chainlesschain 0.162.149 → 0.162.151

package/src/lib/lsp/benchmark.js

@@ -0,0 +1,257 @@
+/**
+ * LSP code-intelligence latency benchmark.
+ *
+ * Measures the two numbers the Phase 2 acceptance criteria call for on real
+ * repos: **startup latency** (cold spawn + project index + first answer) and
+ * **per-query latency** (warm def / refs / hover / diagnostics / symbols), plus
+ * best-effort server-process RSS. Pure timing/stat helpers are separated out so
+ * they are unit-testable without spawning anything.
+ *
+ * Deliberately drives the SAME `CodeIntelligence` the agent tool uses, so the
+ * numbers reflect real agent-path latency, not a synthetic micro-path.
+ */
+
+import { CodeIntelligence } from "./code-intelligence.js";
+
+/** now() in fractional milliseconds — injectable for deterministic tests. */
+export const _deps = {
+  now: () => Number(process.hrtime.bigint() / 1000n) / 1000,
+  sampleRss: sampleRssDefault,
+};
+
+/** p-th percentile (0..100) of an UNSORTED sample via linear interpolation. */
+export function percentile(samples, p) {
+  if (!samples.length) return null;
+  const sorted = [...samples].sort((a, b) => a - b);
+  if (sorted.length === 1) return sorted[0];
+  const rank = (p / 100) * (sorted.length - 1);
+  const lo = Math.floor(rank);
+  const hi = Math.ceil(rank);
+  if (lo === hi) return sorted[lo];
+  return sorted[lo] + (sorted[hi] - sorted[lo]) * (rank - lo);
+}
+
+/** Summary stats for a latency sample (all in ms), rounded to 0.1ms. */
+export function summarize(samples) {
+  if (!samples.length) return { n: 0 };
+  const round = (x) => (x == null ? null : Math.round(x * 10) / 10);
+  const sum = samples.reduce((a, b) => a + b, 0);
+  return {
+    n: samples.length,
+    min: round(Math.min(...samples)),
+    median: round(percentile(samples, 50)),
+    p95: round(percentile(samples, 95)),
+    max: round(Math.max(...samples)),
+    mean: round(sum / samples.length),
+  };
+}
+
+/**
+ * Run the benchmark. Returns a structured report; never throws for the
+ * "no server installed" case (returns { available:false, reason }).
+ *
+ * @param {object} opts
+ * @param {string} opts.projectRoot
+ * @param {string} opts.file          a real source file in the project
+ * @param {number} [opts.runs=20]     timed iterations per operation
+ * @param {number} [opts.warmup=2]    untimed warmup iterations per operation
+ * @param {(msg:string)=>void} [opts.onProgress]
+ */
+export async function runLatencyBenchmark(opts) {
+  const {
+    projectRoot,
+    file,
+    runs = 20,
+    warmup = 2,
+    onProgress = () => {},
+  } = opts;
+  const ci = new CodeIntelligence({ projectRoot, coldStart: true });
+  const report = {
+    file,
+    runs,
+    available: true,
+    coldStartMs: null,
+    probe: null,
+    ops: {},
+    server: null,
+  };
+  try {
+    // --- cold start: first query pays spawn + project index ---
+    onProgress("cold start (spawn + index + first query)…");
+    const t0 = _deps.now();
+    const first = await ci.documentSymbols(file);
+    report.coldStartMs = round1(_deps.now() - t0);
+    if (!first.available) {
+      return { available: false, reason: first.reason };
+    }
+
+    // --- choose a probe position from a real symbol (so def/refs have a target) ---
+    const probe = pickProbe(first.symbols);
+    report.probe = probe;
+
+    // best-effort server memory now that it's warm
+    report.server = await captureServerInfo(ci);
+
+    // --- timed operations (warm) ---
+    const ops = [
+      { name: "document_symbols", run: () => ci.documentSymbols(file) },
+      {
+        name: "definition",
+        run: () => ci.definition(file, probe.line, probe.col),
+        needsProbe: true,
+      },
+      {
+        name: "references",
+        run: () => ci.references(file, probe.line, probe.col),
+        needsProbe: true,
+      },
+      {
+        name: "hover",
+        run: () => ci.hover(file, probe.line, probe.col),
+        needsProbe: true,
+      },
+      {
+        name: "diagnostics",
+        run: () => ci.diagnostics(file, { timeoutMs: 4000 }),
+      },
+    ];
+
+    for (const op of ops) {
+      if (op.needsProbe && !probe) {
+        report.ops[op.name] = { skipped: "no probe symbol" };
+        continue;
+      }
+      onProgress(`${op.name} …`);
+      for (let i = 0; i < warmup; i++) await op.run();
