clawmatrix 0.4.2 → 0.5.1

package/src/store.ts

@@ -0,0 +1,578 @@
+/**
+ * Local SQLite persistence layer for ClawMatrix.
+ *
+ * Single-file database at <stateDir>/clawmatrix.db.
+ * Uses compat.ts SQLite adapter (bun:sqlite in Bun, better-sqlite3 in Node.js).
+ *
+ * Tables fall into two categories:
+ * - **Replicated**: audit_log, health_events, handoff_history — synced across
+ *   peers via log-replication.ts (vector clock + delta rows).
+ * - **Local-only**: closed_sessions, satellite_events, ingested_events — node-private.
+ */
+
+import { openDatabase, type SqliteDatabase } from "./compat.ts";
+import { mkdirSync } from "node:fs";
+import path from "node:path";
+
+// ── Types ───────────────────────────────────────────────────────
+
+export type ReplicatedTable = "audit_log" | "health_events" | "handoff_history";
+
+export interface AuditRow {
+  seq: number;
+  source_seq: number;
+  node_id: string;
+  ts: number;
+  event: string;
+  ip: string | null;
+  detail: string | null;
+}
+
+export interface HealthRow {
+  seq: number;
+  source_seq: number;
+  node_id: string;
+  ts: number;
+  type: string;
+  peer: string | null;
+  via: string | null;
+  reason: string | null;
+}
+
+export interface HandoffRow {
+  seq: number;
+  source_seq: number;
+  node_id: string;
+  ts: number;
+  task_id: string;
+  from_node: string;
+  to_node: string;
+  agent: string;
+  duration: number | null;
+  status: string;
+  error: string | null;
+}
+
+export interface SatelliteEventRow {
+  id: string;
+  ts: number;
+  type: string;
+  data: string;
+}
+
+export interface IngestedEventRow {
+  id: string;
+  ts: number;
+  type: string;
+  source: string;
+  data: string;
+  consumed: number;
+}
+
+export interface AutomationExecutionRow {
+  id: string;
+  rule_id: string;
+  rule_name: string;
+  status: string;
+  started_at: number;
+  finished_at: number | null;
+  result: string | null;
+  error: string | null;
+  attempt: number;
+  max_attempts: number;
+  trigger_source: string | null;
+  trigger_type: string | null;
+  trigger_payload: string | null;
+}
+
+export interface ReplicationStateRow {
+  table_name: string;
+  peer_node_id: string;
+  max_source_seq: number;
+}
+
+// ── Store ───────────────────────────────────────────────────────
+
+export class Store {
+  private db: SqliteDatabase;
+
+  constructor(dbPath: string) {
+    mkdirSync(path.dirname(dbPath), { recursive: true });
+    this.db = openDatabase(dbPath);
+    this.initTables();
+  }
+
+  close() {
+    this.db.close();
+  }
+
+  // ── Table initialization ────────────────────────────────────
+
+  private initTables() {
+    this.db.exec(`
+      -- Replicated tables (synced via log-replication)
+
+      CREATE TABLE IF NOT EXISTS audit_log (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        source_seq INTEGER NOT NULL,
+        node_id TEXT NOT NULL,
+        ts INTEGER NOT NULL,
+        event TEXT NOT NULL,
+        ip TEXT,
+        detail TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS health_events (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        source_seq INTEGER NOT NULL,
+        node_id TEXT NOT NULL,
+        ts INTEGER NOT NULL,
+        type TEXT NOT NULL,
+        peer TEXT,
+        via TEXT,
+        reason TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS handoff_history (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        source_seq INTEGER NOT NULL,
+        node_id TEXT NOT NULL,
+        ts INTEGER NOT NULL,
+        task_id TEXT NOT NULL,
+        from_node TEXT NOT NULL,
+        to_node TEXT NOT NULL,
+        agent TEXT NOT NULL,
+        duration INTEGER,
+        status TEXT NOT NULL,
