@tianshu-ai/tianshu 0.3.0

package/packages/server/dist/core/migrations/004-rebuild-message-chain.js

@@ -0,0 +1,52 @@
+// Migration 004 — rebuild every session's message chain into a
+// strict linked list ordered by (created_at ASC, rowid ASC).
+//
+// Why this exists: migration 003 set up the chain correctly for
+// legacy rows, but the first cut of N+6.4 had a bug in
+// SqliteSessionStorage.appendEntry that left `sessions.leaf_id`
+// pointing at the previous turn's leaf for every new row — so all
+// entries written between N+6.4 deploy and the leaf-id fix landed
+// share the SAME parent (a fan-out), and `getPathToRoot` only
+// walked the most recent branch.
+//
+// `getPathToRoot` had a splice fallback that papered over this for
+// reads, but the fan stayed in the DB. Rather than carry the
+// fallback forever, this migration rewrites every parent_id to
+// point at the predecessor row in chronological order. This is
+// safe for already-chained sessions (we just re-write the same
+// values) and idempotent in practice — re-running on a chain that
+// is already correct is a no-op.
+//
+// We also re-stamp `sessions.leaf_id` to the chronologically last
+// row in case it drifted: pi's harness reads leaf_id at run-start,
+// so an out-of-date pointer would make new turns parent off the
+// wrong row.
+export const ID = "004-rebuild-message-chain";
+export function up(db) {
+    const sessions = db
+        .prepare(`SELECT id FROM sessions`)
+        .all();
+    const selectMsgs = db.prepare(`SELECT id FROM messages
+     WHERE session_id = ?
+     ORDER BY created_at ASC, rowid ASC`);
+    const updateParent = db.prepare(`UPDATE messages SET parent_id = ? WHERE id = ?`);
+    const updateLeaf = db.prepare(`UPDATE sessions SET leaf_id = ? WHERE id = ?`);
+    for (const s of sessions) {
+        const ids = selectMsgs.all(s.id);
+        if (ids.length === 0) {
+            // Session had no messages — clear leaf_id if it was somehow
+            // set, otherwise nothing to do.
+            updateLeaf.run(null, s.id);
+            continue;
+        }
+        let prev = null;
+        for (const row of ids) {
+            // First row gets parent_id=NULL; every subsequent row points
+            // at the row immediately before it in chronological order.
+            updateParent.run(prev, row.id);
+            prev = row.id;
+        }
+        updateLeaf.run(prev, s.id);
+    }
+}
+//# sourceMappingURL=004-rebuild-message-chain.js.map

package/packages/server/dist/core/migrations/004-rebuild-message-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"004-rebuild-message-chain.js","sourceRoot":"","sources":["../../../src/core/migrations/004-rebuild-message-chain.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,6DAA6D;AAC7D,EAAE;AACF,gEAAgE;AAChE,uDAAuD;AACvD,gEAAgE;AAChE,kEAAkE;AAClE,kEAAkE;AAClE,8DAA8D;AAC9D,iCAAiC;AACjC,EAAE;AACF,mEAAmE;AACnE,6DAA6D;AAC7D,+DAA+D;AAC/D,+DAA+D;AAC/D,+DAA+D;AAC/D,kEAAkE;AAClE,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,gEAAgE;AAChE,aAAa;AAIb,MAAM,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC;AAE9C,MAAM,UAAU,EAAE,CAAC,EAAY;IAC7B,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAAqB,yBAAyB,CAAC;SACtD,GAAG,EAAE,CAAC;IACT,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B;;wCAEoC,CACrC,CAAC;IACF,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC7B,gDAAgD,CACjD,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,8CAA8C,CAC/C,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,4DAA4D;YAC5D,gCAAgC;YAChC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,6DAA6D;YAC7D,2DAA2D;YAC3D,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/packages/server/dist/core/migrations/005-task-status-rename.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "better-sqlite3";
+export declare const ID = "005-task-status-rename";
+export declare function up(db: Database): void;
+//# sourceMappingURL=005-task-status-rename.d.ts.map

package/packages/server/dist/core/migrations/005-task-status-rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"005-task-status-rename.d.ts","sourceRoot":"","sources":["../../../src/core/migrations/005-task-status-rename.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,eAAO,MAAM,EAAE,2BAA2B,CAAC;AAS3C,wBAAgB,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CA+BrC"}

