commandmate 0.18.0 → 0.20.0

package/dist/server/src/lib/db/db-repository.js

@@ -28,6 +28,8 @@ exports.disableExistingRepository = disableExistingRepository;
 exports.getExcludedRepositoryPaths = getExcludedRepositoryPaths;
 exports.getExcludedRepositories = getExcludedRepositories;
 exports.restoreRepository = restoreRepository;
+exports.countDisabledRepositories = countDisabledRepositories;
+exports.setRepositoryEnabled = setRepositoryEnabled;
 exports.createCloneJob = createCloneJob;
 exports.getCloneJob = getCloneJob;
 exports.updateCloneJob = updateCloneJob;
@@ -449,8 +451,7 @@ function disableRepository(db, repositoryPath) {
     }
     const resolvedPath = resolveRepositoryPath(repositoryPath);
     // SEC-SF-004: Check disabled repository count limit before creating new record
-    const disabledCount = db.prepare('SELECT COUNT(*) as count FROM repositories WHERE enabled = 0').get();
-    if (disabledCount.count >= exports.MAX_DISABLED_REPOSITORIES) {
+    if (countDisabledRepositories(db) >= exports.MAX_DISABLED_REPOSITORIES) {
         throw new Error('Disabled repository limit exceeded');
     }
     createRepository(db, {
@@ -508,6 +509,69 @@ function restoreRepository(db, repoPath) {
     updateRepository(db, repo.id, { enabled: true });
     return { ...repo, enabled: true };
 }
+/**
+ * Number of repositories currently excluded from scans (`enabled = 0`).
+ *
+ * Extracted so the SEC-SF-004 ceiling is counted the same way by every caller
+ * that can create one more disabled row ({@link disableRepository}) or flip an
+ * enabled row to disabled ({@link setRepositoryEnabled}).
+ */
+function countDisabledRepositories(db) {
+    const row = db
+        .prepare('SELECT COUNT(*) as count FROM repositories WHERE enabled = 0')
+        .get();
+    return Number(row.count) || 0;
+}
+/**
+ * Flip a repository's scan-inclusion flag by id, and touch NOTHING else
+ * (Issue #1658).
+ *
+ * This is the non-destructive counterpart to `DELETE /api/repositories`, which
+ * is "exclude **and purge**": it disables the repository, kills every tmux
+ * session under it, and deletes its `worktrees` rows — taking chat history,
+ * memos, todos, timers, schedules, execution logs, tasks and verification runs
+ * with them (`deleteWorktreeChildRows`). A user who only wants a scan root to
+ * stop being scanned had no other route, so "stop scanning this" cost them
+ * their history and their running agents.
+ *
+ * What this function does, exhaustively: one `UPDATE repositories SET enabled`.
+ * It does not read, write or delete `worktrees` or any child table, and it
+ * never touches `visible` — `enabled` (scan inclusion, Issue #190) and
+ * `visible` (sidebar display, Issue #690) stay orthogonal columns, so
+ * re-enabling restores the user's own visibility choice rather than a guess.
+ *
+ * The scan side is the other half of the pair and already reads this flag:
+ * `POST /api/repositories/sync` and `server.ts` both drop `enabled = 0` paths
+ * via {@link registerAndFilterRepositories}, and neither
+ * `syncWorktreesToDB`'s per-repository prune nor `pruneStaleRepositoryWorktrees`
+ * can reach the rows of a repository that is merely absent from the scan while
+ * its directory still exists.
+ *
+ * SEC-SF-004: disabling one more repository is refused once
+ * {@link MAX_DISABLED_REPOSITORIES} rows are already disabled. Re-disabling an
+ * already-disabled repository adds no row and is therefore always allowed.
+ *
+ * @param db - Database instance
+ * @param id - Repository id (`repositories.id`), not a path
+ * @param enabled - `true` to include in scans, `false` to exclude
+ * @returns The repository as it now stands, or `null` when no row has that id
+ * @throws {RepositoryDbError} code `LIMIT_EXCEEDED` when the disabled ceiling
+ *   would be crossed
+ */
+function setRepositoryEnabled(db, id, enabled) {
+    const repo = getRepositoryById(db, id);
+    if (!repo)
+        return null;
+    // Already in the requested state: nothing to write, and no ceiling to test
+    // (the row is already counted).