+      const samples = [];
+      for (let i = 0; i < runs; i++) {
+        const s = _deps.now();
+        await op.run();
+        samples.push(_deps.now() - s);
+      }
+      report.ops[op.name] = summarize(samples);
+    }
+    return report;
+  } finally {
+    await ci.dispose();
+  }
+}
+
+function pickProbe(symbols) {
+  if (!Array.isArray(symbols) || !symbols.length) return null;
+  // Prefer a function/method/class — those have meaningful def/refs.
+  const preferred = symbols.find((s) =>
+    ["function", "method", "class"].includes(s.kind),
+  );
+  const s = preferred || symbols[0];
+  return { line: s.line, col: s.col, name: s.name, kind: s.kind };
+}
+
+async function captureServerInfo(ci) {
+  try {
+    const servers = ci.manager.listServers();
+    if (!servers.length) return null;
+    const s = servers[0];
+    const rssMb = s.pid != null ? await _deps.sampleRss(s.pid) : null;
+    return { serverId: s.serverId, pid: s.pid, rssMb };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Best-effort resident-set-size (MB) of the server, summed over the pid AND its
+ * descendants. This matters on Windows: a `.cmd` server is launched through
+ * `cmd.exe /c`, so the tracked pid is the launcher and the real language server
+ * (node/tsserver) is a child — measuring only the launcher reports a few MB and
+ * lies. We sum the whole subtree. Returns null if it can't be read (never throws
+ * — memory is a bonus metric, not load-bearing).
+ */
+async function sampleRssDefault(pid) {
+  const { execFileSync } = await import("child_process");
+  try {
+    if (process.platform === "win32") {
+      // One snapshot of every process → parent map → sum the subtree at `pid`.
+      const csv = execFileSync(
+        "wmic",
+        [
+          "process",
+          "get",
+          "ProcessId,ParentProcessId,WorkingSetSize",
+          "/format:csv",
+        ],
+        { encoding: "utf8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 },
+      );
+      const bytes = sumSubtreeRssFromWmicCsv(csv, pid);
+      return bytes != null ? Math.round(bytes / (1024 * 1024)) : null;
+    }
+    // POSIX: not wrapped, so the pid is the real server. Sum pid + children.
+    const out = execFileSync("ps", ["-o", "pid=,ppid=,rss="], {
+      encoding: "utf8",
+    });
+    const rows = out
+      .trim()
+      .split(/\r?\n/)
+      .map((l) => l.trim().split(/\s+/).map(Number));
+    const kb = sumSubtreeRss(
+      rows.map(([p, pp, rss]) => ({ pid: p, ppid: pp, val: rss })),
+      pid,
+    );
+    return kb != null ? Math.round(kb / 1024) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Parse `wmic ... /format:csv` output and sum WorkingSetSize over pid's subtree (bytes). */
+export function sumSubtreeRssFromWmicCsv(csv, rootPid) {
+  const lines = csv
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter(Boolean);
+  const header = lines.find((l) => /ProcessId/i.test(l));
+  if (!header) return null;
+  const cols = header.split(",");
+  const iPid = cols.findIndex((c) => /^ProcessId$/i.test(c));
+  const iPpid = cols.findIndex((c) => /^ParentProcessId$/i.test(c));
+  const iRss = cols.findIndex((c) => /^WorkingSetSize$/i.test(c));
+  if (iPid < 0 || iPpid < 0 || iRss < 0) return null;
+  const rows = [];
+  for (const l of lines) {
+    if (l === header || /ProcessId/i.test(l)) continue;
+    const f = l.split(",");
+    const pid = Number(f[iPid]);
+    const ppid = Number(f[iPpid]);
+    const val = Number(f[iRss]);
+    if (Number.isFinite(pid))
+      rows.push({ pid, ppid, val: Number.isFinite(val) ? val : 0 });
+  }
+  return sumSubtreeRss(rows, rootPid);
+}
+
+/** Sum `val` over `rootPid` and all its transitive descendants. */
+export function sumSubtreeRss(rows, rootPid) {
+  const childrenOf = new Map();
+  const valOf = new Map();
+  for (const r of rows) {
+    valOf.set(r.pid, r.val);
+    if (!childrenOf.has(r.ppid)) childrenOf.set(r.ppid, []);
+    childrenOf.get(r.ppid).push(r.pid);
+  }
+  if (!valOf.has(rootPid)) return null;
+  let total = 0;
+  const seen = new Set();
+  const stack = [rootPid];
+  while (stack.length) {
+    const p = stack.pop();
+    if (seen.has(p)) continue;
+    seen.add(p);
+    total += valOf.get(p) || 0;
+    for (const c of childrenOf.get(p) || []) stack.push(c);
+  }
+  return total;
+}
+
+function round1(x) {
+  return Math.round(x * 10) / 10;
+}

