commandmate 0.10.2 → 0.10.4

package/dist/cli/utils/pid-manager.js

@@ -1,8 +1,10 @@
 "use strict";
 /**
- * PID File Manager
+ * PID / Daemon State File Manager
  * Issue #96: npm install CLI support
  * Issue #136: Phase 2 - Task 2.4 - Added factory functions for Issue number support
+ * Issue #1354/#1355/#1358: the file now records the daemon's version, effective settings, and
+ *   a process-identity signature, not just the PID. See DaemonState.
  * SF-1: SRP - Separated from daemon.ts for single responsibility
  * MF-SEC-2: TOCTOU protection with O_EXCL atomic writes
  */
@@ -12,53 +14,80 @@ exports.createPidManager = createPidManager;
 exports.createIssuePidManager = createIssuePidManager;
 const fs_1 = require("fs");
 const resource_resolvers_1 = require("./resource-resolvers");
+const process_inspector_1 = require("./process-inspector");
 /**
  * PID file manager for daemon process tracking
  */
 class PidManager {
     pidFilePath;
-    constructor(pidFilePath) {
+    readStartTime;
+    /**
+     * @param pidFilePath - Path to the state file for this server
+     * @param readStartTime - Injectable process-identity reader (Issue #1358); defaults to `ps`.
+     *   Overridden in tests to avoid spawning a real process.
+     */
+    constructor(pidFilePath, readStartTime = process_inspector_1.getProcessStartTime) {
         this.pidFilePath = pidFilePath;
+        this.readStartTime = readStartTime;
     }
     /**
-     * Check if PID file exists
+     * Check if the state file exists
      */
     exists() {
         return (0, fs_1.existsSync)(this.pidFilePath);
     }
     /**
-     * Read PID from file
-     * @returns PID number or null if file doesn't exist or is invalid
+     * Read the daemon state from file.
+     *
+     * Tolerates the legacy format (a bare integer PID) by returning `{ pid }`, so a state file
+     * written by an older running daemon is still understood after a CLI upgrade (Issue #1354).
+     *
+     * @returns The daemon state, or null when the file is missing or invalid
      */
-    readPid() {
+    readState() {
         if (!this.exists()) {
             return null;
         }
         try {
             const content = (0, fs_1.readFileSync)(this.pidFilePath, 'utf-8').trim();
-            const pid = parseInt(content, 10);
-            if (isNaN(pid) || pid <= 0) {
+            if (content.length === 0) {
                 return null;
             }
-            return pid;
+            // Legacy format: the file held only the PID as a bare integer.
+            if (/^\d+$/.test(content)) {
+                const pid = parseInt(content, 10);
+                return pid > 0 ? { pid } : null;
+            }
+            const parsed = JSON.parse(content);
+            if (typeof parsed.pid !== 'number' || !Number.isInteger(parsed.pid) || parsed.pid <= 0) {
+                return null;
+            }
+            return parsed;
         }
         catch {
             return null;
         }
     }
     /**
-     * Write PID to file atomically
+     * Read PID from the state file
+     * @returns PID number or null if file doesn't exist or is invalid
+     */
+    readPid() {
+        return this.readState()?.pid ?? null;
+    }
+    /**
+     * Write the daemon state to file atomically
      * MF-SEC-2: Uses O_EXCL to prevent TOCTOU race conditions
      *
      * @returns true if successful, false if file already exists
      * @throws Error for other filesystem errors
      */
-    writePid(pid) {
+    writeState(state) {
         try {
             // O_EXCL: Fail if file already exists (atomic check-and-create)
             const fd = (0, fs_1.openSync)(this.pidFilePath, fs_1.constants.O_WRONLY | fs_1.constants.O_CREAT | fs_1.constants.O_EXCL, 0o600);
             try {
-                (0, fs_1.writeSync)(fd, String(pid));
+                (0, fs_1.writeSync)(fd, JSON.stringify(state));
                 return true;
             }
             finally {
@@ -74,7 +103,17 @@ class PidManager {
         }
     }
     /**
-     * Remove PID file
+     * Read a live process's start-time signature via the injected reader.
+     * Used by start() to record the daemon's identity at launch (Issue #1358).
+     *
+     * @param pid - Process ID to inspect
+     * @returns The start-time signature, or null when it cannot be read
+     */
+    getStartTime(pid) {
+        return this.readStartTime(pid);
+    }
+    /**
+     * Remove the state file
      */
     removePid() {
         if (this.exists()) {
@@ -87,29 +126,50 @@ class PidManager {
         }
     }
     /**
-     * Check if the process recorded in PID file is running
+     * Check if the process recorded in the state file is the daemon we started.
      * NTH-1: ISP - Lightweight process check API
      *
-     * @returns true if process is running, false otherwise
+     * Issue #1358: `process.kill(pid, 0)` alone only proves the PID is in use. When the state
+     * records a start-time signature, the live process's is compared to catch PID reuse; a
+     * mismatch is treated as not-running so stop() never kills, and start() never defers to, an
+     * unrelated process. EPERM (the PID was reused by a process we don't own) is likewise treated
+     * as stale rather than thrown, so a reused PID no longer crashes the command.
+     *
+     * @returns true if the daemon is running, false otherwise
      */
     isProcessRunning() {
-        const pid = this.readPid();
-        if (pid === null) {
+        const state = this.readState();
+        if (state === null) {
             return false;
         }
         try {
             // Sending signal 0 checks if process exists without killing it
-            process.kill(pid, 0);
-            return true;
+            process.kill(state.pid, 0);
         }
         catch (err) {
-            if (err.code === 'ESRCH') {
+            const code = err.code;
+            if (code === 'ESRCH') {
                 // Process not found
                 return false;
             }
-            // Other errors (e.g., EPERM) mean process exists but we can't signal it
+            if (code === 'EPERM') {
+                // Issue #1358: the PID now belongs to a process we don't own — i.e. it was reused by
+                // an unrelated (possibly other-user) process. Treat as stale, not an error.
+                return false;
+            }
+            // Other, genuinely unexpected errors still surface
             throw err;
         }
+        // Issue #1358: the PID exists, but on a long-running machine the OS may have reused it for
+        // an unrelated process after our daemon died. If we recorded the start time, verify the live
+        // process still has it. A null reading (no `ps`, etc.) leaves the best-effort answer intact.
+        if (state.startTime) {
+            const current = this.readStartTime(state.pid);
+            if (current !== null && current !== state.startTime) {
+                return false;
+            }
+        }
+        return true;
     }
 }
 exports.PidManager = PidManager;

