@schlessera/brain-ui-server 0.4.0

package/dist/ws/shrink.js

@@ -0,0 +1,91 @@
+/**
+ * Size-bounding for outbound WebSocket frames.
+ *
+ * A single oversized frame — typically a multi-megabyte tool result (a big
+ * `Read`/`Bash`/`Grep` output), a tool_use with a large input, or a tool
+ * result whose content array holds thousands of blocks — can exceed the
+ * socket's per-frame limit, drop the connection, and (because the client
+ * reconnects and re-requests the same history) wedge into a reconnect loop.
+ *
+ * This helper bounds any JSON-serializable payload below
+ * {@link MAX_WS_MESSAGE_BYTES} by head-truncating long strings AND
+ * head-clipping long arrays, leaving small metadata (ids, types, statuses)
+ * untouched. Both axes matter: string truncation alone leaves the cap
+ * unenforced for a payload built of many short strings. The model already
+ * received the full tool output server-side — this only bounds what the
+ * browser renders.
+ *
+ * Ported from oh-my-pi's collab replication-shrink.
+ */
+/** Per-frame ceiling for server → client messages. Well under Bun's 16 MB
+ * default and typical reverse-proxy WebSocket limits. */
+export const MAX_WS_MESSAGE_BYTES = 512_000;
+/** Target byte size for one `session_history` chunk. Below the frame cap so a
+ * batch plus its wrapper stays comfortably under {@link MAX_WS_MESSAGE_BYTES}. */
+export const HISTORY_CHUNK_BYTES = 400_000;
+/**
+ * Progressive shrink passes. Each tightens both the per-string cap and the
+ * per-array head limit; the loop stops at the first pass whose output fits
+ * {@link MAX_WS_MESSAGE_BYTES}. The final pass clamps every string to 64 B and
+ * every array to one element, so even pathological mixes converge.
+ */
+const SHRINK_PASSES = [
+    { stringCap: 64 * 1024, arrayLimit: 256 },
+    { stringCap: 16 * 1024, arrayLimit: 128 },
+    { stringCap: 4 * 1024, arrayLimit: 64 },
+    { stringCap: 1 * 1024, arrayLimit: 32 },
+    { stringCap: 256, arrayLimit: 16 },
+    { stringCap: 256, arrayLimit: 4 },
+    { stringCap: 64, arrayLimit: 1 },
+];
+const STRING_ELISION_RESERVE = 80;
+/**
+ * Recursively walk `value`, head-truncating any string longer than
+ * `stringCap` and head-clipping any array longer than `arrayLimit`. Returns a
+ * freshly built deep clone; short strings/numbers/booleans pass through.
+ */
+function shrinkWalk(value, stringCap, arrayLimit) {
+    if (typeof value === "string") {
+        if (value.length <= stringCap)
+            return value;
+        const headLen = Math.max(0, stringCap - STRING_ELISION_RESERVE);
+        return `${value.slice(0, headLen)}\n…[${value.length - headLen} chars elided]`;
+    }
+    if (Array.isArray(value)) {
+        const keep = Math.min(value.length, arrayLimit);
+        const elided = value.length - keep;
+        const out = new Array(elided > 0 ? keep + 1 : keep);
+        for (let i = 0; i < keep; i++)
+            out[i] = shrinkWalk(value[i], stringCap, arrayLimit);
+        if (elided > 0)
+            out[keep] = `…[${elided} items elided]`;
+        return out;
+    }
+    if (value && typeof value === "object") {
+        const src = value;
+        const out = {};
+        for (const k in src)
+            out[k] = shrinkWalk(src[k], stringCap, arrayLimit);
+        return out;
+    }
+    return value;
+}
+/**
+ * Return `value` unchanged when its JSON serialization already fits
+ * {@link MAX_WS_MESSAGE_BYTES}; otherwise return a deep-cloned shadow shrunk
+ * along both string and array axes until it fits. The wire shape is preserved:
+ * only string leaves and array tails change — discriminator fields, ids, and
+ * other small metadata pass through untouched.
+ */
+export function shrinkForReplication(value) {
+    if (JSON.stringify(value).length <= MAX_WS_MESSAGE_BYTES)
+        return value;
+    let shrunk = value;
+    for (const pass of SHRINK_PASSES) {
+        shrunk = shrinkWalk(value, pass.stringCap, pass.arrayLimit);
+        if (JSON.stringify(shrunk).length <= MAX_WS_MESSAGE_BYTES)
+            return shrunk;
+    }
+    return shrunk;
+}
+//# sourceMappingURL=shrink.js.map