package/src/lib/lsp/lsp-client.js

@@ -57,6 +57,11 @@ export class LSPClient extends EventEmitter {
     return Boolean(this._child) && !this._closed;
   }
 
+  /** OS pid of the language-server process, or null before start / after exit. */
+  get pid() {
+    return this._child ? (this._child.pid ?? null) : null;
+  }
+
   /** Spawn the process and run the initialize handshake. Resolves when ready. */
   async start({ initTimeoutMs = DEFAULT_INIT_TIMEOUT_MS } = {}) {
     if (this._child) throw new Error("LSPClient already started");
@@ -100,15 +105,31 @@ export class LSPClient extends EventEmitter {
       this.emit("stderr", chunk.toString("utf8"));
     });
 
-    const initResult = await this.request(
-      "initialize",
-      this._initializeParams(),
-      { timeoutMs: initTimeoutMs },
-    );
-    this.serverCapabilities = initResult?.capabilities || {};
-    this.notify("initialized", {});
-    this._initialized = true;
-    return this.serverCapabilities;
+    try {
+      const initResult = await this.request(
+        "initialize",
+        this._initializeParams(),
+        { timeoutMs: initTimeoutMs },
+      );
+      this.serverCapabilities = initResult?.capabilities || {};
+      this.notify("initialized", {});
+      this._initialized = true;
+      return this.serverCapabilities;
+    } catch (err) {
+      // The process spawned but the initialize handshake failed or timed out (a
+      // hung/slow/broken server). Don't leave it orphaned: an init HANG never
+      // fires 'exit', and the manager's crash-loop guard only counts exits, so
+      // the process would linger forever holding a port/file locks. Tear it down
+      // before rethrowing so the caller's failure path doesn't leak a server.
+      this._closed = true;
+      this._failAll(err);
+      try {
+        this._child.kill();
+      } catch {
+        /* already dead */
+      }
+      throw err;
+    }
   }
 
   _initializeParams() {

package/src/lib/lsp/lsp-manager.js

@@ -39,6 +39,16 @@ export class LSPManager {
     this.projectRoot = opts.projectRoot || process.cwd();
     /** key `${root}::${serverId}` → { client, languageId, root, restarts } */
     this._servers = new Map();
+    /**
+     * key → in-flight `_startServer` promise. A server start awaits a real
+     * process spawn + `initialize` handshake, and the read-only agent batch
+     * fires several `code_intelligence` calls at once (see agent-core.js), so a
+     * bare Map.get(miss)→await→Map.set pool double-spawns when two callers race
+     * the same key: the second `_servers.set` orphans the first process (leaked
+     * OS process + a still-attached diagnostics listener writing stale state).
+     * Sharing one in-flight promise per key collapses the race to a single spawn.
+     */
+    this._starting = new Map();
     /** open document uri → { version, languageId } */
     this._openDocs = new Map();
     /** uri → latest diagnostics array */
@@ -115,7 +125,7 @@ export class LSPManager {
           quarantined: true,
         };
       }
-      entry = await this._startServer(key, resolved, projectRoot);
+      entry = await this._getOrStartServer(key, resolved, projectRoot);
     }
 
     const uri = pathToFileUri(abs);
@@ -152,6 +162,22 @@ export class LSPManager {
     });
   }
 
