynx-ai/protocol/remote-runtime";
 import { RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES, RUNTIME_BROWSER_INSPECT_SEMANTIC_CAPABILITY, } from "@rynx-ai/protocol/runtime-browser-inspect";
 import { RUNTIME_BROWSER_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-browser-surface";
 import { RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY } from "@rynx-ai/protocol/runtime-emulator-surface";
-import { createDaemonRuntimeHost, createDesktopFirstSessionBrowserHost, createRunnerSessionTerminalHost, createSessionRuntimeServices, DesktopBrowserHostAbsentError, DesktopBrowserHostRegistry, DirectRuntimeConnectionHub, DirectRuntimeBrowserInspectHostError, MachineSessionService, MachineSessionServiceFailure, RemoteRuntimeDispatcher, SessionBrowserService, SessionBrowserServiceError, SessionBrowserSurfaceCoordinator, SessionEmulatorService, startServer, startDirectRuntimeServer, } from "@rynx-ai/server";
-import { authorizeSessionPortalGrant, redeemSessionPortalTicket, } from "./session-portal-grant-store.js";
+import { createDaemonRuntimeHost, createDesktopFirstSessionBrowserHost, createRunnerSessionTerminalHost, createSessionRuntimeServices, DesktopBrowserHostAbsentError, DesktopBrowserHostRegistry, DirectRuntimeConnectionHub, DirectRuntimeBrowserInspectHostError, MachineSessionService, MachineSessionServiceFailure, RemoteRuntimeDispatcher, SessionPendingInputIndex, SessionBrowserService, SessionBrowserServiceError, SessionBrowserSurfaceCoordinator, SessionEmulatorService, startServer, startDirectRuntimeServer, } from "@rynx-ai/server";
+import { authorizeSessionPortalGrant, inspectSessionPortalGrant, onSessionPortalGrantRevoked, redeemSessionPortalTicket, revokeEmbeddedWritableSessionPortalGrants, } from "./session-portal-grant-store.js";
 import { APP_BROWSER_HOST_BOOTSTRAP_TYPE, AppBrowserHostSupervisor, parseAppBrowserHostLaunchConfig, } from "./app-browser-host-supervisor.js";
 import { buildControlDeps, listControlAgentModels } from "./control-deps.js";
 import { createBrowserArtifactManagementService } from "./browser-artifact-management.js";
@@ -311,7 +311,9 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                 "semantic.session.interaction.v1",
                 "semantic.project.manage.v1",
                 "semantic.provider-cli.status.v1",
-                ...(runtimeBrowserSupported ? ["semantic.browser.v1"] : []),
+                ...(runtimeBrowserSupported
+                    ? ["semantic.browser.v1", "semantic.browser.request-headers.v1"]
+                    : []),
                 ...(runtimeBrowserSupported && directHostingSupported
                     ? [
                         RUNTIME_BROWSER_SURFACE_SEMANTIC_CAPABILITY,
@@ -387,6 +389,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
             };
         };
         let machineSessions;
+        let sessionBrowsers;
         const pluginRuntime = {
             bindHostServices: (services) => pluginSupervisor.bindHostServices({
                 ...services,
@@ -396,6 +399,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                     publicKey: installationIdentity.publicKey,
                     sign: installationIdentity.sign,
                 },
+                sessionBrowserRequestHeaders: sessionBrowsers,
                 sessionLaunch: {
                     resolve: async (selection) => {
                         const workspace = await resolveSessionWorkspace(runtimeProjects, selection.projectId, selection.managedCwd, selection.workspace);
@@ -434,6 +438,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
         const directConnections = new DirectRuntimeConnectionHub();
         const sessionLog = new SqliteSessionLogStore();
         const sessionResources = new SqliteSessionResourceStore();
+        const sessionPendingInputs = new SessionPendingInputIndex();
         const sessionForks = new SqliteSessionForkStore();
         const runtimeProjects = new SqliteRuntimeProjectStore();
         const providerClis = new ProviderCliService();
@@ -446,6 +451,11 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
         const sessionRuntimeServices = createSessionRuntimeServices({
             config: appConfig,
             sessionLog,
+            pendingInputs: sessionPendingInputs,
+            onPendingInputPersisted: (input) => sessionResources.markMessageMirrored(input.sessionId, input.clientMessageId, {
+                responseId: input.responseId,
+                messageItemId: input.messageItemId,
+            }),
             sessionContextProvider: browserRunnerSessionContexts,
             admissionOpen,
             admissionReserve: reserveAdmission,
@@ -455,7 +465,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
         const sessionBrowserHost = appBrowserHostSupervisor
             ? createSupervisedAppSessionBrowserHost(durableDesktopBrowserHost, appBrowserHostSupervisor)
             : createDesktopFirstSessionBrowserHost(durableDesktopBrowserHost, createHeadlessBrowserHost());
-        const sessionBrowsers = new SessionBrowserService({
+        sessionBrowsers = new SessionBrowserService({
             host: sessionBrowserHost,
             sessions: {
                 exists: async (sessionId) => Boolean(sessionRegistry.get(sessionId) ??