package/dist/ws/shrink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shrink.js","sourceRoot":"","sources":["../../src/ws/shrink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;yDACyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;kFACkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAO3C;;;;;GAKG;AACH,MAAM,aAAa,GAA0B;IAC3C,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;IACzC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;IACzC,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;IACvC,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;IACvC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;IAClC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE;IACjC,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;CACjC,CAAC;AAEF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAc,EAAE,SAAiB,EAAE,UAAkB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,sBAAsB,CAAC,CAAC;QAChE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,KAAK,CAAC,MAAM,GAAG,OAAO,gBAAgB,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACnC,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACpF,IAAI,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,gBAAgB,CAAC;QACxD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAI,KAAQ;IAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,oBAAoB;YAAE,OAAO,MAAW,CAAC;IAChF,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC"}

package/dist/ws/turns.d.ts

@@ -0,0 +1,77 @@
+import type { AgentBackend, PermissionDecision, AskUserResult, LocationFix } from "@schlessera/brain-ui-sdk/server";
+import type { ChatImageAttachment } from "@schlessera/brain-ui-sdk/protocol";
+export interface QueuedFollowUp {
+    text: string;
+    attachments: ChatImageAttachment[];
+}
+/**
+ * One RUNNING session slot. `abortController`/`timeoutHandle` belong to the
+ * turn currently executing; a queued follow-up runs as the next turn in the
+ * same slot (same sessionId) after the current one resolves.
+ */
+export interface RunningTurn {
+    sessionId: string | null;
+    /** Host-minted id of the CURRENT turn in this slot; re-minted per queued follow-up. */
+    turnId: string;
+    providerId: string | null;
+    backend: AgentBackend;
+    abortController: AbortController;
+    timeoutHandle: ReturnType<typeof setTimeout>;
+    queue: QueuedFollowUp[];
+    cancelled: boolean;
+}
+export interface PendingApproval {
+    turn: RunningTurn;
+    turnId: string;
+    resolve: (decision: PermissionDecision) => void;
+}
+export interface PendingAskUser {
+    turn: RunningTurn;
+    turnId: string;
+    resolve: (result: AskUserResult) => void;
+    reject: (err: Error) => void;
+}
+export interface PendingLocation {
+    turn: RunningTurn;
+    turnId: string;
+    resolve: (result: LocationFix) => void;
+    reject: (err: Error) => void;
+}
+/**
+ * Mutable turn state for one ws host: the running session slots and every
+ * pending interactive round-trip. This used to be six module-level globals
+ * inside a 976-line handler; as instance state it is testable and owned by an
+ * explicit object with a defined lifecycle.
+ */
+export declare class TurnCoordinator {
+    readonly running: Set<RunningTurn>;
+    readonly bySession: Map<string, RunningTurn>;
+    startingSessions: number;
+    readonly pendingApprovals: Map<string, PendingApproval>;
+    readonly pendingAskUser: Map<string, PendingAskUser>;
+    readonly pendingLocation: Map<string, PendingLocation>;
+    private locationCounter;
+    nextLocationRequestId(): string;
+    /** True while any session has a running turn. */
+    isTurnActive(): boolean;
+    /** Cancel every running turn (used on shutdown). */
+    cancelAll(reason: string): boolean;
+    /** Cancel a session's current turn and drop its queued follow-ups. */
+    cancelTurn(turn: RunningTurn, reason: string): void;
+    /** Resolve/reject every pending interactive request belonging to one turn. */
+    drainPendingForTurn(turn: RunningTurn, reason: string): void;
+    /**
+     * Interactive-request ids (tool-approval / ask-user / location) must be
+     * globally unique so an inbound response resolves the correct turn's
+     * promise. The current backends mint unique ids (SDK tool-use ids,
+     * crypto.randomUUID, a host counter), so a collision across live turns means
+     * a future backend broke that invariant — fail the new request loudly rather
+     * than silently overwriting (and thus resolving) another turn's entry.
+     */
+    collidesAcrossTurns<T extends {
+        turn: RunningTurn;
+    }>(map: Map<string, T>, id: string, turn: RunningTurn): boolean;
+    /** Test seam: abort everything and clear all turn/pending state. */
+    reset(): void;
+}
+//# sourceMappingURL=turns.d.ts.map

package/dist/ws/turns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turns.d.ts","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,WAAW,EACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC7C,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACzC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,QAAQ,CAAC,OAAO,mBAA0B;IAC1C,QAAQ,CAAC,SAAS,2BAAkC;IACpD,gBAAgB,SAAK;IAErB,QAAQ,CAAC,gBAAgB,+BAAsC;IAC/D,QAAQ,CAAC,cAAc,8BAAqC;IAC5D,QAAQ,CAAC,eAAe,+BAAsC;IAE9D,OAAO,CAAC,eAAe,CAAK;IAE5B,qBAAqB,IAAI,MAAM;IAI/B,iDAAiD;IACjD,YAAY,IAAI,OAAO;IAIvB,oDAAoD;IACpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAMlC,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQnD,8EAA8E;IAC9E,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAkB5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,GAChB,OAAO;IAWV,oEAAoE;IACpE,KAAK,IAAI,IAAI;CAYd"}

