@swestash/agent-lens 0.11.0 → 0.12.0

package/dist/agent-lens.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { existsSync as existsSync10, writeFileSync as writeFileSync3 } from "fs";
-import { join as join12 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync10, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // ../../node_modules/.pnpm/cac@6.7.14/node_modules/cac/dist/index.mjs
 import { EventEmitter } from "events";
@@ -921,6 +921,29 @@ END;
 `
 );
 
+// ../core/dist/sqlite.js
+function runNamed(stmt, row) {
+  return stmt.run(row);
+}
+var savepointSeq = 0;
+function transaction(db, fn) {
+  return (...args) => {
+    const savepoint = db.isTransaction ? `agent_lens_sp_${savepointSeq++}` : "";
+    db.exec(savepoint ? `SAVEPOINT ${savepoint}` : "BEGIN");
+    try {
+      const result = fn(...args);
+      db.exec(savepoint ? `RELEASE ${savepoint}` : "COMMIT");
+      return result;
+    } catch (err) {
+      try {
+        db.exec(savepoint ? `ROLLBACK TO ${savepoint}; RELEASE ${savepoint}` : "ROLLBACK");
+      } catch {
+      }
+      throw err;
+    }
+  };
+}
+
 // ../core/dist/security.js
 var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
 function severityRank(s) {
@@ -1076,7 +1099,7 @@ function scrubUsernames(text, users) {
 }
 
 // ../core/dist/redact-export.js
-import { createHash } from "crypto";
+import { createHash } from "node:crypto";
 
 // ../core/dist/markdown.js
 function truncate(s) {
@@ -1313,6 +1336,9 @@ var activeTable = PRICE_TABLE;
 function usePricing(table) {
   activeTable = table;
 }
+function activePricing() {
+  return activeTable;
+}
 function rateForModel(model) {
   if (!model)
     return null;
@@ -1333,25 +1359,24 @@ function costForUsage(model, u) {
 }
 
 // ../core/dist/rawjson.js
-import { gzipSync, gunzipSync } from "zlib";
+import { gzipSync, gunzipSync } from "node:zlib";
 function packRaw(json) {
   return gzipSync(Buffer.from(json, "utf8"));
 }
 function unpackRaw(value) {
-  if (Buffer.isBuffer(value)) {
-    if (value.length >= 2 && value[0] === 31 && value[1] === 139) {
-      return gunzipSync(value).toString("utf8");
-    }
-    return value.toString("utf8");
+  if (typeof value === "string")
+    return value;
+  if (value.length >= 2 && value[0] === 31 && value[1] === 139) {
+    return gunzipSync(value).toString("utf8");
   }
-  return value;
+  return Buffer.from(value).toString("utf8");
 }
 
 // ../core/dist/paths.js
-import { existsSync, readFileSync } from "fs";
-import { dirname, join, resolve } from "path";
-import { fileURLToPath } from "url";
-import { homedir, platform } from "os";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir, platform } from "node:os";
 function expandPath(p) {
   if (!p)
     return p;
@@ -1429,8 +1454,8 @@ function resolveWebDist(fromDir, repoRoot = findRepoRoot(fromDir)) {
 }
 
 // ../core/dist/config.js
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 var DEFAULT_PORT = 4477;
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_DB_NAME = "agent-lens.db";
@@ -1512,10 +1537,10 @@ function resolveServerConfig(overrides = {}, cfg = readConfigFile()) {
 }
 
 // ../core/dist/version.js
-import { spawnSync } from "child_process";
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join3, parse } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { spawnSync } from "node:child_process";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname2, join as join3, parse } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir2 = dirname2(fileURLToPath2(import.meta.url));
 function isPlaceholder(v) {
   return v.startsWith("0.0.0");
@@ -1617,9 +1642,9 @@ function encodeProjectPath(p) {
 }
 
 // ../core/dist/collect.js
-import { appendFileSync, closeSync, copyFileSync, existsSync as existsSync2, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, utimesSync, writeSync, chmodSync } from "fs";
-import { basename, dirname as dirname3, join as join4, relative, sep } from "path";
-import { platform as platform2 } from "os";
+import { appendFileSync, closeSync, copyFileSync, existsSync as existsSync2, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, utimesSync, writeSync, chmodSync } from "node:fs";
+import { basename, dirname as dirname3, join as join4, relative, sep } from "node:path";
+import { platform as platform2 } from "node:os";
 var POSIX = platform2() !== "win32";
 var DIR_MODE = 448;
 var FILE_MODE = 384;
@@ -1838,9 +1863,9 @@ function collectAll(opts = {}) {
 }
 
