commandmate 0.49.0 → 0.49.1

package/dist/server/src/lib/db/migrations/index.js

@@ -45,6 +45,7 @@ const v58_agent_session_costs_1 = require("./v58-agent-session-costs");
 const v59_opencode_instance_settings_1 = require("./v59-opencode-instance-settings");
 const v60_session_relays_1 = require("./v60-session-relays");
 const v61_session_notes_1 = require("./v61-session-notes");
+const v62_session_relays_bind_1 = require("./v62-session-relays-bind");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -93,4 +94,5 @@ exports.migrations = [
     ...v59_opencode_instance_settings_1.v59_migrations,
     ...v60_session_relays_1.v60_migrations,
     ...v61_session_notes_1.v61_migrations,
+    ...v62_session_relays_bind_1.v62_migrations,
 ];

package/dist/server/src/lib/db/migrations/pre-migration-backup.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Pre-migration backup (Issue #3985).
+ *
+ * An older build refuses a database whose schema is newer than it knows
+ * (runner.ts, Issue #1353), so rolling back the executable alone never
+ * recovers from a bad migration — the database from before the migration is
+ * needed too. This module takes that copy, right before the first pending
+ * migration runs.
+ *
+ * The copy is made with `VACUUM INTO`, not by copying files: the connection is
+ * in WAL mode, so committed updates may still live in `-wal` only, and copying
+ * the main file (or the main file and `-wal` separately) gives no single point
+ * in time. `VACUUM INTO` reads inside one read transaction and writes a
+ * self-contained rollback-journal database. `db.backup()` is async and cannot
+ * run inside the synchronous startup path.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKIP_MIGRATION_BACKUP_ENV = exports.MIGRATION_BACKUP_GENERATIONS = exports.MIGRATION_BACKUP_DIR_NAME = void 0;
+exports.isMigrationBackupSkipped = isMigrationBackupSkipped;
+exports.needsPreMigrationBackup = needsPreMigrationBackup;
+exports.listMigrationBackups = listMigrationBackups;
+exports.selectBackupsToPrune = selectBackupsToPrune;
+exports.readLastCompleteVersion = readLastCompleteVersion;
+exports.recordLastCompleteVersion = recordLastCompleteVersion;
+exports.createPreMigrationBackup = createPreMigrationBackup;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/** Directory (next to the database file) that holds the copies. */
+exports.MIGRATION_BACKUP_DIR_NAME = 'db-backups';
+/** Completed copies kept per database file. */
+exports.MIGRATION_BACKUP_GENERATIONS = 3;
+/** Set to `1` to start without the copy (e.g. not enough free disk space). */
+exports.SKIP_MIGRATION_BACKUP_ENV = 'CM_DB_SKIP_MIGRATION_BACKUP';
+const TEMP_SUFFIX = '.partial';
+/** `<db file name><suffix>` in the copy directory holds the last fully migrated version. */
+const LAST_COMPLETE_VERSION_SUFFIX = '.last-complete-version';
+/** True when the operator asked to start without the pre-migration copy. */
+function isMigrationBackupSkipped(env = process.env) {
+    return (env[exports.SKIP_MIGRATION_BACKUP_ENV] ?? '').trim() === '1';
+}
+/**
+ * Whether there is anything worth copying.
+ *
+ * An in-memory database has no file to restore into. A brand-new database
+ * (version 0 and no table besides `schema_version`, which the runner has just
+ * created) has nothing to lose, and is what every test database looks like.
+ */
+function needsPreMigrationBackup(db, currentVersion) {
+    // `typeof` covers adapters without a file name (scripts/spike's node:sqlite wrapper).