+  /**
+   * Dedupe concurrent starts for `key`: return the in-flight start promise if
+   * one exists, otherwise begin one and register it so racing callers share it.
+   * The promise self-evicts on settle (resolve OR reject), so a failed start
+   * doesn't wedge the key — the next request retries cleanly.
+   */
+  _getOrStartServer(key, resolved, projectRoot) {
+    const inflight = this._starting.get(key);
+    if (inflight) return inflight;
+    const p = this._startServer(key, resolved, projectRoot).finally(() => {
+      this._starting.delete(key);
+    });
+    this._starting.set(key, p);
+    return p;
+  }
+
   async _startServer(key, resolved, projectRoot) {
     const client = _deps.createClient({
       command: resolved.command,
@@ -184,8 +210,21 @@ export class LSPManager {
       const log = this._crashLog.get(key) || [];
       log.push(this._now());
       this._crashLog.set(key, log);
+      // Drop this project's open docs AND their published-diagnostics
+      // bookkeeping. Leaving stale _diagMeta/_diagnostics behind makes the
+      // readiness waiters resolve on the PRE-CRASH publish — _waitForFirstPublish
+      // sees count>0 and returns immediately; waitForDiagnostics sees an old
+      // `at` and settles at once — so a query after a crash+restart returns
+      // stale results and races the fresh server's initial empty set, the very
+      // thing the publish-count machinery exists to prevent. (_openDocs keys are
+      // the raw file URI; _diagMeta/_diagnostics use the normalized key.)
       for (const [uri, meta] of this._openDocs) {
-        if (meta.root === projectRoot) this._openDocs.delete(uri);
+        if (meta.root === projectRoot) {
+          this._openDocs.delete(uri);
+          const nuri = normalizeUri(uri);
+          this._diagnostics.delete(nuri);
+          this._diagMeta.delete(nuri);
+        }
       }
     });
     await client.start();
@@ -305,6 +344,19 @@ export class LSPManager {
   get activeServerCount() {
     return this._servers.size;
   }
+
+  /** Snapshot of running servers: `[{ serverId, root, pid }]` (for bench / doctor). */
+  listServers() {
+    const out = [];
+    for (const entry of this._servers.values()) {
+      out.push({
+        serverId: entry.serverId,
+        root: entry.root,
+        pid: entry.client.pid,
+      });
+    }
+    return out;
+  }
 }
 
 // ---- position helpers (the ONLY place that converts between coordinate spaces) ----

package/src/lib/lsp/lsp-server-registry.js

@@ -70,6 +70,13 @@ function tsServer() {
 // Registry of plugin-contributed servers, keyed by languageId. Wins over
 // builtins if a plugin explicitly overrides.
 const pluginServers = new Map();
+// Plugin-contributed extension→languageId overrides, kept SEPARATE from the
+// builtin EXTENSION_LANGUAGE map so `_resetPluginServers` (used by
+// `/reload-plugins`) can fully roll them back. Mutating the builtin map
+// directly meant an uninstalled/untrusted plugin's `.py`→"mylang" remap
+// survived a reload — languageIdForFile kept returning the dead languageId and
+// the builtin server for that extension became unreachable until process exit.
+const pluginExtensions = new Map();
 
 /**
  * Register an extra language server (from a plugin `.lsp.json`).
@@ -87,21 +94,25 @@ export function registerLanguageServer(def) {
   });
   if (Array.isArray(def.extensions)) {
     for (const ext of def.extensions) {
-      EXTENSION_LANGUAGE[ext.startsWith(".") ? ext : "." + ext] =
-        def.languageId;
+      pluginExtensions.set(
+        ext.startsWith(".") ? ext : "." + ext,
+        def.languageId,
+      );
     }
   }
 }
 
-/** Test/reset hook — clears plugin registrations. */
+/** Test/reset hook — clears plugin registrations (servers AND extension maps). */
 export function _resetPluginServers() {
   pluginServers.clear();
+  pluginExtensions.clear();
 }
 
 /** Map a file path to its LSP languageId, or null if unsupported. */
 export function languageIdForFile(filePath) {
   const ext = path.extname(String(filePath || "")).toLowerCase();
-  return EXTENSION_LANGUAGE[ext] || null;
+  // Plugin overrides win over builtins (same precedence as pluginServers).
+  return pluginExtensions.get(ext) || EXTENSION_LANGUAGE[ext] || null;
 }
 