package/packages/server/dist/core/migrations/005-task-status-rename.js

@@ -0,0 +1,64 @@
+// Migration 005 — rename `todo` → `ready`, fold `aborted` into
+// `ready`, add `failure_reason` + `attempts` columns for the retry
+// loop.
+//
+// Why:
+//   - "todo" is what humans put on a kanban; this board feeds a
+//     worker pool, so "ready" (ready-to-claim) is the accurate
+//     semantics. Matches the design used by the closed-source
+//     predecessor.
+//   - "aborted" was a separate persistent state that we never
+//     showed by default (UI archived it). After the
+//     agent-frameworks-research run we found agents can
+//     legitimately abort mid-flight (timeout, external cancel) —
+//     the right action is to put the task back in the queue with
+//     a failure note, not bury it.
+//   - "stalled" survives, but only as the FINAL graveyard for
+//     tasks that have failed `MAX_ATTEMPTS` times. Worker pool
+//     puts a fresh failure back to `ready` and bumps `attempts`.
+//
+// `failure_reason` carries the last error string so the UI can
+// render a "⚠️ failed N times: <reason>" badge on the card.
+//
+// Idempotent: re-running on already-migrated data is a no-op
+// because the UPDATEs target only the obsolete status values and
+// the ALTER TABLE adds use IF NOT EXISTS semantics via a column
+// presence check.
+export const ID = "005-task-status-rename";
+function hasColumn(db, table, column) {
+    const cols = db
+        .prepare(`PRAGMA table_info(${table})`)
+        .all();
+    return cols.some((c) => c.name === column);
+}
+export function up(db) {
+    // 1. Add new columns if they don't exist yet.
+    if (!hasColumn(db, "tasks", "failure_reason")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN failure_reason TEXT`);
+    }
+    if (!hasColumn(db, "tasks", "attempts")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN attempts INTEGER NOT NULL DEFAULT 0`);
+    }
+    // 2. Rename status values. `aborted` rows had no useful
+    //    information beyond "the worker bailed", so we fold them
+    //    into `ready` with a failure_reason so the user can see
+    //    what happened. Tasks already at status='aborted' usually
+    //    have a `result_summary` containing the abort reason; copy
+    //    it across.
+    db.exec(`
+    UPDATE tasks
+       SET status = 'ready'
+     WHERE status = 'todo';
+  `);
+    db.exec(`
+    UPDATE tasks
+       SET status = 'ready',
+           failure_reason = COALESCE(failure_reason, result_summary)
+     WHERE status = 'aborted';
+  `);
+    // 3. NB: the index on `status` (idx_tasks_status_priority)
+    //    keeps working unchanged — SQLite stores text values
+    //    directly in the index, no rebuild needed when a few rows
+    //    change.
+}
+//# sourceMappingURL=005-task-status-rename.js.map

package/packages/server/dist/core/migrations/005-task-status-rename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"005-task-status-rename.js","sourceRoot":"","sources":["../../../src/core/migrations/005-task-status-rename.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,mEAAmE;AACnE,QAAQ;AACR,EAAE;AACF,OAAO;AACP,gEAAgE;AAChE,+DAA+D;AAC/D,8DAA8D;AAC9D,mBAAmB;AACnB,8DAA8D;AAC9D,oDAAoD;AACpD,wDAAwD;AACxD,iEAAiE;AACjE,iEAAiE;AACjE,mCAAmC;AACnC,8DAA8D;AAC9D,+DAA+D;AAC/D,iEAAiE;AACjE,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,6DAA6D;AAC7D,iEAAiE;AACjE,gEAAgE;AAChE,kBAAkB;AAIlB,MAAM,CAAC,MAAM,EAAE,GAAG,wBAAwB,CAAC;AAE3C,SAAS,SAAS,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAuB,qBAAqB,KAAK,GAAG,CAAC;SAC5D,GAAG,EAAE,CAAC;IACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAY;IAC7B,8CAA8C;IAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC9C,EAAE,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC9E,CAAC;IAED,wDAAwD;IACxD,6DAA6D;IAC7D,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,gBAAgB;IAChB,EAAE,CAAC,IAAI,CAAC;;;;GAIP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IAEH,2DAA2D;IAC3D,yDAAyD;IACzD,8DAA8D;IAC9D,aAAa;AACf,CAAC"}

package/packages/server/dist/core/migrations/006-task-labels.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "better-sqlite3";
+export declare const ID = "006-task-labels";
+export declare function up(db: Database): void;
+//# sourceMappingURL=006-task-labels.d.ts.map

package/packages/server/dist/core/migrations/006-task-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"006-task-labels.d.ts","sourceRoot":"","sources":["../../../src/core/migrations/006-task-labels.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,eAAO,MAAM,EAAE,oBAAoB,CAAC;AASpC,wBAAgB,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAerC"}

