@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/daemon/shutdown-handlers.ts

@@ -5,12 +5,19 @@ import { stopCes } from "../credential-execution/ces-runtime.js";
 import { stopHeartbeatService } from "../heartbeat/heartbeat-service.js";
 import { stopCliIpcServer } from "../ipc/assistant-server.js";
 import { stopGatewayFlagListener } from "../ipc/gateway-flag-listener.js";
-import { stopSkillIpcServer } from "../ipc/skill-server.js";
 import { stopMcpServerManager } from "../mcp/manager.js";
-import { getSqlite, resetDb } from "../persistence/db-connection.js";
+import { stopMonitoring } from "../monitoring/control.js";
+import {
+  runAsyncSqlite,
+  spawnDetachedWalCheckpoint,
+} from "../persistence/db-async-query.js";
+import { getSqlite, isDbOpen, resetDb } from "../persistence/db-connection.js";
 import { stopQdrantManager } from "../persistence/embeddings/qdrant-manager.js";
 import { stopMemoryJobsWorker } from "../persistence/jobs-worker.js";
 import { stopMemoryWorkerProcess } from "../persistence/worker-control.js";
+import { stopConsentRefresh } from "../platform/consent-cache.js";
+import { HOOKS } from "../plugin-api/constants.js";
+import { runHook } from "../plugins/pipeline.js";
 import { stopRuntimeHttpServer } from "../runtime/http-server.js";
 import { stopScheduler } from "../schedule/scheduler.js";
 import { getSubagentManager } from "../subagent/index.js";
@@ -18,6 +25,7 @@ import { stopUsageTelemetryReporter } from "../telemetry/usage-telemetry-reporte
 import { browserManager } from "../tools/browser/browser-manager.js";
 import { cleanupShellOutputTempFiles } from "../tools/shared/shell-output.js";
 import { getLogger } from "../util/logger.js";
+import { APP_VERSION } from "../version.js";
 import { getEnrichmentService } from "../workspace/commit-message-enrichment-service.js";
 import {
   commitAllPendingWorkspaceChanges,
@@ -27,11 +35,11 @@ import { stopAppSourceWatcher } from "./app-source-watcher.js";
 import { stopConfigWatcher } from "./config-watcher.js";
 import { stopConversationEvictor } from "./conversation-evictor.js";
 import { stopConversations } from "./conversation-store.js";
-import { cleanupPidFile } from "./daemon-control.js";
+import { cleanupPidFile, cleanupPidFileIfOwner } from "./daemon-control.js";
+import { isStartupComplete } from "./daemon-readiness.js";
 import { stopEventLoopWatchdog } from "./event-loop-watchdog.js";
 import { stopDiskPressureGuardForLifecycle } from "./lifecycle.js";
 import { stopOrphanReaper } from "./orphan-reaper.js";
-import { runShutdownHooks } from "./shutdown-registry.js";
 
 const log = getLogger("lifecycle");
 
@@ -71,6 +79,16 @@ async function shutdown(): Promise<void> {
   // bump only changes behavior for the stuck-shutdown path.
   const forceTimer = setTimeout(() => {
     log.warn("Graceful shutdown timed out, forcing exit");
+    // A stuck shutdown may never reach the graceful WAL checkpoint below —
+    // fold the WAL from a detached subprocess that survives this exit, so
+    // the next boot opens a small WAL instead of paying a multi-minute
+    // recovery. Skipped when the DB was never opened: there is nothing to
+    // fold, and sqlite3 would create an empty DB file.
+    if (isDbOpen() && !spawnDetachedWalCheckpoint()) {
+      log.warn(
+        "No sqlite3 CLI on host — WAL left at high-water mark on force-exit",
+      );
+    }
     stopBackgroundServicesAndCleanupPidFile();
     process.exit(1);
   }, 20_000);
@@ -79,13 +97,21 @@ async function shutdown(): Promise<void> {
   await stopWorkspaceHeartbeatService();
   await stopHeartbeatService();
 