+        error TEXT
+      );
+
+      -- Local-only tables
+
+      CREATE TABLE IF NOT EXISTS closed_sessions (
+        session_id TEXT PRIMARY KEY,
+        closed_at INTEGER NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS satellite_events (
+        id TEXT PRIMARY KEY,
+        ts INTEGER NOT NULL,
+        type TEXT NOT NULL,
+        data TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS ingested_events (
+        id TEXT PRIMARY KEY,
+        ts INTEGER NOT NULL,
+        type TEXT NOT NULL,
+        source TEXT NOT NULL,
+        data TEXT NOT NULL,
+        consumed INTEGER DEFAULT 0
+      );
+
+      CREATE TABLE IF NOT EXISTS automation_executions (
+        id TEXT PRIMARY KEY,
+        rule_id TEXT NOT NULL,
+        rule_name TEXT NOT NULL,
+        status TEXT NOT NULL,
+        started_at INTEGER NOT NULL,
+        finished_at INTEGER,
+        result TEXT,
+        error TEXT,
+        attempt INTEGER NOT NULL,
+        max_attempts INTEGER NOT NULL,
+        trigger_source TEXT,
+        trigger_type TEXT,
+        trigger_payload TEXT
+      );
+
+      -- Replication state (vector clock persistence)
+
+      CREATE TABLE IF NOT EXISTS replication_state (
+        table_name TEXT NOT NULL,
+        peer_node_id TEXT NOT NULL,
+        max_source_seq INTEGER NOT NULL,
+        PRIMARY KEY (table_name, peer_node_id)
+      );
+
+      -- Indexes for replicated tables
+
+      CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit_log(ts);
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_node_seq ON audit_log(node_id, source_seq);
+
+      CREATE INDEX IF NOT EXISTS idx_health_ts ON health_events(ts);
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_health_node_seq ON health_events(node_id, source_seq);
+      CREATE INDEX IF NOT EXISTS idx_health_peer ON health_events(peer);
+
+      CREATE INDEX IF NOT EXISTS idx_handoff_ts ON handoff_history(ts);
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_handoff_node_seq ON handoff_history(node_id, source_seq);
+
+      -- Indexes for local tables
+
+      CREATE INDEX IF NOT EXISTS idx_satellite_ts ON satellite_events(ts);
+      CREATE INDEX IF NOT EXISTS idx_ingested_ts ON ingested_events(ts);
+      CREATE INDEX IF NOT EXISTS idx_ingested_consumed ON ingested_events(consumed, ts);
+      CREATE INDEX IF NOT EXISTS idx_automation_started_at ON automation_executions(started_at);
+    `);
+  }
+
+  // ── Audit log ─────────────────────────────────────────────────
+
+  insertAudit(entry: { nodeId: string; ts: number; event: string; ip?: string; detail?: string }): number {
+    const stmt = this.db.prepare(
+      `INSERT INTO audit_log (source_seq, node_id, ts, event, ip, detail)
+       VALUES (0, ?, ?, ?, ?, ?)`,
+    );
+    const result = stmt.run(entry.nodeId, entry.ts, entry.event, entry.ip ?? null, entry.detail ?? null);
+    const seq = result.lastInsertRowid as number;
+    // Set source_seq = seq for locally inserted rows
+    this.db.prepare(`UPDATE audit_log SET source_seq = ? WHERE seq = ?`).run(seq, seq);
+    return seq;
+  }
+
+  queryAudit(opts: { since?: number; limit?: number; event?: string; nodeId?: string } = {}): AuditRow[] {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+
+    if (opts.since != null) { conditions.push("ts > ?"); params.push(opts.since); }
+    if (opts.event) { conditions.push("event = ?"); params.push(opts.event); }
+    if (opts.nodeId) { conditions.push("node_id = ?"); params.push(opts.nodeId); }
+
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts.limit ?? 1000;
+
+    return this.db.prepare(`SELECT * FROM audit_log ${where} ORDER BY ts DESC LIMIT ?`).all(...params, limit) as AuditRow[];