+    if (repo.enabled === enabled)
+        return repo;
+    if (!enabled && countDisabledRepositories(db) >= exports.MAX_DISABLED_REPOSITORIES) {
+        throw new RepositoryDbError(`Cannot disable more than ${exports.MAX_DISABLED_REPOSITORIES} repositories`, 'LIMIT_EXCEEDED');
+    }
+    updateRepository(db, id, { enabled });
+    return getRepositoryById(db, id);
+}
 // ============================================================
 // Clone Job Operations
 // ============================================================

package/dist/server/src/lib/db/db.js

@@ -10,9 +10,9 @@
  * @internal functions from being unintentionally exposed.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeAgentInstance = exports.addAgentInstance = exports.setAgentInstances = exports.countAgentInstances = exports.getAgentInstance = exports.getAgentInstances = exports.deleteSessionState = exports.clearInProgressMessageId = exports.setInProgressMessageId = exports.updateSessionState = exports.getSessionState = exports.getMessagesByDateRange = exports.ACTIVE_FILTER = exports.markPendingPromptsAsAnswered = exports.updatePromptData = exports.getMessageById = exports.recomputeLastUserMessage = exports.clearLastUserMessage = exports.updateLastUserMessage = exports.deleteMessagesByInstance = exports.deleteMessagesByCliTool = exports.deleteMessageById = exports.deleteAllMessages = exports.getLastMessage = exports.getLastUserMessage = exports.getMessages = exports.updateMessageContent = exports.createMessage = exports.getLastAssistantMessageAt = exports.deleteWorktreesByIds = exports.deleteRepositoryWorktrees = exports.migrateWorktreeIdPreservingChildren = exports.getWorktreesByRepository = exports.getWorktreeIdsByRepository = exports.getInitialBranch = exports.saveInitialBranch = exports.updateVibeLocalContextWindow = exports.updateVibeLocalModel = exports.updateSelectedAgents = exports.updateCliToolId = exports.updateStatus = exports.updateFavorite = exports.updateLastViewedAt = exports.updateWorktreeLink = exports.updateWorktreeDescription = exports.upsertWorktree = exports.getWorktreeById = exports.getRepositories = exports.getWorktrees = exports.initDatabase = void 0;
-exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.MemoDbError = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
-exports.listTaskEvents = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = exports.isTerminalTaskStatus = exports.getActiveTaskForInstance = exports.getActiveTask = exports.listTasks = exports.getTask = exports.createTask = exports.VERIFICATION_TRIGGERS = exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.listVerificationRunsForPeriod = exports.listRunningVerificationRuns = exports.getRunningVerificationRun = exports.listVerificationRuns = exports.getVerificationRun = exports.finishGateResult = exports.createGateResult = exports.finishVerificationRun = exports.createVerificationRun = exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = void 0;
+exports.clearInProgressMessageId = exports.setInProgressMessageId = exports.updateSessionState = exports.getSessionState = exports.getMessagesByDateRange = exports.ACTIVE_FILTER = exports.markPendingPromptsAsAnswered = exports.updatePromptData = exports.getMessageById = exports.recomputeLastUserMessage = exports.clearLastUserMessage = exports.updateLastUserMessage = exports.deleteMessagesByInstance = exports.deleteMessagesByCliTool = exports.deleteMessageById = exports.deleteAllMessages = exports.getLastMessage = exports.getLastUserMessage = exports.getMessages = exports.updateMessageContent = exports.createMessage = exports.getLastAssistantMessageAt = exports.getAliasedWorktreeIds = exports.getAllWorktreeAliases = exports.getWorktreeAliases = exports.resolveWorktreeIdWithAlias = exports.recordWorktreeAlias = exports.deleteWorktreesByIds = exports.deleteRepositoryWorktrees = exports.migrateWorktreeIdPreservingChildren = exports.getAllWorktreePathIds = exports.getAllWorktreeIds = exports.getWorktreesByRepository = exports.getWorktreeIdsByRepository = exports.getInitialBranch = exports.saveInitialBranch = exports.updateVibeLocalContextWindow = exports.updateVibeLocalModel = exports.updateSelectedAgents = exports.updateCliToolId = exports.updateStatus = exports.updateFavorite = exports.updateLastViewedAt = exports.updateWorktreeLink = exports.updateWorktreeDescription = exports.upsertWorktree = exports.getWorktreeById = exports.getRepositories = exports.getWorktrees = exports.initDatabase = void 0;
+exports.updateAssistantMessageStatus = exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.MemoDbError = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = exports.removeAgentInstance = exports.addAgentInstance = exports.setAgentInstances = exports.countAgentInstances = exports.getAgentInstance = exports.getAgentInstances = exports.deleteSessionState = void 0;