-  // Run registered plugin/skill shutdown hooks (e.g. the memory plugin's
-  // filing-service teardown, meet-join session teardown) before stopping the
-  // server so any HTTP round-trips and SSE emissions still have live transports.
+  // Stop the periodic consent-cache refresh (a daemon-owned interval).
+  await stopConsentRefresh();
+
+  // Fire plugin / user / workspace / skill `shutdown` hooks through the unified
+  // hook pipeline — the same dispatch path every other lifecycle hook uses —
+  // before stopping the server so any teardown work still has live transports.
+  // We don't unregister tool/route surfaces here: the daemon is exiting, so that
+  // in-memory registry state is discarded with the process anyway.
   try {
-    await runShutdownHooks("daemon-shutdown");
+    await runHook(HOOKS.SHUTDOWN, {
+      assistantVersion: APP_VERSION,
+      reason: "shutdown",
+    });
   } catch (err) {
-    log.warn({ err }, "Skill shutdown hooks failed (non-fatal)");
+    log.warn({ err }, "Plugin shutdown hooks failed (non-fatal)");
   }
 
   // Commit any uncommitted workspace changes before stopping the server.
@@ -104,7 +130,6 @@ async function shutdown(): Promise<void> {
   stopConfigWatcher();
   stopAppSourceWatcher();
   stopCliIpcServer();
-  stopSkillIpcServer();
   stopConversations();
   await stopCes();
 
@@ -160,6 +185,9 @@ async function shutdown(): Promise<void> {
     log.warn({ err }, "Failed to stop memory worker process (non-fatal)");
   }
 
+  // Stop the resource monitor process if it's actually running.
+  stopMonitoring();
+
   try {
     await stopMcpServerManager();
   } catch (err) {
@@ -171,21 +199,51 @@ async function shutdown(): Promise<void> {
   // Optimize query planner statistics before closing so they persist for
   // the next session. Checkpoint WAL and close SQLite so no writes are
   // lost on exit. Each step is in its own try block so later steps still
-  // run if an earlier one throws (e.g. SQLITE_BUSY).
-  try {
-    getSqlite().exec("PRAGMA optimize");
-  } catch (err) {
-    log.warn({ err }, "PRAGMA optimize at shutdown failed (non-fatal)");
-  }
-  try {
-    getSqlite().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-  } catch (err) {
-    log.warn({ err }, "WAL checkpoint failed (non-fatal)");
-  }
-  try {
-    resetDb();
-  } catch (err) {
-    log.warn({ err }, "Database close failed (non-fatal)");
+  // run if an earlier one throws (e.g. SQLITE_BUSY). Skipped entirely when
+  // the DB was never opened: there is nothing to persist, fold, or close,
+  // and the lazy `getSqlite()` accessor would open the database just to
+  // tear it down.
+  if (isDbOpen()) {
+    try {
+      getSqlite().exec("PRAGMA optimize");
+    } catch (err) {
+      log.warn({ err }, "PRAGMA optimize at shutdown failed (non-fatal)");
+    }
+    // Fold the WAL back into the main database so the next boot opens a
+    // small WAL instead of paying a multi-minute recovery (see
+    // `checkpointWalBeforeOpen` in db-init.ts). Runs through `runAsyncSqlite`
+    // (sqlite3 subprocess when available) because a synchronous checkpoint
+    // of a WAL at its high-water mark blocks the event loop, which keeps the
+    // force-exit timer above from ever firing. Off the loop, the timer stays
+    // armed — and if it fires mid-checkpoint, the subprocess survives
+    // `process.exit` and finishes the fold in the background.
+    try {
+      const checkpointResult = await runAsyncSqlite(
+        "PRAGMA wal_checkpoint(TRUNCATE)",
+        "shutdown:wal-checkpoint-truncate",
+      );
+      if (checkpointResult.ok) {
+        log.info(
+          {
+            backend: checkpointResult.backend,
+            elapsedMs: checkpointResult.elapsedMs,
+          },
+          "Shutdown WAL checkpoint complete",
+        );
+      } else {
+        log.warn(
+          { error: checkpointResult.error, backend: checkpointResult.backend },
+          "WAL checkpoint failed (non-fatal)",
+        );
+      }
+    } catch (err) {
+      log.warn({ err }, "WAL checkpoint failed (non-fatal)");
+    }
+    try {
+      resetDb();
+    } catch (err) {
+      log.warn({ err }, "Database close failed (non-fatal)");
+    }
   }
 
   await Sentry.flush(2000);
@@ -194,45 +252,79 @@ async function shutdown(): Promise<void> {
   process.exit(exitCode);
 }
 