+  }
+
+  // ── Health events ─────────────────────────────────────────────
+
+  insertHealth(entry: { nodeId: string; ts: number; type: string; peer?: string; via?: string; reason?: string }): number {
+    const stmt = this.db.prepare(
+      `INSERT INTO health_events (source_seq, node_id, ts, type, peer, via, reason)
+       VALUES (0, ?, ?, ?, ?, ?, ?)`,
+    );
+    const result = stmt.run(entry.nodeId, entry.ts, entry.type, entry.peer ?? null, entry.via ?? null, entry.reason ?? null);
+    const seq = result.lastInsertRowid as number;
+    this.db.prepare(`UPDATE health_events SET source_seq = ? WHERE seq = ?`).run(seq, seq);
+    return seq;
+  }
+
+  queryHealth(opts: { nodeId?: string; since?: number; peer?: string; type?: string; limit?: number } = {}): HealthRow[] {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+
+    if (opts.nodeId) { conditions.push("node_id = ?"); params.push(opts.nodeId); }
+    if (opts.since != null) { conditions.push("ts > ?"); params.push(opts.since); }
+    if (opts.peer) { conditions.push("peer = ?"); params.push(opts.peer); }
+    if (opts.type) { conditions.push("type = ?"); params.push(opts.type); }
+
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts.limit ?? 10000;
+
+    return this.db.prepare(`SELECT * FROM health_events ${where} ORDER BY ts ASC LIMIT ?`).all(...params, limit) as HealthRow[];
+  }
+
+  /** Get distinct node IDs that have health events. */
+  getHealthNodeIds(): string[] {
+    const rows = this.db.prepare(`SELECT DISTINCT node_id FROM health_events`).all() as Array<{ node_id: string }>;
+    return rows.map(r => r.node_id);
+  }
+
+  // ── Handoff history ───────────────────────────────────────────
+
+  insertHandoff(entry: {
+    nodeId: string; ts: number; taskId: string; fromNode: string; toNode: string;
+    agent: string; duration?: number; status: string; error?: string;
+  }): number {
+    const stmt = this.db.prepare(
+      `INSERT INTO handoff_history (source_seq, node_id, ts, task_id, from_node, to_node, agent, duration, status, error)
+       VALUES (0, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    );
+    const result = stmt.run(
+      entry.nodeId, entry.ts, entry.taskId, entry.fromNode, entry.toNode,
+      entry.agent, entry.duration ?? null, entry.status, entry.error ?? null,
+    );
+    const seq = result.lastInsertRowid as number;
+    this.db.prepare(`UPDATE handoff_history SET source_seq = ? WHERE seq = ?`).run(seq, seq);
+    return seq;
+  }
+
+  queryHandoff(opts: { since?: number; agent?: string; status?: string; nodeId?: string; limit?: number } = {}): HandoffRow[] {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+
+    if (opts.since != null) { conditions.push("ts > ?"); params.push(opts.since); }
+    if (opts.agent) { conditions.push("agent = ?"); params.push(opts.agent); }
+    if (opts.status) { conditions.push("status = ?"); params.push(opts.status); }
+    if (opts.nodeId) { conditions.push("node_id = ?"); params.push(opts.nodeId); }
+
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts.limit ?? 1000;
+
+    return this.db.prepare(`SELECT * FROM handoff_history ${where} ORDER BY ts DESC LIMIT ?`).all(...params, limit) as HandoffRow[];
+  }
+
+  // ── Closed sessions (local only) ─────────────────────────────
+
+  insertClosedSession(sessionId: string, closedAt: number): void {
+    this.db.prepare(`INSERT OR IGNORE INTO closed_sessions (session_id, closed_at) VALUES (?, ?)`).run(sessionId, closedAt);
+  }
+
+  isSessionClosed(sessionId: string): boolean {
+    const row = this.db.prepare(`SELECT 1 FROM closed_sessions WHERE session_id = ?`).get(sessionId);
+    return row != null;