+exports.listTaskEvents = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = exports.isTerminalTaskStatus = exports.getActiveTaskForInstance = exports.getActiveTask = exports.listTasks = exports.getTask = exports.createTask = exports.VERIFICATION_TRIGGERS = exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.listVerificationRunsForPeriod = exports.listRunningVerificationRuns = exports.getRunningVerificationRun = exports.listVerificationRuns = exports.getVerificationRun = exports.finishGateResult = exports.createGateResult = exports.finishVerificationRun = exports.createVerificationRun = exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = void 0;
 // init-db
 var init_db_1 = require("./init-db");
 Object.defineProperty(exports, "initDatabase", { enumerable: true, get: function () { return init_db_1.initDatabase; } });
@@ -35,9 +35,18 @@ Object.defineProperty(exports, "saveInitialBranch", { enumerable: true, get: fun
 Object.defineProperty(exports, "getInitialBranch", { enumerable: true, get: function () { return worktree_db_1.getInitialBranch; } });
 Object.defineProperty(exports, "getWorktreeIdsByRepository", { enumerable: true, get: function () { return worktree_db_1.getWorktreeIdsByRepository; } });
 Object.defineProperty(exports, "getWorktreesByRepository", { enumerable: true, get: function () { return worktree_db_1.getWorktreesByRepository; } });
+Object.defineProperty(exports, "getAllWorktreeIds", { enumerable: true, get: function () { return worktree_db_1.getAllWorktreeIds; } });
+Object.defineProperty(exports, "getAllWorktreePathIds", { enumerable: true, get: function () { return worktree_db_1.getAllWorktreePathIds; } });
 Object.defineProperty(exports, "migrateWorktreeIdPreservingChildren", { enumerable: true, get: function () { return worktree_db_1.migrateWorktreeIdPreservingChildren; } });
 Object.defineProperty(exports, "deleteRepositoryWorktrees", { enumerable: true, get: function () { return worktree_db_1.deleteRepositoryWorktrees; } });
 Object.defineProperty(exports, "deleteWorktreesByIds", { enumerable: true, get: function () { return worktree_db_1.deleteWorktreesByIds; } });
+// worktree-alias-db (Issue #1621: old IDs stay resolvable after a rename)
+var worktree_alias_db_1 = require("./worktree-alias-db");
+Object.defineProperty(exports, "recordWorktreeAlias", { enumerable: true, get: function () { return worktree_alias_db_1.recordWorktreeAlias; } });
+Object.defineProperty(exports, "resolveWorktreeIdWithAlias", { enumerable: true, get: function () { return worktree_alias_db_1.resolveWorktreeIdWithAlias; } });
+Object.defineProperty(exports, "getWorktreeAliases", { enumerable: true, get: function () { return worktree_alias_db_1.getWorktreeAliases; } });
+Object.defineProperty(exports, "getAllWorktreeAliases", { enumerable: true, get: function () { return worktree_alias_db_1.getAllWorktreeAliases; } });
+Object.defineProperty(exports, "getAliasedWorktreeIds", { enumerable: true, get: function () { return worktree_alias_db_1.getAliasedWorktreeIds; } });
 // chat-db
 var chat_db_1 = require("./chat-db");
 Object.defineProperty(exports, "getLastAssistantMessageAt", { enumerable: true, get: function () { return chat_db_1.getLastAssistantMessageAt; } });

package/dist/server/src/lib/db/migrations/index.js

@@ -35,6 +35,10 @@ const v48_skill_operations_audit_index_1 = require("./v48-skill-operations-audit
 const v49_verification_runs_1 = require("./v49-verification-runs");
 const v50_tasks_1 = require("./v50-tasks");
 const v51_task_events_1 = require("./v51-task-events");
+const v52_orphaned_worktree_children_1 = require("./v52-orphaned-worktree-children");
+const v53_worktree_aliases_1 = require("./v53-worktree-aliases");
+const v54_worktree_id_path_derived_1 = require("./v54-worktree-id-path-derived");
+const v55_compact_churned_worktree_ids_1 = require("./v55-compact-churned-worktree-ids");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -73,4 +77,8 @@ exports.migrations = [
     ...v49_verification_runs_1.v49_migrations,
     ...v50_tasks_1.v50_migrations,
     ...v51_task_events_1.v51_migrations,
+    ...v52_orphaned_worktree_children_1.v52_migrations,
+    ...v53_worktree_aliases_1.v53_migrations,
+    ...v54_worktree_id_path_derived_1.v54_migrations,
+    ...v55_compact_churned_worktree_ids_1.v55_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 51;
+exports.CURRENT_SCHEMA_VERSION = 55;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v52-orphaned-worktree-children.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Migration v52: delete child rows pointing at a worktree that no longer exists
+ * (Issue #1621, Phase 0).