+/**
+ * Minimal exit for signals and fatal errors that land before startup
+ * completes. The graceful `shutdown()` path assumes started subsystems and
+ * would interleave its teardown with the still-running startup sequence, so
+ * this path does only the work that matters mid-boot: fold the WAL when the
+ * DB is already open (detached, so the fold survives the exit) and remove
+ * the PID file when this process wrote it — ownership-checked so a duplicate
+ * daemon exiting early never deletes the live daemon's PID file.
+ */
+function exitDuringStartup(code: number): void {
+  if (isDbOpen()) {
+    spawnDetachedWalCheckpoint();
+  }
+  cleanupPidFileIfOwner(process.pid);
+  process.exit(code);
+}
+
+function handleShutdownSignal(signal: string, message: string): void {
+  log.warn({ signal, pid: process.pid, uptime: process.uptime() }, message);
+  if (!isStartupComplete()) {
+    log.warn(
+      { signal },
+      "Signal arrived before startup completed — exiting without graceful shutdown",
+    );
+    exitDuringStartup(0);
+    return;
+  }
+  void shutdown();
+}
+
+function handleFatalError(err: unknown, message: string): void {
+  log.error({ err }, message);
+  Sentry.captureException(err);
+  exitCode = 1;
+  if (!isStartupComplete()) {
+    exitDuringStartup(1);
+    return;
+  }
+  void shutdown();
+}
+
+/**
+ * Install signal and fatal-error handlers. Runs before any blocking startup
+ * work — a boot that inherits a large WAL can spend minutes in DB init, and
+ * without handlers a SIGTERM in that window is the default hard kill (no WAL
+ * fold, no PID cleanup). Handlers stay in the minimal `exitDuringStartup`
+ * mode until `setStartupComplete()` marks the daemon ready; from then on
+ * signals run the full graceful `shutdown()`.
+ */
 export function installShutdownHandlers(): void {
   process.on("SIGTERM", () => {
-    log.warn(
-      { signal: "SIGTERM", pid: process.pid, uptime: process.uptime() },
+    handleShutdownSignal(
+      "SIGTERM",
       "Received SIGTERM — process termination requested",
     );
-    void shutdown();
   });
 
   process.on("SIGINT", () => {
-    log.warn(
-      { signal: "SIGINT", pid: process.pid, uptime: process.uptime() },
-      "Received SIGINT — user interrupt",
-    );
-    void shutdown();
+    handleShutdownSignal("SIGINT", "Received SIGINT — user interrupt");
   });
 
   process.on("SIGHUP", () => {
-    log.warn(
-      { signal: "SIGHUP", pid: process.pid, uptime: process.uptime() },
-      "Received SIGHUP — terminal hangup",
-    );
-    void shutdown();
+    handleShutdownSignal("SIGHUP", "Received SIGHUP — terminal hangup");
   });
 
   process.on("unhandledRejection", (reason) => {
-    log.error(
-      { err: reason },
+    handleFatalError(
+      reason,
       "Unhandled promise rejection — initiating shutdown",
     );
-    Sentry.captureException(reason);
-    exitCode = 1;
-    void shutdown();
   });
 
   process.on("uncaughtException", (err) => {
-    log.error({ err }, "Uncaught exception — initiating shutdown");
-    Sentry.captureException(err);
-    exitCode = 1;
-    void shutdown();
+    handleFatalError(err, "Uncaught exception — initiating shutdown");
   });
 }

package/src/daemon/skill-memory-refresh.ts

@@ -4,11 +4,11 @@ import {
   seedSkillGraphNodes,
   seedUninstalledCatalogSkillMemories,
 } from "../plugins/defaults/memory/graph/capability-seed.js";
-import { getLogger } from "../util/logger.js";
 import {
   maybeSeedMemoryV2CliCommands,
   maybeSeedMemoryV2Skills,
-} from "./memory-v2-startup.js";
+} from "../plugins/defaults/memory/v2/memory-v2-startup.js";
+import { getLogger } from "../util/logger.js";
 