package/packages/server/dist/core/migrations/006-task-labels.js

@@ -0,0 +1,43 @@
+// Migration 006 — turn the `stalled` task STATUS into a `stalled` LABEL.
+//
+// 005 made `stalled` the final-failure column. Yu cross-checked
+// against the closed-source predecessor and pointed out it gets
+// the model wrong: there, `stalled` (and `draft`, and short-term
+// `failed`) are TAGS on otherwise-normal tasks, not separate
+// columns. The kanban only ever shows ready/in-progress/done; a
+// failed task lives in `ready` with a `stalled` label, and the
+// scheduler skips ready+stalled rows when picking work.
+//
+// Why this matters: a 4th column ("Stalled") is hidden behind a
+// toggle, so failed tasks vanish from the user's mental
+// kanban. With a label, the failure stays visible in the same
+// place the task already lives — UI can paint a ⚠️ badge.
+//
+// Schema:
+//   - tasks.labels TEXT NOT NULL DEFAULT '[]'  (JSON array of strings)
+//   - existing rows with status='stalled' → status='ready' + labels=['stalled']
+//
+// Idempotent. The column-presence check guards re-runs.
+export const ID = "006-task-labels";
+function hasColumn(db, table, column) {
+    const cols = db
+        .prepare(`PRAGMA table_info(${table})`)
+        .all();
+    return cols.some((c) => c.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, "tasks", "labels")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN labels TEXT NOT NULL DEFAULT '[]'`);
+    }
+    // Existing stalled rows become ready+labels=['stalled']. Note we
+    // overwrite labels rather than append because before this migration
+    // the column didn't exist (default ''[]'' applied per row); a
+    // user-stamped label would have been impossible.
+    db.exec(`
+    UPDATE tasks
+       SET labels = '["stalled"]',
+           status = 'ready'
+     WHERE status = 'stalled';
+  `);
+}
+//# sourceMappingURL=006-task-labels.js.map

package/packages/server/dist/core/migrations/006-task-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"006-task-labels.js","sourceRoot":"","sources":["../../../src/core/migrations/006-task-labels.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,gEAAgE;AAChE,gEAAgE;AAChE,iEAAiE;AACjE,6DAA6D;AAC7D,gEAAgE;AAChE,+DAA+D;AAC/D,wDAAwD;AACxD,EAAE;AACF,gEAAgE;AAChE,wDAAwD;AACxD,8DAA8D;AAC9D,0DAA0D;AAC1D,EAAE;AACF,UAAU;AACV,uEAAuE;AACvE,gFAAgF;AAChF,EAAE;AACF,wDAAwD;AAIxD,MAAM,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC;AAEpC,SAAS,SAAS,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAuB,qBAAqB,KAAK,GAAG,CAAC;SAC5D,GAAG,EAAE,CAAC;IACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAY;IAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtC,EAAE,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC5E,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,8DAA8D;IAC9D,iDAAiD;IACjD,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;AACL,CAAC"}

package/packages/server/dist/core/migrations/007-session-inbox.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "better-sqlite3";
+export declare const ID = "007-session-inbox";
+export declare function up(db: Database): void;
+//# sourceMappingURL=007-session-inbox.d.ts.map

package/packages/server/dist/core/migrations/007-session-inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-session-inbox.d.ts","sourceRoot":"","sources":["../../../src/core/migrations/007-session-inbox.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,eAAO,MAAM,EAAE,sBAAsB,CAAC;AAkBtC,wBAAgB,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAmBrC"}