 /**

package/src/lib/matrix-bridge.js

@@ -57,6 +57,90 @@ export function ensureMatrixTables(db) {
   `);
 }
 
+/**
+ * Rehydrate _rooms/_messages/_spaceChildren from the persisted matrix_rooms/
+ * matrix_events tables. The `cc` CLI runs every command in a fresh process, so
+ * without this the Maps start empty and a room joined / message sent / space
+ * child added in a prior invocation is invisible (`cc matrix rooms`/`messages`/
+ * `space children` show nothing; sending to a persisted room can't find it).
+ * Call after ensureMatrixTables(db).
+ *
+ * Caveats reflecting the write side: room `type` is not a persisted column, so
+ * spaces are re-identified by their `!space_` roomId prefix (matching
+ * createSpace). removeSpaceChild is not persisted (no tombstone event), so a
+ * removed child re-appears after rehydration — a separate pre-existing gap,
+ * out of scope here.
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _rooms.clear();
+  _messages.clear();
+  _spaceChildren.clear();
+
+  const roomRows = db.prepare(`SELECT * FROM matrix_rooms`).all();
+  for (const row of roomRows) {
+    const isSpace =
+      typeof row.room_id === "string" && row.room_id.startsWith("!space_");
+    const room = {
+      id: row.id,
+      roomId: row.room_id,
+      name: row.name,
+      topic: row.topic ?? null,
+      isEncrypted: !!row.is_encrypted,
+      memberCount: row.member_count ?? 0,
+      lastEventAt: row.last_event_at ?? null,
+      joinedAt: row.joined_at ?? null,
+      status: row.status,
+      createdAt: row.created_at ?? null,
+    };
+    if (isSpace) {
+      room.type = "m.space";
+      if (!_spaceChildren.has(row.room_id))
+        _spaceChildren.set(row.room_id, new Map());
+    }
+    _rooms.set(row.id, room);
+  }
+
+  const eventRows = db.prepare(`SELECT * FROM matrix_events`).all();
+  for (const row of eventRows) {
+    let content = {};
+    try {
+      content = row.content ? JSON.parse(row.content) : {};
+    } catch {
+      content = {};
+    }
+
+    if (row.event_type === "m.space.child") {
+      // Space child state event: content is { state_key, content: { via } }.
+      const childRoomId = content.state_key;
+      const via =
+        content.content && Array.isArray(content.content.via)
+          ? content.content.via
+          : ["matrix.org"];
+      if (childRoomId) {
+        if (!_spaceChildren.has(row.room_id))
+          _spaceChildren.set(row.room_id, new Map());
+        _spaceChildren.get(row.room_id).set(childRoomId, { via });
+      }
+      continue; // space-child events are not messages
+    }
+
+    _messages.set(row.id, {
+      id: row.id,
+      eventId: row.event_id,
+      roomId: row.room_id,
+      sender: row.sender,
+      eventType: row.event_type,
+      content,
+      originServerTs: row.origin_server_ts ?? null,
+      isEncrypted: !!row.is_encrypted,
+      createdAt: row.created_at ?? null,
+    });
+  }
+
+  return _rooms.size + _messages.size + _spaceChildren.size;
+}
+
 /* ── Login ─────────────────────────────────────────────────── */
 
 export function login(db, homeserver, userId, password) {

package/src/lib/memory-manager.js

@@ -7,7 +7,7 @@
 
 import fs from "fs";
 import path from "path";
-import { likePrefix } from "./sql-like.js";
+import { likePrefix, escapeLike } from "./sql-like.js";
 