package/dist/ws/turns.js

@@ -0,0 +1,89 @@
+/**
+ * Mutable turn state for one ws host: the running session slots and every
+ * pending interactive round-trip. This used to be six module-level globals
+ * inside a 976-line handler; as instance state it is testable and owned by an
+ * explicit object with a defined lifecycle.
+ */
+export class TurnCoordinator {
+    running = new Set();
+    bySession = new Map();
+    startingSessions = 0;
+    pendingApprovals = new Map();
+    pendingAskUser = new Map();
+    pendingLocation = new Map();
+    locationCounter = 0;
+    nextLocationRequestId() {
+        return `loc-${Date.now().toString(36)}-${++this.locationCounter}`;
+    }
+    /** True while any session has a running turn. */
+    isTurnActive() {
+        return this.running.size > 0;
+    }
+    /** Cancel every running turn (used on shutdown). */
+    cancelAll(reason) {
+        if (this.running.size === 0)
+            return false;
+        for (const turn of [...this.running])
+            this.cancelTurn(turn, reason);
+        return true;
+    }
+    /** Cancel a session's current turn and drop its queued follow-ups. */
+    cancelTurn(turn, reason) {
+        turn.cancelled = true;
+        turn.queue.length = 0;
+        clearTimeout(turn.timeoutHandle);
+        turn.abortController.abort();
+        this.drainPendingForTurn(turn, reason);
+    }
+    /** Resolve/reject every pending interactive request belonging to one turn. */
+    drainPendingForTurn(turn, reason) {
+        for (const [id, p] of this.pendingApprovals) {
+            if (p.turn !== turn)
+                continue;
+            p.resolve({ behavior: "deny", message: reason });
+            this.pendingApprovals.delete(id);
+        }
+        for (const [id, p] of this.pendingAskUser) {
+            if (p.turn !== turn)
+                continue;
+            p.reject(new Error(reason));
+            this.pendingAskUser.delete(id);
+        }
+        for (const [id, p] of this.pendingLocation) {
+            if (p.turn !== turn)
+                continue;
+            p.reject(new Error(reason));
+            this.pendingLocation.delete(id);
+        }
+    }
+    /**
+     * Interactive-request ids (tool-approval / ask-user / location) must be
+     * globally unique so an inbound response resolves the correct turn's
+     * promise. The current backends mint unique ids (SDK tool-use ids,
+     * crypto.randomUUID, a host counter), so a collision across live turns means
+     * a future backend broke that invariant — fail the new request loudly rather
+     * than silently overwriting (and thus resolving) another turn's entry.
+     */
+    collidesAcrossTurns(map, id, turn) {
+        const existing = map.get(id);
+        if (existing && existing.turn !== turn) {
+            console.error(`[ws] interactive id collision: "${id}" is already pending for another turn`);
+            return true;
+        }
+        return false;
+    }
+    /** Test seam: abort everything and clear all turn/pending state. */
+    reset() {
+        for (const turn of [...this.running]) {
+            clearTimeout(turn.timeoutHandle);
+            turn.abortController.abort();
+        }
+        this.running.clear();
+        this.bySession.clear();
+        this.pendingApprovals.clear();
+        this.pendingAskUser.clear();
+        this.pendingLocation.clear();
+        this.startingSessions = 0;
+    }
+}
+//# sourceMappingURL=turns.js.map

package/dist/ws/turns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turns.js","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAqDA;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACjC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC;IAEZ,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,eAAe,GAAG,CAAC,CAAC;IAE5B,qBAAqB;QACnB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IAED,iDAAiD;IACjD,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAiB,EAAE,MAAc;QACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,GAAmB,EACnB,EAAU,EACV,IAAiB;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,mCAAmC,EAAE,uCAAuC,CAC7E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/migrations/001_initial.sql