+ *
+ * `getWorktreeChildTables` used to enumerate child tables from foreign-key
+ * metadata alone, so `tasks` (#1548), `verification_runs` (#1544) and
+ * `skill_operations` (#1428) — each holding a `worktree_id` with no constraint
+ * declared — were invisible to both the rename path and the delete path. No
+ * CASCADE fires without a foreign key, so every worktree deleted since those
+ * tables landed left their rows behind, and every worktree ID rename left them
+ * addressing an ID nothing resolves. The code fix stops new orphans; this
+ * migration removes the ones already written.
+ *
+ * The sweep reuses the shared enumeration rather than naming tables, so the
+ * FK-less tables above and the FK-declared ones are treated identically — an
+ * orphan in a CASCADE table is equally unreachable, it just needed a
+ * `foreign_keys = OFF` window to be created.
+ *
+ * Three deliberate narrowings:
+ *
+ * - Append-only ledgers are excluded (`getDeletableWorktreeChildTables`).
+ *   `skill_operations` holds a `worktree_id` and does have rows referencing
+ *   worktrees that are gone, but it declares `BEFORE DELETE ... RAISE(ABORT)`
+ *   (#1234) and is read across every worktree by the audit feed. Deleting from
+ *   it aborts the statement, which here would roll back the migration and take
+ *   startup with it (measured). Its rows are history, not orphans.
+ * - `worktree_id IS NULL` rows are left alone. Every current child table
+ *   declares the column NOT NULL, so this cannot fire today; if a future table
+ *   makes it nullable, a NULL means "not attached", not "attached to something
+ *   gone", and deleting it would be data loss rather than cleanup.
+ * - `verification_gate_results` has no `worktree_id` and is not swept directly.
+ *   It reaches its worktree through `verification_runs(id) ON DELETE CASCADE`,
+ *   so deleting the orphaned runs takes its rows with them (better-sqlite3
+ *   enables `foreign_keys` by default, and db-instance.ts sets it explicitly).
+ *   `task_events` is *not* in the same position: v51 declares no foreign key to
+ *   `tasks` on purpose, because history that vanishes with its subject cannot
+ *   be audited afterwards. That is a design choice, not an orphan, so it stays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v52_migrations = void 0;
+const worktree_child_tables_1 = require("./worktree-child-tables");
+exports.v52_migrations = [
+    {
+        version: 52,
+        name: 'delete-orphaned-worktree-children',
+        up: (db) => {
+            let deleted = 0;
+            for (const { table, column } of (0, worktree_child_tables_1.getDeletableWorktreeChildTables)(db)) {
+                // Identifiers come from sqlite_master / PRAGMA, never from user input.
+                // The alias is `cm_parent` rather than something short like `w` so it
+                // cannot collide with a child table that happens to be named the same.