 // ../core/dist/lock.js
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync } from "fs";
-import { dirname as dirname4 } from "path";
-import { hostname } from "os";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+import { hostname } from "node:os";
 function isAlive(pid) {
   if (!pid)
     return false;
@@ -1880,10 +1905,10 @@ function acquireLock(lockPath, staleMs = 6 * 60 * 60 * 1e3) {
 }
 
 // ../core/dist/service.js
-import { spawnSync as spawnSync2 } from "child_process";
-import { mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2, platform as platform3, userInfo } from "os";
-import { join as join5 } from "path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2, platform as platform3, userInfo } from "node:os";
+import { join as join5 } from "node:path";
 var DEFAULT_HOURS = [9, 13, 17, 21];
 function currentUser() {
   try {
@@ -2208,15 +2233,15 @@ function runService(action, params) {
 }
 
 // ../ingest/dist/run.js
-import { readFileSync as readFileSync6, statSync as statSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { readFileSync as readFileSync6, statSync as statSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname6, join as join9 } from "node:path";
 
 // ../ingest/dist/db.js
-import Database from "better-sqlite3";
+import { DatabaseSync } from "node:sqlite";
 function openRaw(file) {
-  const db = new Database(file);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
+  const db = new DatabaseSync(file);
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA foreign_keys = ON");
   return db;
 }
 function readSchemaVersion(db) {
@@ -2236,37 +2261,40 @@ function openDb(file) {
   return db;
 }
 function resetSchema(db) {
-  db.pragma("foreign_keys = OFF");
-  db.exec(`
-    DROP TRIGGER IF EXISTS events_au;
-    DROP TRIGGER IF EXISTS events_ad;
-    DROP TRIGGER IF EXISTS events_ai;
-    DROP TABLE IF EXISTS events_fts;
-    DROP TABLE IF EXISTS file_changes;
-    DROP TABLE IF EXISTS findings;
-    DROP TABLE IF EXISTS classifications;
-    DROP TABLE IF EXISTS token_usage;
-    DROP TABLE IF EXISTS tool_calls;
-    DROP TABLE IF EXISTS skills;
-    DROP TABLE IF EXISTS events;
-    DROP TABLE IF EXISTS turns;
-    DROP TABLE IF EXISTS sessions;
-    DROP TABLE IF EXISTS projects;
-    DROP TABLE IF EXISTS sources;
-    DROP TABLE IF EXISTS agents;
-    DROP TABLE IF EXISTS workflow_results;
-    DROP TABLE IF EXISTS session_meta;
-    DROP TABLE IF EXISTS tool_results;
-    DROP TABLE IF EXISTS ingest_state;
-    DROP TABLE IF EXISTS meta;
-  `);
-  applySchema(db);
-  db.pragma("foreign_keys = ON");
+  db.exec("PRAGMA foreign_keys = OFF");
+  try {
+    db.exec(`
+      DROP TRIGGER IF EXISTS events_au;
+      DROP TRIGGER IF EXISTS events_ad;
+      DROP TRIGGER IF EXISTS events_ai;
+      DROP TABLE IF EXISTS events_fts;
+      DROP TABLE IF EXISTS file_changes;
+      DROP TABLE IF EXISTS findings;
+      DROP TABLE IF EXISTS classifications;
+      DROP TABLE IF EXISTS token_usage;
+      DROP TABLE IF EXISTS tool_calls;
+      DROP TABLE IF EXISTS skills;
+      DROP TABLE IF EXISTS events;
+      DROP TABLE IF EXISTS turns;
+      DROP TABLE IF EXISTS sessions;
+      DROP TABLE IF EXISTS projects;
+      DROP TABLE IF EXISTS sources;
+      DROP TABLE IF EXISTS agents;
+      DROP TABLE IF EXISTS workflow_results;
+      DROP TABLE IF EXISTS session_meta;
+      DROP TABLE IF EXISTS tool_results;
+      DROP TABLE IF EXISTS ingest_state;
+      DROP TABLE IF EXISTS meta;
+    `);
+    applySchema(db);
+  } finally {
+    db.exec("PRAGMA foreign_keys = ON");
+  }
 }
 