 const log = getLogger("skill-memory-refresh");
 

package/src/daemon/sqlite-corruption-watchdog.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Tests for the SQLite corruption watchdog.
+ *
+ * The watchdog turns a `SQLITE_CORRUPT` / `SQLITE_NOTADB` error thrown by any
+ * statement into a direct `sqlite_corrupted` telemetry emit (bypassing the
+ * SQLite watchdog buffer). It must ignore non-corruption errors, debounce per
+ * database, and — wired straight into the slow-query wrapper — fire the moment
+ * a wrapped connection hits corruption. The direct emit itself (opt-out gate,
+ * POST payload) is covered in `../telemetry/watchdog-direct-emit.test.ts`.
+ */
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Silence the logger.
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+// Sentry is a side-effecting no-op in tests.
+mock.module("@sentry/node", () => ({
+  withScope: (fn: (scope: unknown) => void) =>
+    fn({ setLevel() {}, setTag() {}, setContext() {} }),
+  captureMessage: () => {},
+}));
+
+// Capture direct emits instead of POSTing them.
+const emitCalls: Array<{ checkName: string; detail: Record<string, unknown> }> =
+  [];
+mock.module("../telemetry/watchdog-direct-emit.js", () => ({
+  emitWatchdogEventDirect: (
+    checkName: string,
+    detail: Record<string, unknown>,
+  ) => {
+    emitCalls.push({ checkName, detail });
+    return Promise.resolve();
+  },
+}));
+
+import { wrapSqliteForSlowQueryLogging } from "../persistence/slow-query-log.js";
+import {
+  flushCorruptionEmitsForTesting,
+  isSqliteCorruptionError,
+  observeSqliteStatementError,
+  resetSqliteCorruptionWatchdogForTesting,
+  SQLITE_CORRUPTED_CHECK_NAME,
+} from "./sqlite-corruption-watchdog.js";
+
+/** A synthetic `bun:sqlite`-style error carrying a `code`. */
+function sqliteError(code: string, message: string): Error {
+  return Object.assign(new Error(message), { code });
+}
+
+describe("isSqliteCorruptionError", () => {
+  test("matches the SQLITE_CORRUPT / SQLITE_NOTADB families by code", () => {
+    expect(
+      isSqliteCorruptionError(
+        sqliteError("SQLITE_CORRUPT", "database disk image is malformed"),
+      ),
+    ).toBe(true);
+    expect(
+      isSqliteCorruptionError(
+        sqliteError("SQLITE_CORRUPT_VTAB", "corrupt virtual table"),
+      ),
+    ).toBe(true);
+    expect(
+      isSqliteCorruptionError(
+        sqliteError("SQLITE_NOTADB", "file is not a database"),
+      ),
+    ).toBe(true);
+  });
+
+  test("matches the canonical corruption messages even without a code", () => {
+    expect(
+      isSqliteCorruptionError(new Error("database disk image is malformed")),
+    ).toBe(true);
+    expect(isSqliteCorruptionError(new Error("file is not a database"))).toBe(
+      true,
+    );
+  });
+
+  test("does not match transient contention or unrelated errors", () => {
+    expect(
+      isSqliteCorruptionError(sqliteError("SQLITE_BUSY", "database is locked")),
+    ).toBe(false);
+    expect(
+      isSqliteCorruptionError(sqliteError("SQLITE_IOERR", "disk I/O error")),
+    ).toBe(false);
+    expect(
+      isSqliteCorruptionError(
+        sqliteError("SQLITE_CONSTRAINT", "UNIQUE constraint failed"),
+      ),
+    ).toBe(false);
+    expect(isSqliteCorruptionError(new Error("no such table: foo"))).toBe(
+      false,
+    );
+  });
+});
+
+describe("observeSqliteStatementError", () => {
+  beforeEach(() => {
+    emitCalls.length = 0;
+    resetSqliteCorruptionWatchdogForTesting();
+  });
+
+  test("a corruption error emits sqlite_corrupted with detail", async () => {
+    observeSqliteStatementError(
+      sqliteError("SQLITE_CORRUPT", "database disk image is malformed"),
+      {
+        sql: "SELECT * FROM messages WHERE id = ?",
+        database: "main",