 /**
  * Atomically write a UTF-8 file: a crash mid-write must not truncate MEMORY.md
@@ -98,12 +98,14 @@ export function searchMemory(db, query, options = {}) {
   if (!query || !query.trim()) return [];
 
   const limit = Math.max(1, parseInt(options.limit) || 20);
-  const pattern = `%${query}%`;
+  // Escape LIKE wildcards so a query containing % / _ is matched literally
+  // rather than as a wildcard (`search "%"` would otherwise match every entry).
+  const pattern = `%${escapeLike(query)}%`;
 
   return db
     .prepare(
       `SELECT * FROM memory_entries
-       WHERE content LIKE ?
+       WHERE content LIKE ? ESCAPE '\\'
        ORDER BY importance DESC, created_at DESC
        LIMIT ?`,
     )

package/src/lib/nostr-bridge.js

@@ -59,6 +59,59 @@ export function ensureNostrTables(db) {
   `);
 }
 
+/**
+ * Rehydrate the module-level _relays/_events Maps from the persisted
+ * nostr_relays/nostr_events tables. The `cc` CLI runs every command in a
+ * fresh process, so without this the Maps are empty on read and a relay/event
+ * added in a prior invocation is invisible (`cc nostr relays`/`events` show
+ * nothing; `dm-decrypt` can't find the DM). Call after ensureNostrTables(db).
+ * (_keypairs/_didMappings are intentionally ephemeral — no DB table.)
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _relays.clear();
+  _events.clear();
+
+  const relayRows = db.prepare(`SELECT * FROM nostr_relays`).all();
+  for (const row of relayRows) {
+    _relays.set(row.id, {
+      id: row.id,
+      url: row.url,
+      status: row.status,
+      lastConnected: row.last_connected ?? null,
+      eventCount: row.event_count ?? 0,
+      readEnabled: !!row.read_enabled,
+      writeEnabled: !!row.write_enabled,
+    });
+  }
+
+  const eventRows = db.prepare(`SELECT * FROM nostr_events`).all();
+  for (const row of eventRows) {
+    let tags = [];
+    try {
+      tags = row.tags ? JSON.parse(row.tags) : [];
+    } catch {
+      tags = [];
+    }
+    _events.set(row.id, {
+      id: row.id,
+      pubkey: row.pubkey,
+      kind: row.kind,
+      content: row.content,
+      tags,
+      sig: row.sig ?? "",
+      // write side stores createdAt as unix seconds; the column is an ISO
+      // string — convert back so the two process paths agree.
+      createdAt: row.created_at
+        ? Math.floor(new Date(row.created_at).getTime() / 1000)
+        : null,
+      relayUrl: row.relay_url ?? null,
+    });
+  }
+
+  return _relays.size + _events.size;
+}
+
 /* ── Relay Management ─────────────────────────────────────── */
 
 export function listRelays() {

package/src/lib/permission-engine.js

@@ -275,6 +275,24 @@ export function revokePermission(db, userDid, permission) {
   return result.changes > 0;
 }
 
+/**
+ * Is a grant still active given its stored `expires_at`?
+ *
+ * The previous check compared `expires_at > now` as ISO STRINGS. That is
+ * fail-open on unvalidated input: an unpadded date ("2026-7-5") or any
+ * non-numeric-leading garbage ("next year") sorts lexicographically AFTER a
+ * canonical `now` ('7'/'n' > '0'/'2'), so an already-expired or malformed
+ * time-limited grant silently became a PERMANENT grant. Compare numerically and
+ * treat an unparseable expiry as expired (fail closed) so a typo can never widen
+ * access. A null/empty `expires_at` means no expiry.
+ */
+function _grantActive(expiresAt, nowMs) {
+  if (!expiresAt) return true;
+  const t = Date.parse(expiresAt);
+  if (Number.isNaN(t)) return false;
+  return t > nowMs;
+}
+
 /**
  * Get all roles and direct permissions for a user.
  */
@@ -287,15 +305,15 @@ export function getUserPermissions(db, userDid) {
     .all(userDid);
 
   // Filter out expired grants
-  const now = new Date().toISOString();
-  const grants = allGrants.filter((g) => !g.expires_at || g.expires_at > now);
+  const nowMs = Date.now();
+  const grants = allGrants.filter((g) => _grantActive(g.expires_at, nowMs));
 
   // Get direct permissions (not expired)
   const allDirectPerms = db
     .prepare("SELECT * FROM rbac_direct_permissions WHERE user_did = ?")
     .all(userDid);
-  const directPerms = allDirectPerms.filter(
-    (d) => !d.expires_at || d.expires_at > now,
+  const directPerms = allDirectPerms.filter((d) =>
+    _grantActive(d.expires_at, nowMs),
   );
 
   // Collect all permissions by looking up each role