+  }
+
+  // ── Satellite events (local only) ─────────────────────────────
+
+  insertSatelliteEvent(entry: { id: string; ts: number; type: string; data: string }): void {
+    this.db.prepare(
+      `INSERT OR IGNORE INTO satellite_events (id, ts, type, data) VALUES (?, ?, ?, ?)`,
+    ).run(entry.id, entry.ts, entry.type, entry.data);
+  }
+
+  querySatelliteEvents(since: number, limit = 100, latest = false): SatelliteEventRow[] {
+    const sql = latest
+      ? `SELECT * FROM (
+           SELECT * FROM satellite_events WHERE ts > ? ORDER BY ts DESC LIMIT ?
+         ) ORDER BY ts ASC`
+      : `SELECT * FROM satellite_events WHERE ts > ? ORDER BY ts ASC LIMIT ?`;
+    return this.db.prepare(sql).all(since, limit) as SatelliteEventRow[];
+  }
+
+  // ── Ingested events (local only) ──────────────────────────────
+
+  insertIngestedEvent(entry: { id: string; ts: number; type: string; source: string; data: string }): void {
+    this.db.prepare(
+      `INSERT OR IGNORE INTO ingested_events (id, ts, type, source, data) VALUES (?, ?, ?, ?, ?)`,
+    ).run(entry.id, entry.ts, entry.type, entry.source, entry.data);
+  }
+
+  queryIngestedEvents(opts: { since?: number; type?: string; source?: string; unconsumed?: boolean; limit?: number; latest?: boolean } = {}): IngestedEventRow[] {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+
+    if (opts.since != null) { conditions.push("ts > ?"); params.push(opts.since); }
+    if (opts.type) { conditions.push("type = ?"); params.push(opts.type); }
+    if (opts.source) { conditions.push("source = ?"); params.push(opts.source); }
+    if (opts.unconsumed) { conditions.push("consumed = 0"); }
+
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const limit = opts.limit ?? 500;
+    const sql = opts.latest
+      ? `SELECT * FROM (
+           SELECT * FROM ingested_events ${where} ORDER BY ts DESC LIMIT ?
+         ) ORDER BY ts ASC`
+      : `SELECT * FROM ingested_events ${where} ORDER BY ts ASC LIMIT ?`;
+
+    return this.db.prepare(sql).all(...params, limit) as IngestedEventRow[];
+  }
+
+  countIngestedEvents(opts: { since?: number; type?: string; source?: string; unconsumed?: boolean } = {}): number {
+    const conditions: string[] = [];
+    const params: unknown[] = [];
+
+    if (opts.since != null) { conditions.push("ts > ?"); params.push(opts.since); }
+    if (opts.type) { conditions.push("type = ?"); params.push(opts.type); }
+    if (opts.source) { conditions.push("source = ?"); params.push(opts.source); }
+    if (opts.unconsumed) { conditions.push("consumed = 0"); }
+
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const row = this.db.prepare(`SELECT COUNT(*) as count FROM ingested_events ${where}`).get(...params) as { count: number };
+    return row.count;
+  }
+
+  consumeIngestedEvents(ids: string[]): number {
+    if (ids.length === 0) return 0;
+    const placeholders = ids.map(() => "?").join(",");
+    const result = this.db.prepare(
+      `UPDATE ingested_events SET consumed = 1 WHERE id IN (${placeholders}) AND consumed = 0`,
+    ).run(...ids);
+    return result.changes;
+  }
+
+  // ── Automation executions (local only) ───────────────────────
+
+  upsertAutomationExecution(entry: {
+    id: string;
+    ruleId: string;
+    ruleName: string;
+    status: string;
+    startedAt: number;
+    finishedAt?: number;
+    result?: string;
+    error?: string;
+    attempt: number;
+    maxAttempts: number;
+    triggerSource?: string;
+    triggerType?: string;
+    triggerPayload?: string;
+  }): void {
+    this.db.prepare(
+      `INSERT OR REPLACE INTO automation_executions (
+        id, rule_id, rule_name, status, started_at, finished_at, result, error,