+        label: "load-history",
+      },
+    );
+    await flushCorruptionEmitsForTesting();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].checkName).toBe(SQLITE_CORRUPTED_CHECK_NAME);
+    expect(emitCalls[0].checkName).toBe("sqlite_corrupted");
+    expect(emitCalls[0].detail).toMatchObject({
+      database: "main",
+      error: "database disk image is malformed",
+      sql: "SELECT * FROM messages WHERE id = ?",
+      label: "load-history",
+    });
+  });
+
+  test('falls back to "unknown" when the connection carried no database tag', async () => {
+    observeSqliteStatementError(new Error("file is not a database"), {
+      sql: "SELECT 1",
+    });
+    await flushCorruptionEmitsForTesting();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].detail.database).toBe("unknown");
+  });
+
+  test("a transient / unrelated error emits nothing", async () => {
+    observeSqliteStatementError(sqliteError("SQLITE_BUSY", "locked"), {
+      sql: "INSERT ...",
+      database: "main",
+    });
+    observeSqliteStatementError(
+      sqliteError("SQLITE_CONSTRAINT", "UNIQUE constraint failed"),
+      { sql: "INSERT ...", database: "main" },
+    );
+    observeSqliteStatementError(new Error("no such table: foo"), {
+      sql: "SELECT ...",
+      database: "main",
+    });
+    await flushCorruptionEmitsForTesting();
+
+    expect(emitCalls).toHaveLength(0);
+  });
+
+  test("debounces repeated corruption on the same database", async () => {
+    const err = sqliteError(
+      "SQLITE_CORRUPT",
+      "database disk image is malformed",
+    );
+    observeSqliteStatementError(err, { sql: "SELECT 1", database: "main" });
+    observeSqliteStatementError(err, { sql: "SELECT 2", database: "main" });
+    observeSqliteStatementError(err, { sql: "SELECT 3", database: "main" });
+    await flushCorruptionEmitsForTesting();
+    // One report for `main` within the cooldown window...
+    expect(emitCalls).toHaveLength(1);
+
+    // ...but a distinct database is still free to report.
+    observeSqliteStatementError(err, { sql: "SELECT 1", database: "memory" });
+    await flushCorruptionEmitsForTesting();
+    expect(emitCalls).toHaveLength(2);
+  });
+});
+
+describe("wired into the slow-query wrapper", () => {
+  beforeEach(() => {
+    emitCalls.length = 0;
+    resetSqliteCorruptionWatchdogForTesting();
+  });
+
+  test("a wrapped connection hitting a corrupt-header file emits, and the error still propagates", async () => {
+    // A garbage file throws SQLITE_NOTADB while `.query()` compiles the SQL —
+    // the wrapper's create-time seam surfaces it straight to the watchdog, and
+    // names the file from the connection's own `filename` (no key plumbing).
+    const dir = mkdtempSync(join(tmpdir(), "sqlite-corruption-wd-"));
+    const garbagePath = join(dir, "not-a.db");
+    writeFileSync(
+      garbagePath,
+      Buffer.from("this is definitely not a sqlite db"),
+    );
+
+    const db = new Database(garbagePath);
+    wrapSqliteForSlowQueryLogging(db);
+
+    // The original SQLite error must still propagate unchanged.
+    expect(() => db.query("SELECT name FROM sqlite_master").all()).toThrow();
+    await flushCorruptionEmitsForTesting();
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].checkName).toBe("sqlite_corrupted");
+    expect(emitCalls[0].detail.database).toBe("not-a.db");
+  });
+
+  test("a wrapped connection running healthy queries emits nothing", async () => {
+    const db = new Database(":memory:");
+    wrapSqliteForSlowQueryLogging(db);
+    db.exec("CREATE TABLE t (id INTEGER PRIMARY KEY)");
+    db.query("INSERT INTO t (id) VALUES (1)").run();
+    db.query("SELECT * FROM t").all();
+    await flushCorruptionEmitsForTesting();
+
+    expect(emitCalls).toHaveLength(0);
+  });
+});