package/packages/server/dist/core/migrations/007-session-inbox.js

@@ -0,0 +1,67 @@
+// Migration 007 — session inbox + tasks.parent_session_id.
+//
+// Why we need this:
+//   When a chat session calls `task_create` to delegate work to a
+//   worker, the resulting kanban task has, until now, no link
+//   back to *which* session asked for it. So when the worker
+//   finishes (done) or fails (stalled), nobody can tell the
+//   asking agent — the agent has to keep polling task_get_history
+//   to find out.
+//
+//   Yu wants the OpenClaw model: when the worker terminates, drop
+//   a message into the parent session's inbox. If that session
+//   currently has an active turn running, the inbox dispatcher
+//   forwards the message to `harness.followUp(...)`; if the
+//   session is idle, the message sits in the inbox until the next
+//   user turn flushes it as a system-note prefix.
+//
+// Schema:
+//   tasks.parent_session_id  TEXT NULL
+//     The session that asked for the task. NULL for tasks created
+//     outside a chat session (kanban UI add button, REST API).
+//
+//   session_inbox
+//     id                  TEXT  PRIMARY KEY
+//     target_session_id   TEXT  NOT NULL
+//     payload             TEXT  NOT NULL  (JSON; { kind, text, ...meta })
+//     status              TEXT  NOT NULL  ('pending' | 'delivered')
+//     created_at          INTEGER NOT NULL
+//     delivered_at        INTEGER NULL
+//
+//   Index on (target_session_id, status, created_at) so the
+//   pending-flush query (drainPending) is a single index seek.
+//
+// Idempotent: column / table presence is checked before the DDL.
+export const ID = "007-session-inbox";
+function hasColumn(db, table, column) {
+    const cols = db
+        .prepare(`PRAGMA table_info(${table})`)
+        .all();
+    return cols.some((c) => c.name === column);
+}
+function hasTable(db, name) {
+    const row = db
+        .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`)
+        .get(name);
+    return Boolean(row);
+}
+export function up(db) {
+    if (!hasColumn(db, "tasks", "parent_session_id")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN parent_session_id TEXT`);
+    }
+    if (!hasTable(db, "session_inbox")) {
+        db.exec(`
+      CREATE TABLE session_inbox (
+        id                TEXT PRIMARY KEY,
+        target_session_id TEXT NOT NULL,
+        payload           TEXT NOT NULL,
+        status            TEXT NOT NULL DEFAULT 'pending',
+        created_at        INTEGER NOT NULL,
+        delivered_at      INTEGER
+      );
+      CREATE INDEX idx_session_inbox_pending
+        ON session_inbox(target_session_id, status, created_at);
+    `);
+    }
+}
+//# sourceMappingURL=007-session-inbox.js.map

package/packages/server/dist/core/migrations/007-session-inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"007-session-inbox.js","sourceRoot":"","sources":["../../../src/core/migrations/007-session-inbox.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,oBAAoB;AACpB,kEAAkE;AAClE,8DAA8D;AAC9D,6DAA6D;AAC7D,4DAA4D;AAC5D,kEAAkE;AAClE,iBAAiB;AACjB,EAAE;AACF,kEAAkE;AAClE,+DAA+D;AAC/D,+DAA+D;AAC/D,4DAA4D;AAC5D,kEAAkE;AAClE,kDAAkD;AAClD,EAAE;AACF,UAAU;AACV,uCAAuC;AACvC,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,kBAAkB;AAClB,4CAA4C;AAC5C,yCAAyC;AACzC,0EAA0E;AAC1E,oEAAoE;AACpE,2CAA2C;AAC3C,uCAAuC;AACvC,EAAE;AACF,4DAA4D;AAC5D,+DAA+D;AAC/D,EAAE;AACF,iEAAiE;AAIjE,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC;AAEtC,SAAS,SAAS,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAuB,qBAAqB,KAAK,GAAG,CAAC;SAC5D,GAAG,EAAE,CAAC;IACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,EAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN,8DAA8D,CAC/D;SACA,GAAG,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAY;IAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACjD,EAAE,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;KAWP,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/packages/server/dist/core/migrations/008-task-intervention.d.ts

@@ -0,0 +1,4 @@
+import type { Database } from "better-sqlite3";
+export declare const ID = "008-task-intervention";
+export declare function up(db: Database): void;
+//# sourceMappingURL=008-task-intervention.d.ts.map

package/packages/server/dist/core/migrations/008-task-intervention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"008-task-intervention.d.ts","sourceRoot":"","sources":["../../../src/core/migrations/008-task-intervention.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,eAAO,MAAM,EAAE,0BAA0B,CAAC;AAS1C,wBAAgB,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAYrC"}