@@ -0,0 +1,29 @@
+-- Chat session metadata (Claude SDK stores actual messages in JSONL)
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  title TEXT,
+  created_at INTEGER NOT NULL,
+  last_active_at INTEGER NOT NULL,
+  total_cost_usd REAL DEFAULT 0,
+  num_turns INTEGER DEFAULT 0
+);
+
+-- Cron job run history
+CREATE TABLE IF NOT EXISTS cron_runs (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  job_name TEXT NOT NULL,
+  started_at INTEGER NOT NULL,
+  finished_at INTEGER,
+  status TEXT NOT NULL CHECK (status IN ('running', 'success', 'error')),
+  error_message TEXT,
+  duration_ms INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_cron_runs_job ON cron_runs(job_name, started_at DESC);
+
+-- Migrations tracking
+CREATE TABLE IF NOT EXISTS _migrations (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  filename TEXT NOT NULL UNIQUE,
+  applied_at INTEGER NOT NULL
+);

package/migrations/002_session_provider.sql

@@ -0,0 +1 @@
+ALTER TABLE sessions ADD COLUMN provider_id TEXT;

package/migrations/003_session_backend.sql

@@ -0,0 +1,5 @@
+-- Which AgentBackend owns a session's transcript (e.g. "claude" | "pi").
+-- One backend is active per deployment in v1, but the column is added now so a
+-- later per-session-backend change needs no migration. Populated on session
+-- creation from the active backend id.
+ALTER TABLE sessions ADD COLUMN backend_id TEXT;

package/migrations/004_drop_gemini_backend.sql

@@ -0,0 +1,20 @@
+-- Phase-5 hardening: the native Gemini backend was removed. Reconcile sessions
+-- that were pinned to it so they resume cleanly on the default (Claude) backend
+-- instead of dangling on a backend id that no longer resolves.
+--
+-- Rollback note: this rewrites data. Redeploying a Gemini-aware image does NOT
+-- restore these ids; a rollback that needs them must reinstate them separately.
+
+-- Clear the profile pin for any session that ran on the removed backend — those
+-- profile ids do not exist under the default backend.
+UPDATE sessions SET provider_id = NULL WHERE backend_id = 'gemini';
+
+-- Point those sessions at the default backend (getBackendForSession resolves a
+-- NULL/unknown backend_id to the default).
+UPDATE sessions SET backend_id = NULL WHERE backend_id = 'gemini';
+
+-- Migrate the pre-extraction Claude profile id to its renamed, byte-identical
+-- successor so those sessions keep their pin instead of silently dropping to the
+-- default model.
+UPDATE sessions SET provider_id = 'claude-sonnet-4-6'
+WHERE provider_id = 'anthropic-sonnet';

package/migrations/005_passkey_credentials.sql

@@ -0,0 +1,18 @@
+-- WebAuthn passkey credentials (single-user app: no user_id column).
+-- rp_id scopes each credential to the relying party it was registered on
+-- (localhost dev credentials and prod-domain credentials coexist).
+CREATE TABLE passkey_credentials (
+  id TEXT PRIMARY KEY,                  -- base64url credential id
+  public_key BLOB NOT NULL,             -- COSE public key bytes
+  counter INTEGER NOT NULL DEFAULT 0,   -- signature counter (0 forever for cloud passkeys)
+  transports TEXT,                      -- JSON array, e.g. ["internal","hybrid"], or NULL
+  rp_id TEXT NOT NULL,
+  aaguid TEXT,
+  device_type TEXT,                     -- 'singleDevice' | 'multiDevice'
+  backed_up INTEGER NOT NULL DEFAULT 0,
+  label TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL,
+  last_used_at INTEGER
+);
+
+CREATE INDEX idx_passkey_credentials_rp_id ON passkey_credentials(rp_id);

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@schlessera/brain-ui-server",
+  "version": "0.4.0",
+  "description": "brain-kit chat-UI server: Hono app factory, WebSocket turn coordinator, auth (password/passkeys/tailscale/proxy), session catalog, and brain/files/voice routes",
+  "license": "MIT",
+  "keywords": [
+    "brain-kit",
+    "server",
+    "hono",
+    "websocket",
+    "ai-agents"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/schlessera/brain-kit.git",
+    "directory": "packages/ui-server"
+  },
+  "homepage": "https://github.com/schlessera/brain-kit",
+  "bugs": {
+    "url": "https://github.com/schlessera/brain-kit/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "src",
+    "dist",
+    "migrations",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "bun test tests",
+    "prepublishOnly": "bun ../../scripts/check-dist.ts"
+  },
+  "dependencies": {
+    "@schlessera/brain-backend-claude": "0.4.0",
+    "@schlessera/brain-ui-sdk": "0.4.0",
+    "@simplewebauthn/server": "^13.3.2",
+    "hono": "^4",
+    "ignore": "^7.0.5",
+    "marked": "^18.0.4",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@schlessera/brain-backend-pi": "0.4.0",
+    "@types/bun": ">=1.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@schlessera/brain-backend-pi": {
+      "optional": true
+    },
+    "@types/bun": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.14",
+    "typescript": "^6.0.3"
+  }
+}