 // ../ingest/dist/adapters/claude-code.js
-import { readdirSync as readdirSync2 } from "fs";
-import { basename as basename2, join as join6 } from "path";
+import { readdirSync as readdirSync2 } from "node:fs";
+import { basename as basename2, join as join6 } from "node:path";
 function flattenText(content) {
   if (content == null)
     return null;
@@ -2527,7 +2555,7 @@ function createDirtySet(db, name, ids) {
   db.exec(`DROP TABLE IF EXISTS ${name}`);
   db.exec(`CREATE TEMP TABLE ${name} (id TEXT PRIMARY KEY)`);
   const ins = db.prepare(`INSERT OR IGNORE INTO ${name} (id) VALUES (?)`);
-  db.transaction((xs) => {
+  transaction(db, (xs) => {
     for (const id of xs)
       ins.run(id);
   })(ids);
@@ -2727,7 +2755,7 @@ function classify(db, dirty) {
        category=excluded.category, complexity_score=excluded.complexity_score,
        complexity_band=excluded.complexity_band, signals_json=excluded.signals_json,
        classifier_version=excluded.classifier_version`);
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     for (const sess of sessions) {
       const toolCounts = toolMix.get(sess.id) ?? {};
       const skills = skillMix.get(sess.id) ?? {};
@@ -2798,8 +2826,8 @@ function classify(db, dirty) {
 }
 
 // ../ingest/dist/detect.js
-import { createHash as createHash2 } from "crypto";
-import { posix as path } from "path";
+import { createHash as createHash2 } from "node:crypto";
+import { posix as path } from "node:path";
 var DETECTOR_VERSION = 8;
 function evidence(s, max = 200) {
   const one = s.replace(/\s+/g, " ").trim();
@@ -3264,7 +3292,7 @@ function detect(db, dirty) {
      VALUES (@id, @session_id, @tool_call_id, @event_uuid, @turn_id, @rule_id, @category, @framework_ref, @severity, @title, @evidence, @signals_json, @detector_version)
      ON CONFLICT(id) DO NOTHING`);
   const delScope = incremental ? "DELETE FROM findings WHERE session_id IN (SELECT id FROM _dirty_sec)" : "DELETE FROM findings";
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     db.exec(delScope);
     for (const row of rows) {
       const ctx = buildContext(row, projPath.get(row.session_id) ?? null, ownedConfigDirs);
@@ -3324,7 +3352,7 @@ function classifyErrors(db, dirty) {
     createDirtySet(db, "_dirty_err", dirty);
   const rows = db.prepare(`SELECT id, result_summary FROM tool_calls WHERE status = 'error'${scope}`).all();
   const update = db.prepare("UPDATE tool_calls SET error_type = ? WHERE id = ?");
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     db.exec(`UPDATE tool_calls SET error_type = NULL WHERE error_type IS NOT NULL${scope}`);
     for (const r of rows)
       update.run(classifyToolError(r.result_summary).type, r.id);
@@ -3337,8 +3365,8 @@ function classifyErrors(db, dirty) {
 }
 
 // ../ingest/dist/filechanges.js
-import { createHash as createHash3 } from "crypto";
-import { posix as path2 } from "path";
+import { createHash as createHash3 } from "node:crypto";
+import { posix as path2 } from "node:path";
 var FILECHANGES_VERSION = 1;
 var FILE_TOOLS = ["Edit", "Write", "NotebookEdit"];
 function fileChangeId(toolCallId, filePath) {
@@ -3370,7 +3398,7 @@ function deriveFileChanges(db, dirty) {
     db.exec("DROP TABLE IF EXISTS _dirty_fc");
     db.exec("CREATE TEMP TABLE _dirty_fc (id TEXT PRIMARY KEY)");
     const ins = db.prepare("INSERT OR IGNORE INTO _dirty_fc (id) VALUES (?)");
-    db.transaction((ids) => {
+    transaction(db, (ids) => {
       for (const id of ids)
         ins.run(id);
     })(dirty);
@@ -3387,7 +3415,7 @@ function deriveFileChanges(db, dirty) {
      VALUES (@id, @tool_call_id, @session_id, @turn_id, @event_uuid, @project_id, @file_path, @tool_name, @lines_added, @lines_removed, @timestamp, @derive_version)
      ON CONFLICT(id) DO NOTHING`);
   const delScope = incremental ? "DELETE FROM file_changes WHERE session_id IN (SELECT id FROM _dirty_fc)" : "DELETE FROM file_changes";
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     db.exec(delScope);
     for (const row of rows) {
       if (row.status === "error")
@@ -3436,10 +3464,10 @@ function deriveFileChanges(db, dirty) {
 }
 