package/packages/server/dist/core/migrations/008-task-intervention.js

@@ -0,0 +1,60 @@
+// Migration 008 — task intervention model.
+//
+// Replaces the auto-retry-up-to-MAX_ATTEMPTS loop with an
+// "awaiting-intervention" model: any failure (worker error,
+// stream tear, no_completion) parks the task in ready+
+// awaiting-intervention label and asks the parent (main) agent
+// what to do next. The pool no longer re-queues automatically.
+//
+// New columns on `tasks`:
+//
+//   timeout_ms          INTEGER NOT NULL DEFAULT 600000
+//     Per-task budget. The worker pool starts a soft watchdog at
+//     `started_at + timeout_ms`; on overrun it cancels the
+//     worker run and routes to intervention. Main agent can
+//     extend by calling task_extend_timeout. Default 10 minutes
+//     matches the previous unspoken "if it hasn't finished by
+//     now, something's wrong" behaviour.
+//
+//   intervention_reason TEXT
+//     Free-text human-readable description of why the task is
+//     awaiting intervention. Populated when the pool stamps the
+//     `awaiting-intervention` label; cleared on a fresh claim.
+//     Examples: "worker stream terminated mid tool call",
+//     "worker timed out after 10m / extend or abort?",
+//     "worker called task_complete with status=stalled".
+//
+//   intervention_at     INTEGER
+//     ms timestamp the row entered the intervention state. Used
+//     by the UI to surface "stuck for 5 min" badges and by the
+//     pool to decide whether the row is fresh enough to retry
+//     automatically (it never is — but having the timestamp lets
+//     us add expiry policies later without another migration).
+//
+// All three columns are nullable / defaulted, so the migration
+// is backwards-compatible: existing rows just get the defaults.
+//
+// We do NOT drop the `attempts` column. It's still useful as a
+// read-only counter ("how many times has main agent reset this")
+// and the pool still increments it on every fresh claim. The
+// behaviour change is that `attempts >= MAX_ATTEMPTS` no longer
+// triggers anything.
+export const ID = "008-task-intervention";
+function hasColumn(db, table, column) {
+    const cols = db
+        .prepare(`PRAGMA table_info(${table})`)
+        .all();
+    return cols.some((c) => c.name === column);
+}
+export function up(db) {
+    if (!hasColumn(db, "tasks", "timeout_ms")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN timeout_ms INTEGER NOT NULL DEFAULT 600000`);
+    }
+    if (!hasColumn(db, "tasks", "intervention_reason")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN intervention_reason TEXT`);
+    }
+    if (!hasColumn(db, "tasks", "intervention_at")) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN intervention_at INTEGER`);
+    }
+}
+//# sourceMappingURL=008-task-intervention.js.map

package/packages/server/dist/core/migrations/008-task-intervention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"008-task-intervention.js","sourceRoot":"","sources":["../../../src/core/migrations/008-task-intervention.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,0DAA0D;AAC1D,4DAA4D;AAC5D,uDAAuD;AACvD,+DAA+D;AAC/D,+DAA+D;AAC/D,EAAE;AACF,0BAA0B;AAC1B,EAAE;AACF,wDAAwD;AACxD,iEAAiE;AACjE,2DAA2D;AAC3D,4DAA4D;AAC5D,gEAAgE;AAChE,8DAA8D;AAC9D,yCAAyC;AACzC,EAAE;AACF,6BAA6B;AAC7B,8DAA8D;AAC9D,gEAAgE;AAChE,+DAA+D;AAC/D,0DAA0D;AAC1D,uDAAuD;AACvD,yDAAyD;AACzD,EAAE;AACF,gCAAgC;AAChC,gEAAgE;AAChE,+DAA+D;AAC/D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,EAAE;AACF,+DAA+D;AAC/D,gEAAgE;AAChE,EAAE;AACF,+DAA+D;AAC/D,iEAAiE;AACjE,6DAA6D;AAC7D,gEAAgE;AAChE,qBAAqB;AAIrB,MAAM,CAAC,MAAM,EAAE,GAAG,uBAAuB,CAAC;AAE1C,SAAS,SAAS,CAAC,EAAY,EAAE,KAAa,EAAE,MAAc;IAC5D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAuB,qBAAqB,KAAK,GAAG,CAAC;SAC5D,GAAG,EAAE,CAAC;IACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,EAAY;IAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,EAAE,CAAC,IAAI,CACL,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/C,EAAE,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/packages/server/dist/core/migrations/index.d.ts

@@ -0,0 +1,12 @@
+import type { Database } from "better-sqlite3";
+export interface Migration {
+    id: string;
+    up: (db: Database) => void;
+}
+/** Ordered list of migrations. Append, never reorder, never edit past entries. */
+export declare const MIGRATIONS: Migration[];
+export declare function runMigrations(db: Database): {
+    applied: string[];
+    alreadyApplied: string[];
+};
+//# sourceMappingURL=index.d.ts.map

package/packages/server/dist/core/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/migrations/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAU/C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,CAAC;CAC5B;AAED,kFAAkF;AAClF,eAAO,MAAM,UAAU,EAAE,SAAS,EASjC,CAAC;AASF,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CA6B3F"}