+        attempt, max_attempts, trigger_source, trigger_type, trigger_payload
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(
+      entry.id,
+      entry.ruleId,
+      entry.ruleName,
+      entry.status,
+      entry.startedAt,
+      entry.finishedAt ?? null,
+      entry.result ?? null,
+      entry.error ?? null,
+      entry.attempt,
+      entry.maxAttempts,
+      entry.triggerSource ?? null,
+      entry.triggerType ?? null,
+      entry.triggerPayload ?? null,
+    );
+  }
+
+  queryAutomationExecutions(limit = 100): AutomationExecutionRow[] {
+    return this.db.prepare(
+      `SELECT * FROM automation_executions ORDER BY started_at DESC LIMIT ?`,
+    ).all(limit) as AutomationExecutionRow[];
+  }
+
+  getAutomationExecution(id: string): AutomationExecutionRow | null {
+    const row = this.db.prepare(
+      `SELECT * FROM automation_executions WHERE id = ?`,
+    ).get(id) as AutomationExecutionRow | undefined;
+    return row ?? null;
+  }
+
+  // ── Replication support ───────────────────────────────────────
+
+  /** Get rows from a replicated table for a given node_id where source_seq > afterSeq. */
+  getRowsSince(table: ReplicatedTable, nodeId: string, afterSeq: number, limit = 500): Record<string, unknown>[] {
+    this.validateTableName(table);
+    return this.db.prepare(
+      `SELECT * FROM ${table} WHERE node_id = ? AND source_seq > ? ORDER BY source_seq ASC LIMIT ?`,
+    ).all(nodeId, afterSeq, limit) as Record<string, unknown>[];
+  }
+
+  /** Get the maximum source_seq for a given node_id in a replicated table. */
+  getMaxSeq(table: ReplicatedTable, nodeId: string): number {
+    this.validateTableName(table);
+    const row = this.db.prepare(
+      `SELECT MAX(source_seq) AS max_seq FROM ${table} WHERE node_id = ?`,
+    ).get(nodeId) as { max_seq: number | null } | undefined;
+    return row?.max_seq ?? 0;
+  }
+
+  /** Get max source_seq for ALL node_ids in a replicated table (for building vector clock). */
+  getVectorClock(table: ReplicatedTable): Record<string, number> {
+    this.validateTableName(table);
+    const rows = this.db.prepare(
+      `SELECT node_id, MAX(source_seq) AS max_seq FROM ${table} GROUP BY node_id`,
+    ).all() as Array<{ node_id: string; max_seq: number }>;
+    const clock: Record<string, number> = {};
+    for (const row of rows) clock[row.node_id] = row.max_seq;
+    return clock;
+  }
+
+  /** Get a resume vector that preserves high-water marks even after local TTL cleanup. */
+  getResumeVector(table: ReplicatedTable): Record<string, number> {
+    const clock = this.getVectorClock(table);
+    const persisted = this.getAllReplicationState()[table];
+    for (const [nodeId, maxSeq] of Object.entries(persisted)) {
+      clock[nodeId] = Math.max(clock[nodeId] ?? 0, maxSeq);
+    }
+    return clock;
+  }
+
+  /** Insert replicated rows from a remote peer. Uses INSERT OR IGNORE for dedup. */
+  insertReplicatedRows(table: ReplicatedTable, rows: Record<string, unknown>[]): number {
+    if (rows.length === 0) return 0;
+    this.validateTableName(table);
+
+    let inserted = 0;
+    const txn = this.db.transaction(() => {
+      for (const row of rows) {
+        const result = this.insertReplicatedRow(table, row);
+        if (result) inserted++;
+      }
+    });
+    txn();
+    return inserted;
+  }
+
+  private insertReplicatedRow(table: ReplicatedTable, row: Record<string, unknown>): boolean {
+    switch (table) {
+      case "audit_log": {
+        const r = this.db.prepare(
+          `INSERT OR IGNORE INTO audit_log (source_seq, node_id, ts, event, ip, detail) VALUES (?, ?, ?, ?, ?, ?)`,