+                const result = db
+                    .prepare(`DELETE FROM "${table}"
+              WHERE "${column}" IS NOT NULL
+                AND NOT EXISTS (
+                  SELECT 1 FROM worktrees AS cm_parent
+                  WHERE cm_parent.id = "${table}"."${column}"
+                )`)
+                    .run();
+                if (result.changes > 0) {
+                    console.log(`Deleted ${result.changes} orphaned row(s) from ${table}.${column}`);
+                    deleted += result.changes;
+                }
+            }
+            if (deleted === 0) {
+                console.log('No orphaned worktree child rows found');
+            }
+        },
+        down: () => {
+            // Deleted rows cannot be resurrected. Defined anyway so rollback tooling
+            // (and the tests that rebuild a v51 database) keep working.
+            console.log('No rollback for orphaned child row cleanup (rows are gone)');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v53-worktree-aliases.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Migration v53: worktree_aliases (Issue #1621, Phase 2).
+ *
+ * Every ID a worktree has ever answered to, mapped to the ID it answers to now.
+ * #1644 froze the ID at first registration, but rows written before that carry
+ * a branch-derived ID, and #1645 will renumber them. The moment an ID moves,
+ * every URL a human kept — an open tab, a phone, a PWA shortcut, a bookmark, a
+ * script's `commandmate send <id>` — points at something that no longer
+ * resolves. An alias makes the old ID keep working instead of 404ing.
+ *
+ * `old_id` is the primary key: one historical ID resolves to exactly one
+ * worktree. `worktree_id` cascades, so a deleted worktree takes its aliases
+ * with it rather than leaving redirects to a dead row. (The column is also
+ * named `worktree_id`, so `getWorktreeChildTables` finds this table on both of
+ * its axes and a *rename* re-points the alias as well — an ID renamed twice
+ * still resolves in one hop, never a chain.)
+ *
+ * Resolution order is worktrees-first, aliases-second, and the ID minter is
+ * told about alias IDs too (`deriveWorktreeId`'s taken set), so a fresh
+ * worktree cannot be handed an ID that an alias would otherwise shadow. Both
+ * halves are needed: the index below exists for the second lookup, which runs
+ * on every API request whose worktree ID is not a live row.
+ *
+ * Timestamps are epoch milliseconds (INTEGER), matching v44 onward.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v53_migrations = void 0;
+exports.v53_migrations = [
+    {
+        version: 53,
+        name: 'add-worktree-aliases',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS worktree_aliases (
+          old_id TEXT PRIMARY KEY,
+          worktree_id TEXT NOT NULL REFERENCES worktrees(id) ON DELETE CASCADE,
+          created_at INTEGER NOT NULL
+        );
+      `);
+            // Aliases are read by old_id (the PK covers that) and swept by
+            // worktree_id whenever a worktree is renamed or deleted.
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_worktree_aliases_worktree_id
+          ON worktree_aliases(worktree_id);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP INDEX IF EXISTS idx_worktree_aliases_worktree_id;');
+            db.exec('DROP TABLE IF EXISTS worktree_aliases;');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v54-worktree-id-path-derived.js

@@ -0,0 +1,204 @@
+"use strict";
+/**
+ * Migration v54: renumber every existing worktree to its path-derived ID
+ * (Issue #1621 Phase 4, delivered by #1645).
+ *
+ * #1644 stopped the ID from moving on its own — `syncWorktreesToDB` now looks a
+ * row up by path and keeps whatever ID it already carries. What it deliberately
+ * did NOT do is touch the rows already in the database: those still hold
+ * `sanitize(repoName)-sanitize(branch)`, so every one of them is still a
+ * branch-derived ID that merely happens to be frozen. The failures #1621
+ * enumerates are only really gone once the stored IDs are the directory's.
+ *
+ * This migration is the one moment the whole table moves at once, which is what
+ * makes the two problems below real rather than theoretical.
+ *
+ * ## Why the renaming is staged through temporary IDs
+ *
+ * One worktree's NEW ID can be another worktree's CURRENT ID. The design's own
+ * example: the directory registered today as `mycodebranchdesk-main` (repo
+ * `MyCodeBranchDesk`, branch `main`) is at `.../commandmate-main`, so its new ID
+ * is `commandmate-main` — which is exactly the shape another row could already
+ * be using. Renaming pairwise would then hit
+ * `renameWorktreeIdPreservingChildren`'s collision branch, which *merges* the
+ * source into the destination and deletes the source row: silent data loss. A
+ * straight swap (A→B, B→A) has no safe ordering at all. Every rename therefore
+ * goes `old → cmate-mig54-<n> → new`, so no intermediate state can collide.