package/packages/server/dist/core/migrations/index.js

@@ -0,0 +1,58 @@
+// Migration runner.
+//
+// Migrations are simple: an ordered list, each with a unique id and an `up`
+// function. We track applied ids in a `schema_migrations` table inside the
+// tenant DB, so the runner is idempotent — calling it on an up-to-date DB
+// is a no-op.
+//
+// Down migrations are intentionally NOT supported. SQLite + downgrade is
+// painful; we'd rather forward-fix.
+import * as initial from "./001-initial.js";
+import * as taskDependencies from "./002-task-dependencies.js";
+import * as sessionTree from "./003-session-tree.js";
+import * as rebuildMessageChain from "./004-rebuild-message-chain.js";
+import * as taskStatusRename from "./005-task-status-rename.js";
+import * as taskLabels from "./006-task-labels.js";
+import * as sessionInbox from "./007-session-inbox.js";
+import * as taskIntervention from "./008-task-intervention.js";
+/** Ordered list of migrations. Append, never reorder, never edit past entries. */
+export const MIGRATIONS = [
+    { id: initial.ID, up: initial.up },
+    { id: taskDependencies.ID, up: taskDependencies.up },
+    { id: sessionTree.ID, up: sessionTree.up },
+    { id: rebuildMessageChain.ID, up: rebuildMessageChain.up },
+    { id: taskStatusRename.ID, up: taskStatusRename.up },
+    { id: taskLabels.ID, up: taskLabels.up },
+    { id: sessionInbox.ID, up: sessionInbox.up },
+    { id: taskIntervention.ID, up: taskIntervention.up },
+];
+const ENSURE_MIGRATIONS_TABLE = `
+  CREATE TABLE IF NOT EXISTS schema_migrations (
+    id         TEXT PRIMARY KEY,
+    applied_at INTEGER NOT NULL
+  );
+`;
+export function runMigrations(db) {
+    db.exec(ENSURE_MIGRATIONS_TABLE);
+    const existing = db
+        .prepare("SELECT id FROM schema_migrations")
+        .all()
+        .map((r) => r.id);
+    const seen = new Set(existing);
+    const applied = [];
+    const alreadyApplied = [];
+    const recordStmt = db.prepare("INSERT INTO schema_migrations (id, applied_at) VALUES (?, ?)");
+    for (const m of MIGRATIONS) {
+        if (seen.has(m.id)) {
+            alreadyApplied.push(m.id);
+            continue;
+        }
+        db.transaction(() => {
+            m.up(db);
+            recordStmt.run(m.id, Date.now());
+        })();
+        applied.push(m.id);
+    }
+    return { applied, alreadyApplied };
+}
+//# sourceMappingURL=index.js.map

package/packages/server/dist/core/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/migrations/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,cAAc;AACd,EAAE;AACF,yEAAyE;AACzE,oCAAoC;AAGpC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,WAAW,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,gBAAgB,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,gBAAgB,MAAM,4BAA4B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;IAClC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE;IACpD,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;IAC1C,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE;IAC1D,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE;IACpD,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;IACxC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE;IAC5C,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE;CACrD,CAAC;AAEF,MAAM,uBAAuB,GAAG;;;;;CAK/B,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,EAAY;IACxC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAAqB,kCAAkC,CAAC;SAC/D,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,8DAA8D,CAC/D,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACT,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACrC,CAAC"}