package/dist/cli/utils/process-inspector.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Process Inspector
+ * Issue #1358: verify a PID still belongs to the daemon we started
+ *
+ * `process.kill(pid, 0)` only proves *some* process owns the PID. On a long-running machine
+ * the OS reuses PIDs, so after the daemon crashes the same PID can belong to an unrelated
+ * process. Recording the OS-reported start time at launch and comparing it later lets us tell
+ * "our daemon is still running" from "the PID was reused".
+ */
+/**
+ * A function that returns a stable identity signature for a PID, or null when it cannot be
+ * determined. Injected into PidManager so tests can supply a deterministic reader.
+ */
+export type ProcessStartTimeReader = (pid: number) => string | null;
+/**
+ * Read a process's start time via `ps`, as an absolute wall-clock string.
+ *
+ * `-o lstart=` prints e.g. "Sat Jul 18 01:03:24 2026" and is stable across invocations (unlike
+ * `etime`, which advances), so two reads of the same live process return the same value while a
+ * reused PID returns a different one. Works on macOS and Linux; any failure (no `ps`, unknown
+ * PID, permission) returns null so callers fall back to best-effort behaviour instead of erroring.
+ *
+ * @param pid - Process ID to inspect
+ * @returns The start-time signature, or null when it cannot be read
+ */
+export declare function getProcessStartTime(pid: number): string | null;
+//# sourceMappingURL=process-inspector.d.ts.map

package/dist/cli/utils/process-inspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-inspector.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/process-inspector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9D"}