+    if (db.memory || typeof db.name !== 'string' || db.name === '' || db.name === ':memory:')
+        return false;
+    if (currentVersion > 0)
+        return true;
+    const row = db.prepare(`
+    SELECT COUNT(*) AS count FROM sqlite_master
+    WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name != 'schema_version'
+  `).get();
+    return row.count > 0;
+}
+function utcStamp(date) {
+    // 2026-10-29T01:02:03.456Z -> 20261029T010203456Z (sortable, filename-safe)
+    return date.toISOString().replace(/[-:]/g, '').replace('.', '');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Completed copies of `dbFileName` in `dir`, oldest first. */
+function listMigrationBackups(dir, dbFileName) {
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const pattern = new RegExp(`^${escapeRegExp(dbFileName)}\\.v\\d+-to-v\\d+\\.(\\d{8}T\\d{9}Z)\\.[0-9a-f]+\\.sqlite$`);
+    return entries
+        .map((name) => ({ name, stamp: pattern.exec(name)?.[1] }))
+        .filter((entry) => entry.stamp !== undefined)
+        .sort((a, b) => (a.stamp === b.stamp ? a.name.localeCompare(b.name) : a.stamp.localeCompare(b.stamp)))
+        .map((entry) => path_1.default.join(dir, entry.name));
+}
+function parseVersions(copyPath) {
+    const match = /\.v(\d+)-to-v(\d+)\.\d{8}T\d{9}Z\.[0-9a-f]+\.sqlite$/.exec(path_1.default.basename(copyPath));
+    return match ? { from: Number(match[1]), to: Number(match[2]) } : null;
+}
+/**
+ * Completed copies to delete, given all of them oldest first.
+ *
+ * Keeps the newest {@link MIGRATION_BACKUP_GENERATIONS}, except that the
+ * original restore point always survives: the newest copy whose source version
+ * is `lastCompleteVersion`, whatever its target. A migration that half-succeeds
+ * (v59 -> v60 applied, v61 fails) leaves the next attempt starting from v60,
+ * possibly from another build aiming at v62; retrying it three times must not
+ * push out the v59 copy, which is the only one the last working build can open.
+ * That copy then takes one of the slots, so the total stays at the limit.
+ *
+ * With no usable record (`null`: never recorded, or older than a restored
+ * database), the copy with the lowest source version (newest on a tie) is the
+ * restore point — an intermediate version left by a half-applied run is never
+ * taken for a completed one.
+ */
+function selectBackupsToPrune(completed, lastCompleteVersion) {
+    let original;
+    let originalFrom = Infinity;
+    for (const copy of completed) {
+        const from = parseVersions(copy)?.from;
+        if (from === undefined)
+            continue;
+        if (lastCompleteVersion === null ? from <= originalFrom : from === lastCompleteVersion) {
+            original = copy;
+            originalFrom = from;
+        }
+    }
+    const newest = completed.slice(-exports.MIGRATION_BACKUP_GENERATIONS);
+    const keep = original === undefined || newest.includes(original)
+        ? newest
+        : [original, ...completed.slice(-(exports.MIGRATION_BACKUP_GENERATIONS - 1))];
+    return completed.filter((copy) => !keep.includes(copy));
+}
+function backupDirFor(dbName) {
+    const dbPath = path_1.default.resolve(dbName);
+    return { dir: path_1.default.join(path_1.default.dirname(dbPath), exports.MIGRATION_BACKUP_DIR_NAME), dbFileName: path_1.default.basename(dbPath) };
+}
+function lastCompleteVersionPath(dir, dbFileName) {
+    return path_1.default.join(dir, `${dbFileName}${LAST_COMPLETE_VERSION_SUFFIX}`);
+}
+/** The schema version the last fully successful migration run ended at, or null when unrecorded. */
+function readLastCompleteVersion(dir, dbFileName) {
+    try {
+        const text = fs_1.default.readFileSync(lastCompleteVersionPath(dir, dbFileName), 'utf8').trim();
+        return /^\d+$/.test(text) ? Number(text) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeLastCompleteVersion(dir, dbFileName, version) {
+    const target = lastCompleteVersionPath(dir, dbFileName);
+    const temp = `${target}.${crypto_1.default.randomBytes(4).toString('hex')}${TEMP_SUFFIX}`;
+    try {
+        fs_1.default.writeFileSync(temp, `${version}\n`, { mode: 0o600, flag: 'wx' });
+        fs_1.default.chmodSync(temp, 0o600);
+        fs_1.default.renameSync(temp, target);
+    }
+    catch (error) {
+        try {
+            fs_1.default.rmSync(temp, { force: true });
+        }
+        catch {
+            // best effort
+        }
+        throw error;
+    }
+}
+/**
+ * Record that every migration up to `version` completed (Issue #3985).
+ *
+ * Only once a copy directory exists: a database that never needed a copy has no
+ * restore point to protect. A failure is logged and never stops startup; the
+ * next copy then protects the copy with the lowest source version instead.