+        ).run(row.source_seq, row.node_id, row.ts, row.event, row.ip ?? null, row.detail ?? null);
+        return r.changes > 0;
+      }
+      case "health_events": {
+        const r = this.db.prepare(
+          `INSERT OR IGNORE INTO health_events (source_seq, node_id, ts, type, peer, via, reason) VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        ).run(row.source_seq, row.node_id, row.ts, row.type, row.peer ?? null, row.via ?? null, row.reason ?? null);
+        return r.changes > 0;
+      }
+      case "handoff_history": {
+        const r = this.db.prepare(
+          `INSERT OR IGNORE INTO handoff_history (source_seq, node_id, ts, task_id, from_node, to_node, agent, duration, status, error) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        ).run(row.source_seq, row.node_id, row.ts, row.task_id, row.from_node, row.to_node, row.agent, row.duration ?? null, row.status, row.error ?? null);
+        return r.changes > 0;
+      }
+    }
+  }
+
+  // ── Replication state persistence ─────────────────────────────
+
+  /** Get persisted vector clock for a peer (used on reconnect to resume sync). */
+  getReplicationState(table: ReplicatedTable, peerNodeId: string): number {
+    const row = this.db.prepare(
+      `SELECT max_source_seq FROM replication_state WHERE table_name = ? AND peer_node_id = ?`,
+    ).get(table, peerNodeId) as { max_source_seq: number } | undefined;
+    return row?.max_source_seq ?? 0;
+  }
+
+  /** Persist vector clock entry for a peer. */
+  setReplicationState(table: ReplicatedTable, peerNodeId: string, maxSourceSeq: number): void {
+    this.db.prepare(
+      `INSERT OR REPLACE INTO replication_state (table_name, peer_node_id, max_source_seq) VALUES (?, ?, ?)`,
+    ).run(table, peerNodeId, maxSourceSeq);
+  }
+
+  /** Get all replication state as a nested map: table → nodeId → maxSeq. */
+  getAllReplicationState(): Record<ReplicatedTable, Record<string, number>> {
+    const rows = this.db.prepare(`SELECT * FROM replication_state`).all() as ReplicationStateRow[];
+    const result: Record<string, Record<string, number>> = {
+      audit_log: {},
+      health_events: {},
+      handoff_history: {},
+    };
+    for (const row of rows) {
+      if (result[row.table_name]) {
+        result[row.table_name]![row.peer_node_id] = row.max_source_seq;
+      }
+    }
+    return result as Record<ReplicatedTable, Record<string, number>>;
+  }
+
+  // ── TTL cleanup ───────────────────────────────────────────────
+
+  /** Delete rows older than cutoff timestamp. Returns count of deleted rows per table. */
+  cleanup(cutoffTs: number): { audit: number; health: number; handoff: number; satellite: number; ingested: number; automation: number } {
+    const audit = this.db.prepare(`DELETE FROM audit_log WHERE ts < ?`).run(cutoffTs).changes;
+    const health = this.db.prepare(`DELETE FROM health_events WHERE ts < ?`).run(cutoffTs).changes;
+    const handoff = this.db.prepare(`DELETE FROM handoff_history WHERE ts < ?`).run(cutoffTs).changes;
+    const satellite = this.db.prepare(`DELETE FROM satellite_events WHERE ts < ?`).run(cutoffTs).changes;
+    const ingested = this.db.prepare(`DELETE FROM ingested_events WHERE ts < ?`).run(cutoffTs).changes;
+    const automation = this.db.prepare(`DELETE FROM automation_executions WHERE started_at < ?`).run(cutoffTs).changes;
+    return { audit, health, handoff, satellite, ingested, automation };
+  }
+
+  // ── Internal helpers ──────────────────────────────────────────
+
+  private validateTableName(table: string) {
+    if (!["audit_log", "health_events", "handoff_history"].includes(table)) {
+      throw new Error(`Invalid replicated table name: ${table}`);
+    }
+  }
+}