package/packages/server/dist/core/paths.d.ts

@@ -0,0 +1,53 @@
+export declare const SOFT_DELETE_SUFFIX = ".deleted";
+/** Resolve TIANSHU_HOME at call time so tests can monkey-patch process.env. */
+export declare function getTianshuHome(): string;
+export declare function getGlobalConfigPath(home?: string): string;
+export declare function getTenantsRoot(home?: string): string;
+export declare function getTenantRoot(tenantId: string, home?: string): string;
+export declare function getTenantConfigPath(tenantId: string, home?: string): string;
+export declare function getTenantDbPath(tenantId: string, home?: string): string;
+export declare function getTenantSecretsDir(tenantId: string, home?: string): string;
+export declare function getTenantWorkspaceDir(tenantId: string, home?: string): string;
+export declare function getTenantSharedDir(tenantId: string, home?: string): string;
+/** Per-tenant logs directory. Sibling to `db.sqlite`, not under
+ *  `workspace/`, so that tenant-visible workspace tools never see
+ *  these files. Created lazily on first write. */
+export declare function getTenantLogsDir(tenantId: string, home?: string): string;
+/** Per-tenant agent-config root, where SKILL.md trees, SOUL.md and
+ *  related agent-facing files live. The chat handler scans this on
+ *  every turn (no host restart required for new skills).
+ *
+ *  Layout:
+ *    _tenant/config/skills/<name>/SKILL.md             — shared skills
+ *    _tenant/config/main/skills/<name>/SKILL.md        — main agent only
+ *    _tenant/config/workers/<kind>/skills/<name>/SKILL.md
+ *                                                       — worker-kind only
+ *  (More files like SOUL.md / MEMORY.md are reserved for follow-up
+ *  changes; the directory shape is intentionally future-compatible.)
+ */
+export declare function getTenantConfigDir(tenantId: string, home?: string): string;
+export declare function getTenantSharedSkillsDir(tenantId: string, home?: string): string;
+export declare function getTenantMainSkillsDir(tenantId: string, home?: string): string;
+export declare function getTenantWorkerSkillsDir(tenantId: string, workerKind: string, home?: string): string;
+export declare function getTenantUsersDir(tenantId: string, home?: string): string;
+export declare function getUserHomeDir(tenantId: string, userId: string, home?: string): string;
+export declare function getDeletedTenantPath(tenantId: string, timestamp: number, home?: string): string;
+/** True for any soft-deleted directory name like `myorg.deleted` or `myorg.deleted.171…`. */
+export declare function isSoftDeletedDirName(name: string): boolean;
+/** True iff a name starts with the system-reserved underscore prefix. */
+export declare function isSystemReserved(name: string): boolean;
+/**
+ * Validate a path is within `root` after canonicalisation.
+ *
+ * Used by every tool / API endpoint that takes a user-supplied path.
+ * Returns the resolved absolute path on success, or throws.
+ *
+ * Note we do NOT call fs.realpath because (a) the path may not exist yet
+ * and (b) we explicitly do not want to follow symlinks out of root.
+ */
+export declare function ensureInside(root: string, candidate: string): string;
+export declare const __forTest: {
+    RESERVED_TENANT_IDS: Set<string>;
+    SYSTEM_PREFIX: string;
+};
+//# sourceMappingURL=paths.d.ts.map

package/packages/server/dist/core/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAO7C,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAE3E;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAEtE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAyB,GAAG,MAAM,CAEvF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED;;kDAEkD;AAClD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAOR;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAyB,GAC9B,MAAM,CAER;AAED,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI1D;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED,eAAO,MAAM,SAAS;;;CAAyC,CAAC"}