+ */
+function recordLastCompleteVersion(db, version) {
+    if (db.memory || typeof db.name !== 'string' || db.name === '' || db.name === ':memory:')
+        return;
+    const { dir, dbFileName } = backupDirFor(db.name);
+    if (!fs_1.default.existsSync(dir))
+        return;
+    try {
+        writeLastCompleteVersion(dir, dbFileName, version);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        console.warn(`Could not record the last completed schema version in ${dir}: ${reason}`);
+    }
+}
+function verifyCopy(copyPath, expectedVersion) {
+    const copy = new better_sqlite3_1.default(copyPath, { readonly: true, fileMustExist: true });
+    try {
+        const integrity = copy.pragma('integrity_check', { simple: true });
+        if (integrity !== 'ok') {
+            throw new Error(`integrity_check returned ${String(integrity)}`);
+        }
+        let version = 0;
+        try {
+            const row = copy.prepare('SELECT MAX(version) AS version FROM schema_version').get();
+            version = row?.version ?? 0;
+        }
+        catch {
+            version = 0;
+        }
+        if (version !== expectedVersion) {
+            // Another process migrated between our version read and the copy (#1360).
+            throw new Error(`copy is at schema v${version}, expected v${expectedVersion}`);
+        }
+    }
+    finally {
+        copy.close();
+    }
+}
+/**
+ * Take and verify the pre-migration copy, then prune old generations.
+ *
+ * @throws Error when the copy cannot be made or verified. The caller must not
+ *   start migrating then; the message names the directory, the reason and the
+ *   `CM_DB_SKIP_MIGRATION_BACKUP=1` escape hatch.
+ */
+function createPreMigrationBackup(db, fromVersion, toVersion, now = new Date()) {
+    const { dir, dbFileName } = backupDirFor(db.name);
+    const id = crypto_1.default.randomBytes(4).toString('hex');
+    const finalPath = path_1.default.join(dir, `${dbFileName}.v${fromVersion}-to-v${toVersion}.${utcStamp(now)}.${id}.sqlite`);
+    const tempPath = `${finalPath}${TEMP_SUFFIX}`;
+    try {
+        if (!fs_1.default.existsSync(dir)) {
+            fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+            fs_1.default.chmodSync(dir, 0o700);
+        }
+        // VACUUM INTO accepts an empty existing file; creating it first fixes the mode.
+        fs_1.default.closeSync(fs_1.default.openSync(tempPath, 'wx', 0o600));
+        db.prepare('VACUUM INTO ?').run(tempPath);
+        fs_1.default.chmodSync(tempPath, 0o600);
+        verifyCopy(tempPath, fromVersion);
+        fs_1.default.renameSync(tempPath, finalPath);
+    }
+    catch (error) {
+        try {
+            fs_1.default.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // best effort: a leftover *.partial is never counted as a completed copy
+        }
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not back up the database before migrating it (v${fromVersion} -> v${toVersion}). ` +
+            `No migration was run. Backup directory: ${dir}. Reason: ${reason}. ` +
+            `To start without the backup (e.g. when disk space is short), set ${exports.SKIP_MIGRATION_BACKUP_ENV}=1.`);
+    }
+    // Prune only after the new copy is verified and in place.
+    const removed = [];
+    // Unrecorded (first copy, or a directory from an older build) stays unrecorded:
+    // the record is written only when every migration succeeds. A record newer
+    // than the database means an older copy was restored by hand; it is ignored
+    // (not deleted) until the next completed run overwrites it.
+    let lastCompleteVersion = readLastCompleteVersion(dir, dbFileName);
+    if (lastCompleteVersion !== null && lastCompleteVersion > fromVersion) {
+        console.warn(`Ignoring the recorded last completed schema version v${lastCompleteVersion}: ` +
+            `the database is at v${fromVersion} (restored from an older copy?)`);
+        lastCompleteVersion = null;
+    }
+    const completed = listMigrationBackups(dir, dbFileName);
+    for (const old of selectBackupsToPrune(completed, lastCompleteVersion)) {
+        try {
+            fs_1.default.rmSync(old, { force: true });
+            removed.push(old);
+        }
+        catch {
+            // a copy we could not delete is extra disk use, not a reason to stop startup
+        }
+    }
+    return { path: finalPath, removed };
+}

package/dist/server/src/lib/db/migrations/runner.js

@@ -13,11 +13,12 @@ exports.getMigrationHistory = getMigrationHistory;
 exports.validateSchema = validateSchema;
 exports.findRepositoryRoot = findRepositoryRoot;
 const path_1 = __importDefault(require("path"));
+const pre_migration_backup_1 = require("./pre-migration-backup");
 /**
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 61;
+exports.CURRENT_SCHEMA_VERSION = 62;
 /**
  * Get current schema version from database
  */
@@ -73,12 +74,34 @@ function runMigrations(db, migrations) {
         return;
     }
     console.log(`Found ${pendingMigrations.length} pending migration(s)`);
+    // Issue #3985: a restore point before the first migration. An older build
+    // refuses the migrated schema (#1353 above), so rolling back the executable
+    // needs this copy. Failing to take it stops startup before any migration.