+ *
+ * ## Why an ID is never minted onto an ID somebody else is vacating
+ *
+ * A retired ID does not disappear, it becomes an alias, and live worktrees beat
+ * aliases at resolution time. So if worktree B were handed `x` — the ID worktree
+ * A is retiring — every bookmark of A's `x` would silently start landing on B.
+ * The taken set therefore holds **every current worktree ID** and **every
+ * pre-existing alias**, minus the row's own ID (which it is free to keep). A
+ * blocked candidate falls back to `basename-<sha256(path)[0..8]>`, exactly as a
+ * same-basename collision does.
+ *
+ * ## What follows the move, and what deliberately does not
+ *
+ * Child rows follow through `renameWorktreeIdPreservingChildren`, which
+ * enumerates by `worktree_id` column rather than by declared foreign key — the
+ * only reason `tasks` (#1548), `verification_runs` (#1544) and the aliases
+ * themselves come along. `skill_operations` does NOT: it is an append-only
+ * ledger whose `BEFORE UPDATE ... RAISE(ABORT)` trigger (#1234) would abort this
+ * migration outright. Its rows keep the ID that was in force when they were
+ * written, which is what an audit log is for, and the alias recorded here keeps
+ * them resolvable.
+ *
+ * tmux sessions and in-process state cannot be reached from a migration. They
+ * are reconciled at startup by `reconcileWorktreeSessionsFromAliases`, which
+ * reads the very alias rows this migration writes (`server.ts`).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v54_migrations = void 0;
+exports.planWorktreeIdRenumbering = planWorktreeIdRenumbering;
+const path_1 = __importDefault(require("path"));
+const worktree_id_1 = require("../../../lib/git/worktree-id");
+const worktree_id_rename_1 = require("./worktree-id-rename");
+/**
+ * Prefix for the intermediate IDs used by the two-stage renaming.
+ *
+ * Deliberately not a plausible directory basename, and the rows carrying it
+ * exist only between the two loops below — both inside the migration's
+ * transaction, so no reader ever observes one.
+ */
+const TEMP_ID_PREFIX = 'cmate-mig54-';
+/**
+ * Decide the new ID for every worktree row.
+ *
+ * Exported for the unit tests: the planning is the part with the interesting
+ * rules (collision, self-retention, alias shadowing), and it is a pure function
+ * of the rows plus the reserved set.
+ *
+ * @param rows - Every worktree row, `id` and `path`
+ * @param aliasIds - IDs already answerable as aliases
+ * @returns The renames to apply, in row order; rows keeping their ID are omitted
+ * @internal
+ */
+function planWorktreeIdRenumbering(rows, aliasIds) {
+    const currentIds = new Set(rows.map((row) => row.id));
+    const reserved = new Set([...currentIds, ...aliasIds]);
+    const assigned = new Set();
+    const plan = [];
+    for (const row of rows) {
+        const taken = new Set([...reserved, ...assigned]);
+        // A row is never blocked by its own ID: when the directory basename already
+        // equals it, the right answer is "keep it" and no rename is emitted.
+        taken.delete(row.id);
+        const newId = (0, worktree_id_1.deriveWorktreeId)(path_1.default.resolve(row.path), taken);
+        assigned.add(newId);
+        if (newId !== row.id)
+            plan.push({ oldId: row.id, newId });
+    }
+    return plan;
+}
+exports.v54_migrations = [
+    {
+        version: 54,
+        name: 'renumber-worktree-ids-from-path',
+        up: (db) => {
+            const rows = db
+                .prepare('SELECT id, path FROM worktrees ORDER BY id')
+                .all();
+            if (rows.length === 0) {
+                console.log('No worktrees to renumber');
+                return;
+            }
+            const aliasTableExists = db
+                .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'worktree_aliases'")
+                .get() !== undefined;
+            const aliasIds = aliasTableExists
+                ? db.prepare('SELECT old_id FROM worktree_aliases').all().map((row) => row.old_id)
+                : [];
+            const plan = planWorktreeIdRenumbering(rows, aliasIds);
+            if (plan.length === 0) {
+                console.log(`Worktree IDs already path-derived (${rows.length} row(s) checked)`);
+                return;
+            }
+            // Temporary IDs must not collide with anything real, including an ID this
+            // migration is about to hand out.