package/packages/server/dist/core/paths.js

@@ -0,0 +1,125 @@
+// Filesystem layout for Tianshu, per ADR-0001.
+//
+//   <TIANSHU_HOME>/
+//   ├── config.json
+//   └── tenants/
+//       ├── <tenantId>/
+//       │   ├── config.json
+//       │   ├── db.sqlite
+//       │   ├── secrets/
+//       │   └── workspace/
+//       └── <tenantId>.deleted/
+//
+// Default TIANSHU_HOME is ~/.tianshu but every test, every CLI invocation,
+// and every container deploy can override it via the env var. Centralising
+// path math here keeps the rest of the server code from sprinkling
+// path.join(...) and lets tests use isolated temp dirs trivially.
+import os from "node:os";
+import path from "node:path";
+export const SOFT_DELETE_SUFFIX = ".deleted";
+const SYSTEM_PREFIX = "_";
+/** Reserved tenant ids that must not be allowed even if the regex passes. */
+const RESERVED_TENANT_IDS = new Set(["", ".", "..", "tenants", "config", "global"]);
+/** Resolve TIANSHU_HOME at call time so tests can monkey-patch process.env. */
+export function getTianshuHome() {
+    const env = process.env.TIANSHU_HOME?.trim();
+    if (env)
+        return path.resolve(env);
+    return path.join(os.homedir(), ".tianshu");
+}
+export function getGlobalConfigPath(home = getTianshuHome()) {
+    return path.join(home, "config.json");
+}
+export function getTenantsRoot(home = getTianshuHome()) {
+    return path.join(home, "tenants");
+}
+export function getTenantRoot(tenantId, home = getTianshuHome()) {
+    return path.join(getTenantsRoot(home), tenantId);
+}
+export function getTenantConfigPath(tenantId, home) {
+    return path.join(getTenantRoot(tenantId, home), "config.json");
+}
+export function getTenantDbPath(tenantId, home) {
+    return path.join(getTenantRoot(tenantId, home), "db.sqlite");
+}
+export function getTenantSecretsDir(tenantId, home) {
+    return path.join(getTenantRoot(tenantId, home), "secrets");
+}
+export function getTenantWorkspaceDir(tenantId, home) {
+    return path.join(getTenantRoot(tenantId, home), "workspace");
+}
+export function getTenantSharedDir(tenantId, home) {
+    return path.join(getTenantWorkspaceDir(tenantId, home), "_tenant");
+}
+/** Per-tenant logs directory. Sibling to `db.sqlite`, not under
+ *  `workspace/`, so that tenant-visible workspace tools never see
+ *  these files. Created lazily on first write. */
+export function getTenantLogsDir(tenantId, home) {
+    return path.join(getTenantRoot(tenantId, home), "logs");
+}
+/** Per-tenant agent-config root, where SKILL.md trees, SOUL.md and
+ *  related agent-facing files live. The chat handler scans this on
+ *  every turn (no host restart required for new skills).
+ *
+ *  Layout:
+ *    _tenant/config/skills/<name>/SKILL.md             — shared skills
+ *    _tenant/config/main/skills/<name>/SKILL.md        — main agent only
+ *    _tenant/config/workers/<kind>/skills/<name>/SKILL.md
+ *                                                       — worker-kind only
+ *  (More files like SOUL.md / MEMORY.md are reserved for follow-up
+ *  changes; the directory shape is intentionally future-compatible.)
+ */
+export function getTenantConfigDir(tenantId, home) {
+    return path.join(getTenantSharedDir(tenantId, home), "config");
+}
+export function getTenantSharedSkillsDir(tenantId, home) {
+    return path.join(getTenantConfigDir(tenantId, home), "skills");
+}
+export function getTenantMainSkillsDir(tenantId, home) {
+    return path.join(getTenantConfigDir(tenantId, home), "main", "skills");
+}
+export function getTenantWorkerSkillsDir(tenantId, workerKind, home) {
+    return path.join(getTenantConfigDir(tenantId, home), "workers", workerKind, "skills");
+}
+export function getTenantUsersDir(tenantId, home) {
+    return path.join(getTenantWorkspaceDir(tenantId, home), "users");
+}
+export function getUserHomeDir(tenantId, userId, home) {
+    return path.join(getTenantUsersDir(tenantId, home), userId);
+}
+export function getDeletedTenantPath(tenantId, timestamp, home = getTianshuHome()) {
+    return path.join(getTenantsRoot(home), `${tenantId}.deleted.${timestamp}`);
+}
+/** True for any soft-deleted directory name like `myorg.deleted` or `myorg.deleted.171…`. */
+export function isSoftDeletedDirName(name) {
+    return name === SOFT_DELETE_SUFFIX.slice(1) // edge case: literally ".deleted"
+        ? false
+        : name.includes(SOFT_DELETE_SUFFIX);
+}
+/** True iff a name starts with the system-reserved underscore prefix. */
+export function isSystemReserved(name) {
+    return name.startsWith(SYSTEM_PREFIX);
+}
+/**
+ * Validate a path is within `root` after canonicalisation.
+ *
+ * Used by every tool / API endpoint that takes a user-supplied path.
+ * Returns the resolved absolute path on success, or throws.
+ *
+ * Note we do NOT call fs.realpath because (a) the path may not exist yet
+ * and (b) we explicitly do not want to follow symlinks out of root.
+ */
+export function ensureInside(root, candidate) {
+    const resolvedRoot = path.resolve(root);
+    const resolved = path.resolve(resolvedRoot, candidate);
+    // path.relative gives "../something" when escaping; absolute paths get
+    // resolved first so an absolute candidate that doesn't start with root
+    // is also caught.
+    const rel = path.relative(resolvedRoot, resolved);
+    if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) {
+        return resolved;
+    }
+    throw new Error(`path escapes root: ${candidate} (root=${resolvedRoot})`);
+}
+export const __forTest = { RESERVED_TENANT_IDS, SYSTEM_PREFIX };
+//# sourceMappingURL=paths.js.map

package/packages/server/dist/core/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,oBAAoB;AACpB,oBAAoB;AACpB,iBAAiB;AACjB,wBAAwB;AACxB,4BAA4B;AAC5B,0BAA0B;AAC1B,yBAAyB;AACzB,2BAA2B;AAC3B,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,mEAAmE;AACnE,kEAAkE;AAElE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAE7C,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpF,+EAA+E;AAC/E,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,cAAc,EAAE;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,cAAc,EAAE;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe,cAAc,EAAE;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAa;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAa;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAa;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAa;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED;;kDAEkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAa;IAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAa;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,IAAa;IAEb,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAAa;IAEb,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,UAAkB,EAClB,IAAa;IAEb,OAAO,IAAI,CAAC,IAAI,CACd,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAClC,SAAS,EACT,UAAU,EACV,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,IAAa;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAa;IAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,SAAiB,EACjB,OAAe,cAAc,EAAE;IAE/B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,YAAY,SAAS,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kCAAkC;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEvD,uEAAuE;IACvE,uEAAuE;IACvE,kBAAkB;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,UAAU,YAAY,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC"}