 // ../ingest/dist/canonicalize.js
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { createHash as createHash4 } from "crypto";
-import { dirname as dirname5, join as join7 } from "path";
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { createHash as createHash4 } from "node:crypto";
+import { dirname as dirname5, join as join7 } from "node:path";
 function projectId(agentId, path3) {
   return createHash4("sha1").update(`${agentId}\0${path3}`).digest("hex").slice(0, 16);
 }
@@ -3495,7 +3523,7 @@ function canonicalizeProjects(db, opts = {}) {
   const repointSessions = db.prepare("UPDATE sessions SET project_id = ? WHERE project_id = ?");
   const repointFileChanges = db.prepare("UPDATE file_changes SET project_id = ? WHERE project_id = ?");
   const touched = /* @__PURE__ */ new Set();
-  db.transaction(() => {
+  transaction(db, () => {
     for (const r of rows) {
       const target = canon(r.path);
       if (target === strip(r.path))
@@ -3519,12 +3547,12 @@ function canonicalizeProjects(db, opts = {}) {
     for (const id of touched)
       refresh.run(id);
   })();
-  const removed = db.prepare("DELETE FROM projects WHERE id NOT IN (SELECT DISTINCT project_id FROM sessions WHERE project_id IS NOT NULL)").run().changes;
+  const removed = Number(db.prepare("DELETE FROM projects WHERE id NOT IN (SELECT DISTINCT project_id FROM sessions WHERE project_id IS NOT NULL)").run().changes);
   return { merged, removed };
 }
 
 // ../ingest/dist/pipeline.js
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash5 } from "node:crypto";
 function newStats() {
   return { files: 0, skipped: 0, malformed: 0, newEvents: 0 };
 }
@@ -3588,20 +3616,23 @@ function pruneExcluded(db, excludedPaths) {
     return 0;
   }
   const files = db.prepare("SELECT DISTINCT source_file f FROM events WHERE session_id IN (SELECT id FROM _prune) AND source_file IS NOT NULL").all().map((r) => r.f);
-  db.pragma("foreign_keys = OFF");
-  db.transaction(() => {
-    db.exec("DELETE FROM findings WHERE session_id IN (SELECT id FROM _prune)");
-    db.exec("DELETE FROM file_changes WHERE session_id IN (SELECT id FROM _prune)");
-    for (const t of ["token_usage", "tool_calls", "turns", "events"])
-      db.exec(`DELETE FROM ${t} WHERE session_id IN (SELECT id FROM _prune)`);
-    db.exec("DELETE FROM classifications WHERE scope = 'session' AND target_id IN (SELECT id FROM _prune)");
-    db.exec("DELETE FROM sessions WHERE id IN (SELECT id FROM _prune)");
-    const delState = db.prepare("DELETE FROM ingest_state WHERE file_path = ?");
-    for (const f of files)
-      delState.run(f);
-    db.exec("DELETE FROM projects WHERE id NOT IN (SELECT DISTINCT project_id FROM sessions WHERE project_id IS NOT NULL)");
-  })();
-  db.pragma("foreign_keys = ON");
+  db.exec("PRAGMA foreign_keys = OFF");
+  try {
+    transaction(db, () => {
+      db.exec("DELETE FROM findings WHERE session_id IN (SELECT id FROM _prune)");
+      db.exec("DELETE FROM file_changes WHERE session_id IN (SELECT id FROM _prune)");
+      for (const t of ["token_usage", "tool_calls", "turns", "events"])
+        db.exec(`DELETE FROM ${t} WHERE session_id IN (SELECT id FROM _prune)`);
+      db.exec("DELETE FROM classifications WHERE scope = 'session' AND target_id IN (SELECT id FROM _prune)");
+      db.exec("DELETE FROM sessions WHERE id IN (SELECT id FROM _prune)");
+      const delState = db.prepare("DELETE FROM ingest_state WHERE file_path = ?");
+      for (const f of files)
+        delState.run(f);
+      db.exec("DELETE FROM projects WHERE id NOT IN (SELECT DISTINCT project_id FROM sessions WHERE project_id IS NOT NULL)");
+    })();
+  } finally {
+    db.exec("PRAGMA foreign_keys = ON");
+  }
   db.exec("DROP TABLE IF EXISTS _prune");
   return total;
 }
@@ -3683,12 +3714,12 @@ function rebuildTurns(db, scope, sessionIds) {
   const insTurn = db.prepare(`INSERT INTO turns (id, session_id, seq, user_event_uuid, prompt_preview, model, started_at, ended_at, duration_ms)
      VALUES (@id, @session_id, @seq, @user_event_uuid, @prompt_preview, @model, @started_at, @ended_at, @duration_ms)`);
   const updEventTurn = db.prepare("UPDATE events SET turn_id = ? WHERE uuid = ?");
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     for (const { id } of sessionIds) {
       const rows = selEvents.all(id);
       const { turns, eventTurn } = buildTurns(id, rows);
       for (const t of turns)
-        insTurn.run(t);
+        runNamed(insTurn, t);
       for (const [uuid, turnId] of eventTurn)
         updEventTurn.run(turnId, uuid);
     }
@@ -3707,7 +3738,7 @@ function linkSkillVersions(db, sessionIds) {
        first_seen = MIN(first_seen, excluded.first_seen),
        base_dir   = excluded.base_dir`);
   const linkCall = db.prepare("UPDATE tool_calls SET skill_id = ? WHERE id = ?");
-  const linkTx = db.transaction(() => {
+  const linkTx = transaction(db, () => {
     for (const { id: sid } of sessionIds) {
       const calls = selSkillCalls.all(sid);
       if (!calls.length)
@@ -3905,7 +3936,7 @@ function prepareStatements(db) {
 function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
   const sessionMeta = {};
   let eventsInFile = 0;
-  const tx = db.transaction(() => {
+  const tx = transaction(db, () => {
     stmts.insSessionStub.run(file.sessionId, adapter.agentId, file.sourceId);
     let seq = 0;
     for (const line of lines) {
@@ -3929,10 +3960,10 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
         }
       }
       if (parsed.tokenUsage)
-        stmts.insTokens.run(parsed.tokenUsage);
+        runNamed(stmts.insTokens, parsed.tokenUsage);
       if (parsed.toolCalls)
         for (const tc of parsed.toolCalls)
-          stmts.insTool.run(tc);
+          runNamed(stmts.insTool, tc);
       if (parsed.toolResults)
         for (const tr of parsed.toolResults)
           stmts.patchTool.run({
@@ -3986,14 +4017,13 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
 }
 