package/src/daemon/sqlite-corruption-watchdog.ts

@@ -0,0 +1,155 @@
+/**
+ * SQLite corruption watchdog.
+ *
+ * The daemon keeps all of its state — conversations, schedules, memory,
+ * telemetry — in `bun:sqlite` files. When one of those files is damaged (a
+ * torn write, a truncated file, bad disk media) SQLite surfaces it as a
+ * `SQLITE_CORRUPT` / `SQLITE_NOTADB` error ("database disk image is malformed"
+ * / "file is not a database") on the next statement that touches the damaged
+ * page. Left unobserved, that damage is only noticed when a user hits a broken
+ * feature; the platform has no fleet-wide view of how often it happens.
+ *
+ * This watchdog makes corruption observable. It emits a `watchdog` telemetry
+ * event with `check_name = "sqlite_corrupted"` — the same stream the event-loop
+ * watchdog uses — but POSTs it *directly* to the platform ingest rather than
+ * through the SQLite-backed watchdog buffer: a check that fires because SQLite
+ * is unusable must not depend on writing to SQLite, and going direct keeps this
+ * module out of the `db-connection` import graph. The direct path still honors
+ * the `share_analytics` opt-out (see {@link emitWatchdogEventDirect}). The
+ * platform's already-merged `watchdog__sqlite_corruption_daily` admin query
+ * filters `check_name` to this exact string, so it is the cross-repo contract
+ * and must stay stable.
+ *
+ * Detection is per-statement: the shared slow-query wrapper — which already
+ * wraps every `bun:sqlite` connection (main, logs, memory, telemetry — Drizzle
+ * and raw) — hands every failed statement to {@link observeSqliteStatementError}.
+ * So corruption is caught on *any* failing query or write, read or write, the
+ * moment the workload actually hits the damaged page — no dedicated scan
+ * needed. Non-corruption errors (constraint violations, syntax errors,
+ * transient `SQLITE_BUSY`) are ignored.
+ *
+ * Reports are debounced per-database (a corrupt file throws on every
+ * subsequent statement) — see {@link REPORT_COOLDOWN_MS}.
+ */
+
+import * as Sentry from "@sentry/node";
+
+import type { StatementErrorContext } from "../persistence/slow-query-log.js";
+import { getLogger } from "../util/logger.js";
+
+const log = getLogger("sqlite-corruption-watchdog");
+
+/**
+ * Check name emitted for SQLite corruption events. The platform's
+ * `watchdog__sqlite_corruption_daily` admin query filters `check_name` to
+ * this exact string — it is the cross-repo contract, keep it stable.
+ */
+export const SQLITE_CORRUPTED_CHECK_NAME = "sqlite_corrupted";
+
+/**
+ * Minimum spacing between reports for a single database. Corruption is sticky:
+ * once a file is malformed every subsequent statement against it throws the
+ * same way, so without a cooldown a single damaged DB hit in a tight loop
+ * would emit a flood of identical events. Keyed per database so damage to one
+ * file never suppresses the first report for another.
+ */
+const REPORT_COOLDOWN_MS = 60_000;
+
+const lastReportAtByDatabase = new Map<string, number>();
+
+/** The most recent in-flight direct emit, so tests can await it. */
+let pendingEmit: Promise<unknown> = Promise.resolve();
+
+/**
+ * Whether an error is SQLite reporting structural corruption — the
+ * `SQLITE_CORRUPT` / `SQLITE_NOTADB` families, by extended result code or by
+ * the canonical message text ("database disk image is malformed" / "file is
+ * not a database"). Deliberately distinct from `isRetryableSqliteError`: a
+ * corrupt image is permanent, not transient contention, so retrying can never
+ * help. Pure, so callers (and tests) can classify a synthesized error without
+ * a real database.
+ */
+export function isSqliteCorruptionError(err: unknown): boolean {
+  const code = (err as { code?: string } | null)?.code ?? "";
+  if (code.startsWith("SQLITE_CORRUPT") || code.startsWith("SQLITE_NOTADB")) {
+    return true;
+  }