+    const targetVersion = pendingMigrations[pendingMigrations.length - 1].version;
+    if ((0, pre_migration_backup_1.needsPreMigrationBackup)(db, currentVersion)) {
+        if ((0, pre_migration_backup_1.isMigrationBackupSkipped)()) {
+            console.warn(`${pre_migration_backup_1.SKIP_MIGRATION_BACKUP_ENV}=1: migrating without a pre-migration backup`);
+        }
+        else {
+            const backup = (0, pre_migration_backup_1.createPreMigrationBackup)(db, currentVersion, targetVersion);
+            console.log(`Pre-migration backup: ${backup.path}`);
+        }
+    }
     // Run each pending migration in a transaction
+    let isFirstMigration = true;
     for (const migration of pendingMigrations) {
         console.log(`Applying migration ${migration.version}: ${migration.name}...`);
         try {
             // Run migration in transaction
-            db.transaction(() => {
+            const apply = db.transaction(() => {
+                // Issue #3985: VACUUM INTO cannot run inside a transaction, so the copy
+                // and the first migration cannot share one lock. Take the write lock
+                // (IMMEDIATE) for the first migration and confirm nobody migrated
+                // since the version read the copy was checked against (#1360).
+                if (isFirstMigration && getCurrentVersion(db) !== currentVersion) {
+                    throw new Error(`schema version changed from v${currentVersion} to v${getCurrentVersion(db)} ` +
+                        `while starting migrations (another process migrated this database)`);
+                }
                 // Execute migration
                 migration.up(db);
                 // Record migration in schema_version table
@@ -86,7 +109,14 @@ function runMigrations(db, migrations) {
           INSERT INTO schema_version (version, name, applied_at)
           VALUES (?, ?, ?)
         `).run(migration.version, migration.name, Date.now());
-            })();
+            });
+            if (isFirstMigration) {
+                apply.immediate();
+            }
+            else {
+                apply();
+            }
+            isFirstMigration = false;
             console.log(`Migration ${migration.version} applied successfully`);
         }
         catch (error) {
@@ -95,7 +125,10 @@ function runMigrations(db, migrations) {
             throw new Error(`Migration ${migration.version} (${migration.name}) failed: ${errorMessage}`);
         }
     }
-    console.log(`All migrations completed. Current version: ${getCurrentVersion(db)}`);
+    const completedVersion = getCurrentVersion(db);
+    // Issue #3985: the next upgrade's original restore point is a copy taken from here.
+    (0, pre_migration_backup_1.recordLastCompleteVersion)(db, completedVersion);
+    console.log(`All migrations completed. Current version: ${completedVersion}`);
 }
 /**
  * Rollback migrations to a specific version

package/dist/server/src/lib/db/migrations/v62-session-relays-bind.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Migration v62: tie a relay to the send that asked for it (Issue #3957).
+ *
+ * Until now a relay row knew when it was OPENED (`created_at`, before the CLI
+ * sent anything) and nothing about the send itself. The delivery therefore took
+ * the newest reply written after `created_at` — which, when the send queued for
+ * the input lock or failed, was somebody else's reply (S3 / S5 of the Issue).
+ *
+ * The columns below record the send: which attempt reserved the relay, when
+ * its body started going in, whether a turn was already open then, and how the
+ * send ended. `bind_mode` says whether a row takes part at all — every row that
+ * existed before this migration, and every row an older CLI opens, is `legacy`
+ * and is delivered exactly as before.
+ *
+ * ## Columns
+ *
+ * - `bind_mode` — `legacy` | `bound`. NOT NULL with a default, so existing rows
+ *   read as legacy without a backfill.
+ * - `send_state` — `awaiting` → `input_started` → `sent`, or `failed` /
+ *   `unknown`. NULL for legacy (never "sent" by pretence).