package/dist/cli/utils/process-inspector.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Process Inspector
+ * Issue #1358: verify a PID still belongs to the daemon we started
+ *
+ * `process.kill(pid, 0)` only proves *some* process owns the PID. On a long-running machine
+ * the OS reuses PIDs, so after the daemon crashes the same PID can belong to an unrelated
+ * process. Recording the OS-reported start time at launch and comparing it later lets us tell
+ * "our daemon is still running" from "the PID was reused".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProcessStartTime = getProcessStartTime;
+const child_process_1 = require("child_process");
+/**
+ * Read a process's start time via `ps`, as an absolute wall-clock string.
+ *
+ * `-o lstart=` prints e.g. "Sat Jul 18 01:03:24 2026" and is stable across invocations (unlike
+ * `etime`, which advances), so two reads of the same live process return the same value while a
+ * reused PID returns a different one. Works on macOS and Linux; any failure (no `ps`, unknown
+ * PID, permission) returns null so callers fall back to best-effort behaviour instead of erroring.
+ *
+ * @param pid - Process ID to inspect
+ * @returns The start-time signature, or null when it cannot be read
+ */
+function getProcessStartTime(pid) {
+    try {
+        const out = (0, child_process_1.execFileSync)('ps', ['-o', 'lstart=', '-p', String(pid)], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+        }).trim();
+        return out.length > 0 ? out : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/server/src/config/github-links.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * GitHub URL Constants (Centralized)
+ * Issue #264: DRY - All GitHub URLs derived from GITHUB_REPO_BASE_URL
+ *
+ * [SEC-001] SSRF Prevention: GITHUB_API_URL is NOT included here.
+ * It remains hardcoded in version-checker.ts for security reasons.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_SECURITY_GUIDE_URL = exports.GITHUB_RELEASE_URL_PREFIX = exports.GITHUB_QUESTION_URL = exports.GITHUB_FEATURE_REQUEST_URL = exports.GITHUB_BUG_REPORT_URL = exports.GITHUB_NEW_ISSUE_URL = exports.GITHUB_ISSUES_URL = exports.GITHUB_REPO_BASE_URL = void 0;
+exports.GITHUB_REPO_BASE_URL = 'https://github.com/Kewton/CommandMate';
+// Issue URLs
+exports.GITHUB_ISSUES_URL = `${exports.GITHUB_REPO_BASE_URL}/issues`;
+exports.GITHUB_NEW_ISSUE_URL = `${exports.GITHUB_REPO_BASE_URL}/issues/new`;
+// Template URLs (UI: uses filename in query parameter)
+exports.GITHUB_BUG_REPORT_URL = `${exports.GITHUB_NEW_ISSUE_URL}?template=bug_report.md`;
+exports.GITHUB_FEATURE_REQUEST_URL = `${exports.GITHUB_NEW_ISSUE_URL}?template=feature_request.md`;
+exports.GITHUB_QUESTION_URL = `${exports.GITHUB_NEW_ISSUE_URL}?template=question.md`;
+// Release URL (moved from version-checker.ts, re-exported there for backward compatibility)
+exports.GITHUB_RELEASE_URL_PREFIX = `${exports.GITHUB_REPO_BASE_URL}/releases/`;
+// Security Guide URL (moved from security-messages.ts)
+exports.GITHUB_SECURITY_GUIDE_URL = `${exports.GITHUB_REPO_BASE_URL}/blob/main/docs/security-guide.md`;