+            const inUse = new Set([
+                ...rows.map((row) => row.id),
+                ...aliasIds,
+                ...plan.map((entry) => entry.newId),
+            ]);
+            const tempIds = plan.map((_entry, index) => {
+                let candidate = `${TEMP_ID_PREFIX}${index}`;
+                for (let attempt = 1; inUse.has(candidate); attempt++) {
+                    candidate = `${TEMP_ID_PREFIX}${index}-${attempt}`;
+                }
+                inUse.add(candidate);
+                return candidate;
+            });
+            // A single timestamp for every alias this migration writes, so the rows
+            // read as one event. (`Date.now()` is called once rather than per row for
+            // the same reason.)
+            const now = Date.now();
+            // Stage 1: park every row on an ID nothing else can want.
+            plan.forEach((entry, index) => {
+                (0, worktree_id_rename_1.renameWorktreeIdPreservingChildren)(db, entry.oldId, tempIds[index], now);
+            });
+            // Stage 2: into the real IDs, now guaranteed free.
+            plan.forEach((entry, index) => {
+                (0, worktree_id_rename_1.renameWorktreeIdPreservingChildren)(db, tempIds[index], entry.newId, now);
+            });
+            // Stage 1 recorded `oldId → temp` and stage 2 re-pointed it to
+            // `oldId → newId` (aliases are a child table, so the sweep moved them).
+            // What stage 2 also wrote is `temp → newId`, which is a redirect for an ID
+            // that never left this transaction — drop it so it neither answers
+            // requests nor blocks a future ID.
+            const deleteAlias = aliasTableExists
+                ? db.prepare('DELETE FROM worktree_aliases WHERE old_id = ?')
+                : null;
+            if (deleteAlias) {
+                for (const tempId of tempIds)
+                    deleteAlias.run(tempId);
+            }
+            for (const entry of plan) {
+                console.log(`Renumbered worktree ${entry.oldId} -> ${entry.newId}`);
+            }
+            console.log(`Renumbered ${plan.length} of ${rows.length} worktree(s) to path-derived IDs`);
+        },
+        down: (db) => {
+            // The alias rows record where each ID came from, so the move is reversible
+            // as long as they are still there. Same two-stage staging, in reverse.
+            const aliasTableExists = db
+                .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'worktree_aliases'")
+                .get() !== undefined;
+            if (!aliasTableExists) {
+                console.log('No worktree_aliases table: nothing to roll back');
+                return;
+            }
+            const aliases = db
+                .prepare(`SELECT a.old_id, a.worktree_id
+             FROM worktree_aliases AS a
+             JOIN worktrees AS w ON w.id = a.worktree_id
+            ORDER BY a.old_id`)
+                .all();
+            if (aliases.length === 0) {
+                console.log('No worktree aliases to roll back');
+                return;
+            }
+            const now = Date.now();
+            const tempIds = aliases.map((_alias, index) => `${TEMP_ID_PREFIX}down-${index}`);
+            aliases.forEach((alias, index) => {
+                (0, worktree_id_rename_1.renameWorktreeIdPreservingChildren)(db, alias.worktree_id, tempIds[index], now);
+            });
+            aliases.forEach((alias, index) => {
+                (0, worktree_id_rename_1.renameWorktreeIdPreservingChildren)(db, tempIds[index], alias.old_id, now);
+            });
+            const deleteAlias = db.prepare('DELETE FROM worktree_aliases WHERE old_id = ?');
+            for (const tempId of tempIds)
+                deleteAlias.run(tempId);
+            // The forward IDs are now the historical ones; the rollback should not
+            // leave them redirecting back to the IDs it just undid.
+            for (const alias of aliases)
+                deleteAlias.run(alias.worktree_id);
+            console.log(`Rolled back ${aliases.length} worktree ID renumbering(s)`);
+        },
+    },
+];