 // ../ingest/dist/workflows.js
-import { basename as basename3 } from "path";
+import { basename as basename3 } from "node:path";
 
 // ../ingest/dist/sidecar.js
-import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { join as join8 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // ../ingest/dist/redact.js
-import { createHash as createHash6, randomBytes } from "crypto";
 function parseExcludes(csv) {
   return (csv ?? "").split(",").map((s) => s.trim()).filter(Boolean).map(encodeProjectPath);
 }
@@ -4002,17 +4032,17 @@ function isExcludedArchivePath(filePath, excluded) {
 }
 
 // ../ingest/dist/fileread.js
-import { createHash as createHash7 } from "crypto";
-import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
-import { StringDecoder } from "string_decoder";
+import { createHash as createHash6 } from "node:crypto";
+import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
 var STREAM_THRESHOLD = 8 * 1024 * 1024;
 var CHUNK2 = 64 * 1024;
 function sha256(buf) {
-  return createHash7("sha256").update(buf).digest("hex");
+  return createHash6("sha256").update(buf).digest("hex");
 }
 function sha256File(path3) {
   const fd = openSync2(path3, "r");
-  const h = createHash7("sha256");
+  const h = createHash6("sha256");
   const buf = Buffer.allocUnsafe(CHUNK2);
   try {
     let n;
@@ -4205,7 +4235,7 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
 }
 
 // ../ingest/dist/meta.js
-import { basename as basename4 } from "path";
+import { basename as basename4 } from "node:path";
 var newMetaStats = newSidecarStats;
 function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
   const upsert = db.prepare(`INSERT INTO session_meta
@@ -4244,7 +4274,7 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2,
 }
 
 // ../ingest/dist/toolResults.js
-import { basename as basename5 } from "path";
+import { basename as basename5 } from "node:path";
 var newToolResultStats = newSidecarStats;
 function ingestToolResults(db, sourceArchiveDir, excludedDirs, now2, stats, full) {
   const upsert = db.prepare(`INSERT INTO tool_results (session_id, name, path, bytes, text, ingested_at)
@@ -4435,22 +4465,23 @@ function runMetrics(argv = process.argv.slice(2)) {
 }
 