package/dist/server/src/lib/db/db-instance.js

@@ -45,11 +45,30 @@ function getDbInstance() {
             fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
         }
         // Issue #1263: recover from a better-sqlite3 ABI mismatch (Node.js version switch)
-        dbInstance = (0, abi_recovery_1.openDatabaseWithAbiRecovery)(dbPath);
+        const db = (0, abi_recovery_1.openDatabaseWithAbiRecovery)(dbPath);
         // Issue #294: Enable foreign key enforcement BEFORE migrations
         // This ensures ON DELETE CASCADE works correctly for all tables
-        dbInstance.pragma('foreign_keys = ON');
-        (0, db_migrations_1.runMigrations)(dbInstance);
+        db.pragma('foreign_keys = ON');
+        // Issue #1360: harden against SQLITE_BUSY when the same DB file is opened by
+        // more than one process (e.g. a misconfigured worktree server sharing
+        // CM_DB_PATH). WAL lets readers and a single writer coexist instead of
+        // taking an exclusive lock, and busy_timeout makes a contended write wait
+        // for the lock (up to 5s) rather than failing immediately with the default
+        // busy_timeout of 0. Set before migrations so migration writes benefit too.
+        db.pragma('journal_mode = WAL');
+        db.pragma('busy_timeout = 5000');
+        // Issue #1353: only publish the connection once its schema is verified.
+        // Assigning before runMigrations() cached a database whose migrations had
+        // thrown, so every later caller was handed it back without the failure —
+        // the guard would fire once and be bypassed for the rest of the process.
+        try {
+            (0, db_migrations_1.runMigrations)(db);
+        }
+        catch (error) {
+            db.close();
+            throw error;
+        }
+        dbInstance = db;
     }
     return dbInstance;
 }