@@ -556,6 +566,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                 list: () => control.listAgents(),
             },
             pendingMessages: sessionPendingMessageStore,
+            pendingInputs: sessionPendingInputs,
             resources: sessionResources,
             forks: sessionForks,
             execution: {
@@ -769,6 +780,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                 status: async () => asDaemonChromeInspectionStatus(await initializedChromeInspectionManager.status()),
                 configure: async (input) => asDaemonChromeInspectionStatus(await initializedChromeInspectionManager.configure(input)),
             };
+            revokeEmbeddedWritableSessionPortalGrants();
             server = await startServer({
                 config: appConfig,
                 control,
@@ -801,8 +813,10 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, onShut
                     daemonInstanceId,
                 },
                 sessionPortalAuthorization: {
-                    redeem: redeemSessionPortalTicket,
+                    redeem: (ticket, embedOrigin) => redeemSessionPortalTicket(ticket, new Date(), embedOrigin),
                     authorize: authorizeSessionPortalGrant,
+                    inspect: inspectSessionPortalGrant,
+                    subscribeRevocations: onSessionPortalGrantRevoked,
                     ownsSession: sessionBelongsToPlugin,
                 },
             });

package/dist/db.js

@@ -282,6 +282,17 @@ function migrate(conn) {
     );
     CREATE INDEX IF NOT EXISTS idx_session_portal_grants_expires
       ON session_portal_grants(expires_at);
+    CREATE TABLE IF NOT EXISTS session_timeline_projections (
+      plugin_id     TEXT NOT NULL,
+      session_id    TEXT NOT NULL,
+      projection_id TEXT NOT NULL,
+      request_hash  TEXT NOT NULL,
+      response_id   TEXT NOT NULL,
+      item_id       TEXT NOT NULL UNIQUE,
+      state         TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending', 'completed')),
+      created_at    TEXT NOT NULL,
+      PRIMARY KEY(plugin_id, session_id, projection_id)
+    );
     CREATE TABLE IF NOT EXISTS runtime_pairing_claims (
       claim_id                   TEXT PRIMARY KEY,
       secret_hash                TEXT NOT NULL,
@@ -359,6 +370,17 @@ function migrate(conn) {
     addColumnIfMissing(conn, "session_message_operations", "response_id", "TEXT");
     addColumnIfMissing(conn, "session_message_operations", "message_item_id", "TEXT");
     addColumnIfMissing(conn, "session_message_operations", "execution_snapshot", "TEXT");
+    addColumnIfMissing(conn, "session_portal_tickets", "grant_handle", "TEXT");
+    addColumnIfMissing(conn, "session_portal_tickets", "embed_origin", "TEXT");
+    addColumnIfMissing(conn, "session_portal_grants", "grant_handle", "TEXT");
+    addColumnIfMissing(conn, "session_portal_grants", "embed_origin", "TEXT");
+    addColumnIfMissing(conn, "session_timeline_projections", "state", "TEXT NOT NULL DEFAULT 'pending'");
+    conn.exec(`
+    CREATE INDEX IF NOT EXISTS idx_session_portal_tickets_grant_handle
+      ON session_portal_tickets(plugin_id, grant_handle);
+    CREATE INDEX IF NOT EXISTS idx_session_portal_grants_grant_handle
+      ON session_portal_grants(plugin_id, grant_handle);
+  `);
 }
 /** Rebuild the original image-only table without losing committed resources. */
 function migrateSessionResourceFiles(conn) {