package/src/terminal.ts

@@ -43,7 +43,9 @@ interface RemoteSession {
   sessionId: string;
   nodeId: string;
   frameId: string;
-  outputBuffer: string;     // accumulated output (base64 decoded)
+  /** Accumulated output chunks — joined lazily via getOutput() to avoid O(n) string concat. */
+  outputChunks: string[];
+  outputBytes: number;
   lastActivity: number;
   closed: boolean;
   exitCode?: number;
@@ -341,7 +343,8 @@ export class TerminalManager {
         sessionId: frame.payload.sessionId,
         nodeId: frame.from,
         frameId: frame.id,
-        outputBuffer: "",
+        outputChunks: [],
+        outputBytes: 0,
         lastActivity: Date.now(),
         closed: false,
       };
@@ -363,10 +366,15 @@ export class TerminalManager {
     session.lastActivity = Date.now();
     const decoded = Buffer.from(frame.payload.data, "base64").toString();
 
-    // Cap output buffer
-    session.outputBuffer += decoded;
-    if (session.outputBuffer.length > MAX_OUTPUT_BUFFER) {
-      session.outputBuffer = session.outputBuffer.slice(-MAX_OUTPUT_BUFFER);
+    // Append to chunk array (O(1) amortized) instead of string concat (O(n))
+    session.outputChunks.push(decoded);
+    session.outputBytes += decoded.length;
+
+    // Cap output buffer: compact when over limit
+    if (session.outputBytes > MAX_OUTPUT_BUFFER) {
+      const joined = session.outputChunks.join("").slice(-MAX_OUTPUT_BUFFER);
+      session.outputChunks = [joined];
+      session.outputBytes = joined.length;
     }
   }
 
@@ -450,8 +458,9 @@ export class TerminalManager {
       return { data: "", closed: true, exitCode: undefined };
     }
 
-    const data = session.outputBuffer;
-    session.outputBuffer = "";
+    const data = session.outputChunks.join("");
+    session.outputChunks = [];
+    session.outputBytes = 0;
 
     return { data, closed: session.closed, exitCode: session.exitCode };
   }

package/src/tool-proxy.ts

@@ -9,6 +9,7 @@ import type {
   ToolBatchResultItem,
 } from "./types.ts";
 import type { PluginLogger } from "openclaw/plugin-sdk";
+import { nanoid } from "nanoid";
 import { isLocalTool, executeLocally } from "./local-tools.ts";
 import { writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
@@ -33,7 +34,7 @@ export interface GatewayInfo {
   authHeader?: string;
 }
 
-/** Interface for satellite tool routing (implemented by WebHandler). */
+/** Interface for satellite tool routing (implemented by ApiHandler). */
 export interface SatelliteToolHandler {
   isSatelliteNode(nodeId: string): boolean;
   queueToolForSatellite(nodeId: string, id: string, tool: string, params: Record<string, unknown>, timeout?: number): Promise<Record<string, unknown>>;
@@ -65,7 +66,7 @@ export class ToolProxy {
     this.allowAll = this.allowSet.size === 0 || this.allowSet.has("*");
   }
 
-  /** Set the satellite tool handler (called by ClusterRuntime after WebHandler is created). */
+  /** Set the satellite tool handler (called by ClusterRuntime after ApiHandler is created). */
   setSatelliteHandler(handler: SatelliteToolHandler) {
     this.satelliteHandler = handler;
   }
@@ -91,14 +92,14 @@ export class ToolProxy {
     // If no WS route, try satellite fallback
     if (!route) {
       if (this.satelliteHandler?.isSatelliteNode(node)) {
-        const id = crypto.randomUUID();
+        const id = nanoid();
         this.logger.info(`[clawmatrix] Tool invoke: "${tool}" -> satellite node "${node}" (id=${id})`);
         return this.satelliteHandler.queueToolForSatellite(node, id, tool, params, timeout);
       }
       throw new Error(`Node "${node}" not reachable`);
     }
 
-    const id = crypto.randomUUID();
+    const id = nanoid();
     this.logger.info(`[clawmatrix] Tool invoke: "${tool}" -> node "${node}" (id=${id})`);
     const frame: ToolProxyRequest = {
       type: "tool_req",
@@ -283,7 +284,7 @@ export class ToolProxy {
     const route = this.peerManager.router.resolveNode(node);
     if (!route) throw new Error(`Node "${node}" not reachable`);
 
-    const id = crypto.randomUUID();
+    const id = nanoid();
     this.logger.info(`[clawmatrix] Tool batch: ${items.length} items -> node "${node}" (id=${id})`);
     const frame: ToolBatchRequest = {
       type: "tool_batch_req",