package/dist/server/src/lib/db/db-repository.js

@@ -8,11 +8,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_DISABLED_REPOSITORIES = void 0;
+exports.MAX_DISABLED_REPOSITORIES = exports.RepositoryDbError = void 0;
 exports.createRepository = createRepository;
 exports.getRepositoryByNormalizedUrl = getRepositoryByNormalizedUrl;
 exports.getRepositoryById = getRepositoryById;
 exports.getRepositoryByPath = getRepositoryByPath;
+exports.deleteRepository = deleteRepository;
+exports.countWorktreesByRepositoryPath = countWorktreesByRepositoryPath;
 exports.updateRepository = updateRepository;
 exports.getAllRepositories = getAllRepositories;
 exports.getAllRepositoriesWithWorktreeCount = getAllRepositoriesWithWorktreeCount;
@@ -22,6 +24,7 @@ exports.ensureEnvRepositoriesRegistered = ensureEnvRepositoriesRegistered;
 exports.filterExcludedPaths = filterExcludedPaths;
 exports.registerAndFilterRepositories = registerAndFilterRepositories;
 exports.disableRepository = disableRepository;
+exports.disableExistingRepository = disableExistingRepository;
 exports.getExcludedRepositoryPaths = getExcludedRepositoryPaths;
 exports.getExcludedRepositories = getExcludedRepositories;
 exports.restoreRepository = restoreRepository;
@@ -33,6 +36,28 @@ exports.getCloneJobsByStatus = getCloneJobsByStatus;
 const crypto_1 = require("crypto");
 const path_1 = __importDefault(require("path"));
 const system_directories_1 = require("../../config/system-directories");
+/**
+ * Typed error for repositories-table operations.
+ *
+ * Issue #1352: `createRepository()` used to let a raw better-sqlite3
+ * `SqliteError: UNIQUE constraint failed` propagate. A concurrent clone of the
+ * same URL has a TOCTOU window where both jobs pass the duplicate checks and
+ * the losing `createRepository()` throws that raw error, which the background
+ * clone path only logs (#1340). Convert UNIQUE violations to an explicit
+ * `DUPLICATE` code here so callers can distinguish the collision from other DB
+ * failures. Mirrors `ExternalAppDbError` in `external-apps/db.ts`.
+ */
+class RepositoryDbError extends Error {
+    code;
+    cause;
+    constructor(message, code, cause) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = 'RepositoryDbError';
+    }
+}
+exports.RepositoryDbError = RepositoryDbError;
 /**
  * Map repository row to Repository model
  */
@@ -94,7 +119,22 @@ function createRepository(db, data) {
     )
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `);
-    stmt.run(id, data.name, data.path, data.enabled !== false ? 1 : 0, data.visible !== false ? 1 : 0, data.cloneUrl || null, data.normalizedCloneUrl || null, data.cloneSource, data.isEnvManaged ? 1 : 0, now, now);
+    // Issue #1352: `repositories.path` is UNIQUE and `normalized_clone_url` has a
+    // partial UNIQUE index. A concurrent clone of the same URL can race past the
+    // duplicate checks and reach here twice; the loser must fail with an explicit
+    // DUPLICATE rather than a raw SqliteError. These DB constraints are what
+    // serialize the final registration — the guard turns the collision into a
+    // typed error instead of preventing it.
+    try {
+        stmt.run(id, data.name, data.path, data.enabled !== false ? 1 : 0, data.visible !== false ? 1 : 0, data.cloneUrl || null, data.normalizedCloneUrl || null, data.cloneSource, data.isEnvManaged ? 1 : 0, now, now);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('UNIQUE constraint')) {
+            throw new RepositoryDbError(`A repository is already registered at path "${data.path}"` +
+                (data.normalizedCloneUrl ? ` or for URL "${data.normalizedCloneUrl}"` : ''), 'DUPLICATE', error);
+        }
+        throw new RepositoryDbError(`Failed to create repository: ${error instanceof Error ? error.message : 'Unknown error'}`, 'DB_ERROR', error instanceof Error ? error : undefined);
+    }
     return {
         id,
         name: data.name,
@@ -142,6 +182,39 @@ function getRepositoryByPath(db, path) {
     const row = stmt.get(path);
     return row ? mapRepositoryRow(row) : null;
 }
+/**
+ * Physically delete a repositories row by id.
+ *
+ * Issue #1350: before this, the only way to "remove" a repository was
+ * `disableRepository()` (enabled=0) — the row itself was never deleted. A row
+ * whose on-disk directory has been removed and that has no worktrees left
+ * ("ghost") therefore lingered forever and blocked re-cloning the same URL,
+ * with no removal path in the UI or API. This gives callers a real delete so a
+ * ghost can be cleared. Linkage of worktrees/child rows is by
+ * `worktrees.repository_path` (TEXT), not a FK to `repositories`, so deleting
+ * the row does not cascade — callers must confirm the row is a ghost first.
+ *
+ * @returns true if a row was deleted, false if no row matched the id.
+ */
+function deleteRepository(db, id) {
+    const result = db.prepare('DELETE FROM repositories WHERE id = ?').run(id);
+    return result.changes > 0;
+}
+/**
+ * Count the worktrees associated with a repository path.
+ *
+ * Repository ↔ worktree linkage is by matching `repositories.path` against
+ * `worktrees.repository_path` (TEXT) — see `getAllRepositoriesWithWorktreeCount`.
+ * Issue #1350 uses this to tell a recoverable "ghost" (directory gone AND zero
+ * worktrees) apart from a repository that still has worktrees registered, which
+ * must never be silently deleted.
+ */
+function countWorktreesByRepositoryPath(db, repositoryPath) {
+    const row = db
+        .prepare('SELECT COUNT(*) AS count FROM worktrees WHERE repository_path = ?')
+        .get(repositoryPath);
+    return Number(row.count) || 0;
+}
 /**
  * Update repository
  *
@@ -371,25 +444,40 @@ function registerAndFilterRepositories(db, repositoryPaths) {
  * SF-002: SRP - disable logic encapsulated
  */
 function disableRepository(db, repositoryPath) {
-    const resolvedPath = resolveRepositoryPath(repositoryPath);
-    const repo = getRepositoryByPath(db, resolvedPath);
-    if (repo) {
-        updateRepository(db, repo.id, { enabled: false });
+    if (disableExistingRepository(db, repositoryPath)) {
+        return;
     }
-    else {
-        // SEC-SF-004: Check disabled repository count limit before creating new record
-        const disabledCount = db.prepare('SELECT COUNT(*) as count FROM repositories WHERE enabled = 0').get();
-        if (disabledCount.count >= exports.MAX_DISABLED_REPOSITORIES) {
-            throw new Error('Disabled repository limit exceeded');
-        }
-        createRepository(db, {
-            name: path_1.default.basename(resolvedPath),
-            path: resolvedPath,
-            cloneSource: 'local',
-            isEnvManaged: false,
-            enabled: false, // Explicit: do not rely on undefined -> 1 default
-        });
+    const resolvedPath = resolveRepositoryPath(repositoryPath);
+    // SEC-SF-004: Check disabled repository count limit before creating new record
+    const disabledCount = db.prepare('SELECT COUNT(*) as count FROM repositories WHERE enabled = 0').get();
+    if (disabledCount.count >= exports.MAX_DISABLED_REPOSITORIES) {
+        throw new Error('Disabled repository limit exceeded');
     }
+    createRepository(db, {
+        name: path_1.default.basename(resolvedPath),
+        path: resolvedPath,
+        cloneSource: 'local',
+        isEnvManaged: false,
+        enabled: false, // Explicit: do not rely on undefined -> 1 default
+    });
+}
+/**
+ * Disable a repository only when it is already registered (enabled=0).
+ *
+ * Unlike disableRepository(), this never creates a record, so callers that may be
+ * handed a path that was never registered do not leave a ghost `enabled=0` row behind.
+ *
+ * Issue #1346
+ *
+ * @returns true if a registered repository was disabled, false if none was registered
+ */
+function disableExistingRepository(db, repositoryPath) {
+    const resolvedPath = resolveRepositoryPath(repositoryPath);
+    const repo = getRepositoryByPath(db, resolvedPath);
+    if (!repo)
+        return false;
+    updateRepository(db, repo.id, { enabled: false });
+    return true;
 }
 /**
  * Get paths of excluded (enabled=0) repositories