 // ../server/dist/run.js
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname7 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { existsSync as existsSync8 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../server/dist/db.js
-import Database2 from "better-sqlite3";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../server/dist/sql-util.js
+var bind = (params) => params;
 function tableExists(db, name) {
   return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name = ?").get(name);
 }
 function queryAll(db, sql, ...params) {
-  return db.prepare(sql).all(...params);
+  return db.prepare(sql).all(...bind(params));
 }
 function queryGet(db, sql, ...params) {
-  return db.prepare(sql).get(...params);
+  return db.prepare(sql).get(...bind(params));
 }
 function pushDateRange(clauses, params, col, from, to) {
   if (from) {
@@ -4526,8 +4557,8 @@ function costOf(rows) {
 
 // ../server/dist/db.js
 function openReadonly(file) {
-  const db = new Database2(file, { readonly: true, fileMustExist: true });
-  db.pragma("query_only = ON");
+  const db = new DatabaseSync2(file, { readOnly: true });
+  db.exec("PRAGMA query_only = ON");
   return db;
 }
 function schemaStatus(db) {
@@ -4575,6 +4606,32 @@ function listModels(db) {
 function toFtsQuery(raw) {
   return raw.trim().split(/\s+/).filter(Boolean).map((t) => `"${t.replace(/"/g, '""')}"`).join(" ");
 }
+var TOKENS_SORT_SQL = `(SELECT COALESCE(SUM(t.input_tokens + t.output_tokens
+      + t.cache_creation_input_tokens + t.cache_read_input_tokens), 0)
+    FROM token_usage t WHERE t.session_id = s.id)`;
+var SECURITY_SORT_SQL = `(CASE worst_severity
+      WHEN 'critical' THEN 5 WHEN 'high' THEN 4 WHEN 'medium' THEN 3 WHEN 'low' THEN 2 WHEN 'info' THEN 1
+      ELSE 0 END) * 1000000 + finding_count`;
+var COST_SORT_SQL = `(SELECT COALESCE(SUM((tu.input_tokens * mr.i_rate + tu.output_tokens * mr.o_rate
+      + tu.cache_creation_input_tokens * mr.cw_rate + tu.cache_read_input_tokens * mr.cr_rate) / 1000000.0), 0)
+    FROM token_usage tu LEFT JOIN model_rate mr ON mr.model IS tu.model
+    WHERE tu.session_id = s.id)`;
+function ratesCte() {
+  const entries = Object.entries(activePricing());
+  return {
+    // `model_rate` resolves the prefix match ONCE per distinct model id, not once per token_usage row.
+    // Inlining the lookup into the cost expression instead re-ran it for every usage row of every
+    // candidate session — ~35× slower on a real corpus, which would have made this "fix" a regression.
+    sql: `WITH rates(prefix, i_rate, o_rate, cw_rate, cr_rate) AS (VALUES ${entries.map(() => "(?,?,?,?,?)").join(",")}),
+      model_rate AS (
+        SELECT m.model, r.i_rate, r.o_rate, r.cw_rate, r.cr_rate
+        FROM (SELECT DISTINCT model FROM token_usage) m
+        LEFT JOIN rates r ON r.prefix = (
+          SELECT p.prefix FROM rates p WHERE substr(m.model, 1, length(p.prefix)) = p.prefix
+          ORDER BY length(p.prefix) DESC LIMIT 1)) `,
+    params: entries.flatMap(([prefix, r]) => [prefix, r.input, r.output, r.cacheWrite, r.cacheRead])
+  };
+}
 function listSessions(db, f) {
   const where = [];
   const params = [];
@@ -4619,41 +4676,19 @@ function listSessions(db, f) {
                  LIMIT 1) AS worst_severity
        FROM sessions s LEFT JOIN projects p ON p.id = s.project_id
        ${whereSql}`;
-  const NATIVE_ORDER = {
+  const ORDER = {
     started: "s.started_at",
     title: "COALESCE(s.ai_title, s.slug)",
     turns: "s.turn_count",
-    duration: "s.duration_ms"
+    duration: "s.duration_ms",
+    errors: "tool_error_count",
+    tokens: TOKENS_SORT_SQL,
+    cost: COST_SORT_SQL,
+    security: SECURITY_SORT_SQL
   };
   const sortKey = f.sort ?? "started";
-  const JS_SORT = /* @__PURE__ */ new Set(["tokens", "cost", "errors", "security"]);
-  let sessions;
-  if (JS_SORT.has(sortKey)) {
-    const all = attachSessionCost(db, queryAll(db, baseSelect, ...params));
-    const sign = f.dir === "asc" ? 1 : -1;
-    const metric = (r) => {
-      switch (sortKey) {
-        case "tokens":
-          return r.tokens;
-        case "cost":
-          return r.cost;
-        case "errors":
-          return r.tool_error_count ?? 0;
-        // Security: rank by worst severity (info=0 … critical=4; none = -1), finding count as tiebreak.
-        case "security":
-          return (severityRank(r.worst_severity ?? "") + 1) * 1e6 + (r.finding_count ?? 0);
-        default:
-          return 0;
-      }
-    };
-    all.sort((a, b) => {
-      const c = (metric(a) - metric(b)) * sign;
-      return c !== 0 ? c : String(a.id).localeCompare(String(b.id));
-    });
-    sessions = all.slice(f.offset, f.offset + f.limit);
-  } else {
-    sessions = attachSessionCost(db, queryAll(db, `${baseSelect} ORDER BY ${orderBy(NATIVE_ORDER, sortKey, "started", f.dir)}, s.id ASC LIMIT ? OFFSET ?`, ...params, f.limit, f.offset));
-  }
+  const rates = sortKey === "cost" ? ratesCte() : null;
+  const sessions = attachSessionCost(db, queryAll(db, `${rates?.sql ?? ""}${baseSelect} ORDER BY ${orderBy(ORDER, sortKey, "started", f.dir)}, s.id ASC LIMIT ? OFFSET ?`, ...rates?.params ?? [], ...params, f.limit, f.offset));
   return { total, sessions };
 }
 function attachSessionCost(db, rows) {
@@ -5216,7 +5251,7 @@ function securitySummary(db) {
 }
 