+  const message = (
+    err instanceof Error ? err.message : String(err)
+  ).toLowerCase();
+  return (
+    message.includes("database disk image is malformed") ||
+    message.includes("file is not a database")
+  );
+}
+
+/**
+ * Report a corruption detection: debounce per database, capture to Sentry, and
+ * emit the `sqlite_corrupted` telemetry event directly (opt-out gated inside
+ * {@link emitWatchdogEventDirect}). The direct emit is lazy-imported so the
+ * platform/telemetry stack only loads on the rare corruption path — and so this
+ * module never pulls `db-connection` into its static import graph. Fire-and-
+ * forget: the observer runs on a query hot path, so nothing here throws or
+ * blocks on the POST.
+ */
+function reportCorruption(
+  detail: Record<string, unknown> & { database: string },
+): void {
+  const now = Date.now();
+  const last =
+    lastReportAtByDatabase.get(detail.database) ?? Number.NEGATIVE_INFINITY;
+  if (now - last < REPORT_COOLDOWN_MS) return;
+  lastReportAtByDatabase.set(detail.database, now);
+
+  log.error(detail, "SQLite corruption detected");
+
+  pendingEmit = import("../telemetry/watchdog-direct-emit.js")
+    .then(({ emitWatchdogEventDirect }) =>
+      emitWatchdogEventDirect(SQLITE_CORRUPTED_CHECK_NAME, detail),
+    )
+    .catch(() => {
+      // Best-effort; never let a telemetry failure escape the query path.
+    });
+
+  try {
+    Sentry.withScope((scope) => {
+      scope.setLevel("error");
+      scope.setTag("sqlite_corruption_database", detail.database);
+      scope.setContext("sqlite_corruption", detail);
+      Sentry.captureMessage(SQLITE_CORRUPTED_CHECK_NAME);
+    });
+  } catch {
+    // Never let a Sentry failure escape into the calling query path.
+  }
+}
+
+/**
+ * Called by the slow-query wrapper for every failed statement: fires the
+ * corruption event for `SQLITE_CORRUPT` / `SQLITE_NOTADB` errors and ignores
+ * everything else (constraint/syntax errors, transient `SQLITE_BUSY` /
+ * `SQLITE_IOERR` contention). The wrapper calls this directly, so there is no
+ * observer registration or start/stop lifecycle — a corrupt file reports the
+ * moment a statement hits it.
+ */
+export function observeSqliteStatementError(
+  err: unknown,
+  context: StatementErrorContext,
+): void {
+  if (!isSqliteCorruptionError(err)) return;
+  reportCorruption({
+    database: context.database ?? "unknown",
+    error: err instanceof Error ? err.message : String(err),
+    ...(context.sql ? { sql: context.sql } : {}),
+    ...(context.label ? { label: context.label } : {}),
+  });
+}
+
+/** Test-only: clear the per-database debounce state between cases. */
+export function resetSqliteCorruptionWatchdogForTesting(): void {
+  lastReportAtByDatabase.clear();
+}
+
+/** Test-only: await the most recent fire-and-forget direct emit. */
+export function flushCorruptionEmitsForTesting(): Promise<unknown> {
+  return pendingEmit;
+}

package/src/daemon/tool-setup-types.ts

@@ -105,6 +105,14 @@ export interface ToolSetupContext extends SurfaceConversationContext {
   callSessionId?: string;
   /** The interface ID of the connected client driving the current turn (e.g. "macos", "chrome-extension"). Propagated into ToolContext for browser backend selection. */
   readonly transportInterface?: InterfaceId;
+  /**
+   * The conversation's per-chat plugin scope (mirrors
+   * {@link Conversation.enabledPlugins}). `null`/absent means no per-chat
+   * restriction. Read per tool call to derive the effective enabled-plugin set
+   * (via `getEffectiveEnabledPluginSet`) for the `ToolContext.enabledPluginSet`
+   * field and the `skill_execute` dispatch guard.
+   */
+  readonly enabledPlugins?: string[] | null;
 
   /** Turn-scoped flag: true when any tool call in the current turn received explicit user approval via interactive prompt. Cleared at turn end. */
   approvedViaPromptThisTurn?: boolean;