package/dist/server/src/lib/db/db.js

@@ -11,8 +11,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeAgentInstance = exports.addAgentInstance = exports.setAgentInstances = exports.countAgentInstances = exports.getAgentInstance = exports.getAgentInstances = exports.deleteSessionState = exports.clearInProgressMessageId = exports.setInProgressMessageId = exports.updateSessionState = exports.getSessionState = exports.getMessagesByDateRange = exports.ACTIVE_FILTER = exports.markPendingPromptsAsAnswered = exports.updatePromptData = exports.getMessageById = exports.recomputeLastUserMessage = exports.clearLastUserMessage = exports.updateLastUserMessage = exports.deleteMessagesByInstance = exports.deleteMessagesByCliTool = exports.deleteMessageById = exports.deleteAllMessages = exports.getLastMessage = exports.getLastUserMessage = exports.getMessages = exports.updateMessageContent = exports.createMessage = exports.getLastAssistantMessageAt = exports.deleteWorktreesByIds = exports.deleteRepositoryWorktrees = exports.migrateWorktreeIdPreservingChildren = exports.getWorktreesByRepository = exports.getWorktreeIdsByRepository = exports.getInitialBranch = exports.saveInitialBranch = exports.updateVibeLocalContextWindow = exports.updateVibeLocalModel = exports.updateSelectedAgents = exports.updateCliToolId = exports.updateStatus = exports.updateFavorite = exports.updateLastViewedAt = exports.updateWorktreeLink = exports.updateWorktreeDescription = exports.upsertWorktree = exports.getWorktreeById = exports.getRepositories = exports.getWorktrees = exports.initDatabase = void 0;
-exports.getLatestAssistantExecutionByConversation = exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
-exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = void 0;
+exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.MemoDbError = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
+exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = void 0;
 // init-db
 var init_db_1 = require("./init-db");
 Object.defineProperty(exports, "initDatabase", { enumerable: true, get: function () { return init_db_1.initDatabase; } });
@@ -83,6 +83,7 @@ Object.defineProperty(exports, "createMemo", { enumerable: true, get: function (
 Object.defineProperty(exports, "updateMemo", { enumerable: true, get: function () { return memo_db_1.updateMemo; } });
 Object.defineProperty(exports, "deleteMemo", { enumerable: true, get: function () { return memo_db_1.deleteMemo; } });
 Object.defineProperty(exports, "reorderMemos", { enumerable: true, get: function () { return memo_db_1.reorderMemos; } });
+Object.defineProperty(exports, "MemoDbError", { enumerable: true, get: function () { return memo_db_1.MemoDbError; } });
 // todo-db (repository-scoped Home ToDo widget)
 var todo_db_1 = require("./todo-db");
 Object.defineProperty(exports, "getTodosByRepositoryId", { enumerable: true, get: function () { return todo_db_1.getTodosByRepositoryId; } });