 // ../server/dist/app.js
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync7 } from "node:fs";
 import Fastify from "fastify";
 import fastifyStatic from "@fastify/static";
 
@@ -5274,11 +5309,18 @@ var usageForCost = (u) => ({
   cache_creation_input_tokens: u.cw ?? 0,
   cache_read_input_tokens: u.cr ?? 0
 });
-function pct(sorted, p) {
-  if (sorted.length === 0)
-    return 0;
-  const rank = Math.ceil(p / 100 * sorted.length) - 1;
-  return sorted[Math.min(Math.max(rank, 0), sorted.length - 1)];
+function percentiles(db, values, params) {
+  const at = (p) => `(SELECT COALESCE((SELECT v FROM vals ORDER BY v
+        LIMIT 1 OFFSET MAX(0, CAST(ceil(${p} / 100.0 * (SELECT c FROM n)) AS INTEGER) - 1)), 0))`;
+  const row = queryGet(
+    db,
+    // MATERIALIZED matters: the three selects below each reference `vals`, and without the hint
+    // SQLite inlines the CTE and re-runs the underlying scan once per percentile.
+    `WITH vals AS MATERIALIZED (${values}), n AS (SELECT COUNT(*) c FROM vals)
+     SELECT ${at(50)} AS p50, ${at(95)} AS p95, (SELECT c FROM n) AS count`,
+    ...params
+  );
+  return row ?? { p50: 0, p95: 0, count: 0 };
 }
 function workflowWhere(f) {
   const where = [];
@@ -5345,10 +5387,10 @@ function dashboardOverview(db, f) {
       unpriced2.push(u.model);
   }
   const totalTokens = tokens.input + tokens.output + tokens.cache_creation + tokens.cache_read;
-  const durs = queryAll(db, `SELECT tn.duration_ms d FROM turns tn JOIN sessions s ON s.id = tn.session_id
-     ${w.sql ? w.sql + " AND" : "WHERE"} tn.duration_ms IS NOT NULL ORDER BY tn.duration_ms`, ...w.params).map((r) => r.d);
-  const sessDurs = queryAll(db, `SELECT s.duration_ms d FROM sessions s
-     ${w.sql ? w.sql + " AND" : "WHERE"} s.is_sidechain = 0 AND s.duration_ms IS NOT NULL ORDER BY s.duration_ms`, ...w.params).map((r) => r.d);
+  const turnDur = percentiles(db, `SELECT tn.duration_ms v FROM turns tn JOIN sessions s ON s.id = tn.session_id
+     ${w.sql ? w.sql + " AND" : "WHERE"} tn.duration_ms IS NOT NULL`, w.params);
+  const sessDur = percentiles(db, `SELECT s.duration_ms v FROM sessions s
+     ${w.sql ? w.sql + " AND" : "WHERE"} s.is_sidechain = 0 AND s.duration_ms IS NOT NULL`, w.params);
   return {
     range: { from: f.from ?? null, to: f.to ?? null, source: f.source ?? null },
     sessions: counts.sessions ?? 0,
@@ -5363,8 +5405,8 @@ function dashboardOverview(db, f) {
     cache_read_ratio: totalTokens ? tokens.cache_read / totalTokens : 0,
     cost: Number(cost.toFixed(4)),
     unpriced_models: [...new Set(unpriced2)].sort(),
-    turn_duration_ms: { p50: pct(durs, 50), p95: pct(durs, 95), count: durs.length },
-    session_duration_ms: { p50: pct(sessDurs, 50), p95: pct(sessDurs, 95), count: sessDurs.length },
+    turn_duration_ms: turnDur,
+    session_duration_ms: sessDur,
     workflows: workflowAgg(db, f)
   };
 }
@@ -5529,8 +5571,8 @@ function dashboardBreakdowns(db, f) {
 }
 