+ * - `bind_attempt_id` / `bind_owner` — the reservation and the server boot that
+ *   holds it, so a reservation orphaned by a restart can be told apart.
+ * - `input_boundary_at` / `boundary_kind` — the delivery's lower bound (ms) and
+ *   where it was taken: `input_start` (right before the first key) or
+ *   `dispatch` (right before an HTTP send that reports no input start).
+ * - `turn_open_at_send` — 1 / 0 / NULL (not known).
+ * - `obs_state` / `obs_source` — whether the observation can still be trusted
+ *   (`valid`, `invalid`, `turn_unknown`) and where it was made (boot id and
+ *   session generation).
+ * - `input_message_id` — the send's own user row, so it is not counted as
+ *   somebody else's input.
+ * - `hold_reason` — why the relay is held, published as is.
+ * - `held_candidates` — JSON list of completions seen before the send settled.
+ * - `overlap` — `none` | `later` | `earlier` | `both` | `unknown`.
+ * - `pending_reply` — JSON: a reply finished while a prompt notice was being
+ *   delivered (the second slot).
+ * - `payload_id` — the id of the payload now in `pending_*`, so a stale
+ *   delivery cannot clear a newer one.
+ *
+ * The rollback drops exactly these columns. None is indexed, part of a foreign
+ * key or named in another column's CHECK, so `DROP COLUMN` (SQLite 3.35+) keeps
+ * the rows, the pending payloads, the indexes and the foreign keys as they were.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v62_migrations = exports.V62_SESSION_RELAY_COLUMNS = void 0;
+/** The v62 columns, in the order the rollback drops them. */
+exports.V62_SESSION_RELAY_COLUMNS = [
+    'bind_mode',
+    'send_state',
+    'bind_attempt_id',
+    'bind_owner',
+    'input_boundary_at',
+    'boundary_kind',
+    'turn_open_at_send',
+    'obs_state',
+    'obs_source',
+    'input_message_id',
+    'hold_reason',
+    'held_candidates',
+    'overlap',
+    'pending_reply',
+    'payload_id',
+];
+exports.v62_migrations = [
+    {
+        version: 62,
+        name: 'session-relays-bind',
+        up: (db) => {
+            const statements = [
+                `ALTER TABLE session_relays ADD COLUMN bind_mode TEXT NOT NULL DEFAULT 'legacy'
+           CHECK (bind_mode IN ('legacy','bound'))`,
+                `ALTER TABLE session_relays ADD COLUMN send_state TEXT
+           CHECK (send_state IN ('awaiting','input_started','sent','failed','unknown'))`,
+                'ALTER TABLE session_relays ADD COLUMN bind_attempt_id TEXT',
+                'ALTER TABLE session_relays ADD COLUMN bind_owner TEXT',
+                'ALTER TABLE session_relays ADD COLUMN input_boundary_at INTEGER',
+                `ALTER TABLE session_relays ADD COLUMN boundary_kind TEXT
+           CHECK (boundary_kind IN ('input_start','dispatch'))`,
+                `ALTER TABLE session_relays ADD COLUMN turn_open_at_send INTEGER
+           CHECK (turn_open_at_send IN (0,1))`,
+                `ALTER TABLE session_relays ADD COLUMN obs_state TEXT
+           CHECK (obs_state IN ('valid','invalid','turn_unknown'))`,
+                'ALTER TABLE session_relays ADD COLUMN obs_source TEXT',
+                'ALTER TABLE session_relays ADD COLUMN input_message_id TEXT',
+                'ALTER TABLE session_relays ADD COLUMN hold_reason TEXT',
+                'ALTER TABLE session_relays ADD COLUMN held_candidates TEXT',
+                `ALTER TABLE session_relays ADD COLUMN overlap TEXT
+           CHECK (overlap IN ('none','later','earlier','both','unknown'))`,
+                'ALTER TABLE session_relays ADD COLUMN pending_reply TEXT',
+                'ALTER TABLE session_relays ADD COLUMN payload_id TEXT',
+            ];
+            for (const statement of statements)
+                db.exec(statement);
+        },
+        down: (db) => {
+            for (const column of [...exports.V62_SESSION_RELAY_COLUMNS].reverse()) {
+                db.exec(`ALTER TABLE session_relays DROP COLUMN ${column}`);
+            }
+        },
+    },
+];