package/dist/server/src/lib/db/memo-db.js

@@ -6,6 +6,7 @@
  * Issue #479: Extracted from db.ts for single-responsibility separation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoDbError = void 0;
 exports.getMemosByWorktreeId = getMemosByWorktreeId;
 exports.getMemoById = getMemoById;
 exports.createMemo = createMemo;
@@ -13,6 +14,26 @@ exports.updateMemo = updateMemo;
 exports.deleteMemo = deleteMemo;
 exports.reorderMemos = reorderMemos;
 const crypto_1 = require("crypto");
+/**
+ * Database error for memo operations.
+ *
+ * Issue #1351: `createMemo` writes to a table with a
+ * `UNIQUE(worktree_id, position)` constraint. Converting the driver's opaque
+ * "UNIQUE constraint failed" message into a typed, coded error lets API callers
+ * map the collision to an explicit 409 instead of a generic 500. Mirrors
+ * `ExternalAppDbError` in `src/lib/external-apps/db.ts`.
+ */
+class MemoDbError extends Error {
+    code;
+    cause;
+    constructor(message, code, cause) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = 'MemoDbError';
+    }
+}
+exports.MemoDbError = MemoDbError;
 /**
  * Map database row to WorktreeMemo model
  */
@@ -73,7 +94,17 @@ function createMemo(db, worktreeId, options) {
     INSERT INTO worktree_memos (id, worktree_id, title, content, position, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?)
   `);
-    stmt.run(id, worktreeId, title, content, options.position, now, now);
+    try {
+        stmt.run(id, worktreeId, title, content, options.position, now, now);
+    }
+    catch (error) {
+        // UNIQUE(worktree_id, position) violation -> typed DUPLICATE error (Issue #1351).
+        // Other failures (e.g. FOREIGN KEY) are re-thrown unchanged.
+        if (error instanceof Error && error.message.includes('UNIQUE constraint')) {
+            throw new MemoDbError(`Memo position ${options.position} is already in use for worktree "${worktreeId}"`, 'DUPLICATE_POSITION', error);
+        }
+        throw error;
+    }
     return {
         id,
         worktreeId,

package/dist/server/src/lib/db/migrations/index.js

@@ -26,6 +26,7 @@ const v39_worktree_todo_detail_1 = require("./v39-worktree-todo-detail");
 const v40_timer_error_1 = require("./v40-timer-error");
 const v41_push_subscriptions_1 = require("./v41-push-subscriptions");
 const v42_push_subscription_locale_1 = require("./v42-push-subscription-locale");
+const v43_remove_cm_root_dir_ghost_repository_1 = require("./v43-remove-cm-root-dir-ghost-repository");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -55,4 +56,5 @@ exports.migrations = [
     ...v40_timer_error_1.v40_migrations,
     ...v41_push_subscriptions_1.v41_migrations,
     ...v42_push_subscription_locale_1.v42_migrations,
+    ...v43_remove_cm_root_dir_ghost_repository_1.v43_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 42;
+exports.CURRENT_SCHEMA_VERSION = 43;
 /**
  * Get current schema version from database
  */
@@ -56,6 +56,16 @@ function runMigrations(db, migrations) {
     // Get current version
     const currentVersion = getCurrentVersion(db);
     console.log(`Current schema version: ${currentVersion}`);
+    // Issue #1353: refuse a database written by a newer build.
+    // Migrations only move forward, so this build has no definition for the
+    // schema it is looking at: queries still written against renamed/dropped
+    // columns would fail at runtime, long after startup reported success.
+    // The check sits after the version read but before any migration writes.
+    if (currentVersion > exports.CURRENT_SCHEMA_VERSION) {
+        throw new Error(`This database (schema v${currentVersion}) was created by a newer version of CommandMate ` +
+            `(this build supports up to v${exports.CURRENT_SCHEMA_VERSION}). ` +
+            `Please update: commandmate update`);
+    }
     // Find pending migrations
     const pendingMigrations = migrations.filter(migration => migration.version > currentVersion);
     if (pendingMigrations.length === 0) {