 // ../server/dist/refresh.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join10 } from "node:path";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 function originAllowed(origin) {
   if (!origin)
@@ -5567,7 +5609,7 @@ function runRefresh() {
 }
 
 // ../server/dist/triage.js
-import Database3 from "better-sqlite3";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var TRIAGE_SCHEMA_SQL = (
   /* sql */
   `
@@ -5595,8 +5637,8 @@ CREATE TABLE IF NOT EXISTS muted_rules (
 `
 );
 function openTriage(file) {
-  const db = new Database3(file);
-  db.pragma("journal_mode = WAL");
+  const db = new DatabaseSync3(file);
+  db.exec("PRAGMA journal_mode = WAL");
   db.exec(TRIAGE_SCHEMA_SQL);
   return db;
 }
@@ -5605,7 +5647,7 @@ function dismiss(db, ids, note) {
   const stmt = db.prepare(`INSERT INTO dismissed_findings (finding_id, note, dismissed_at) VALUES (?, ?, ?)
      ON CONFLICT(finding_id) DO UPDATE SET note = excluded.note, dismissed_at = excluded.dismissed_at`);
   const ts = now();
-  const tx = db.transaction((list) => {
+  const tx = transaction(db, (list) => {
     for (const id of list)
       stmt.run(id, note ?? null, ts);
   });
@@ -5615,9 +5657,9 @@ function dismiss(db, ids, note) {
 function reopen(db, ids) {
   const stmt = db.prepare("DELETE FROM dismissed_findings WHERE finding_id = ?");
   let n = 0;
-  const tx = db.transaction((list) => {
+  const tx = transaction(db, (list) => {
     for (const id of list)
-      n += stmt.run(id).changes;
+      n += Number(stmt.run(id).changes);
   });
   tx(ids);
   return n;
@@ -5627,14 +5669,14 @@ function muteRule(db, ruleId, scope = "global", scopeId = "", note) {
      ON CONFLICT(rule_id, scope, scope_id) DO UPDATE SET note = excluded.note, muted_at = excluded.muted_at`).run(ruleId, scope, scope === "global" ? "" : scopeId, note ?? null, now());
 }
 function unmute(db, ruleId, scope = "global", scopeId = "") {
-  return db.prepare("DELETE FROM muted_rules WHERE rule_id = ? AND scope = ? AND scope_id = ?").run(ruleId, scope, scope === "global" ? "" : scopeId).changes;
+  return Number(db.prepare("DELETE FROM muted_rules WHERE rule_id = ? AND scope = ? AND scope_id = ?").run(ruleId, scope, scope === "global" ? "" : scopeId).changes);
 }
 function listMutes(db) {
   return db.prepare("SELECT rule_id, scope, scope_id, note, muted_at FROM muted_rules ORDER BY muted_at DESC").all();
 }
 
 // ../server/dist/about.js
-import { statSync as statSync4 } from "fs";
+import { statSync as statSync4 } from "node:fs";
 function storage(db, dbPath) {
   const row = tableExists(db, "ingest_state") ? queryGet(db, "SELECT COUNT(*) files, SUM(size) bytes, MAX(ingested_at) last FROM ingest_state") : void 0;
   let db_bytes = null;
@@ -6018,8 +6060,8 @@ async function startServer(overrides = {}) {
 }
 
 // src/watch.ts
-import { existsSync as existsSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join11 } from "node:path";
 import chokidar from "chokidar";
 async function runWatch(opts = {}) {
   const sources = loadSources();