commandmate 0.49.1 → 0.49.3

package/dist/server/src/lib/cli-tools/vibe-local.js

@@ -14,6 +14,9 @@ const base_1 = require("./base");
 const types_1 = require("./types");
 const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
+const readiness_1 = require("../detection/tools/vibe-local/readiness");
+const status_detector_1 = require("../detection/status-detector");
+const prompt_wait_dialog_1 = require("./prompt-wait-dialog");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const db_instance_1 = require("../db/db-instance");
 const db_1 = require("../db");
@@ -28,6 +31,31 @@ const logger = (0, logger_1.createLogger)('cli-tools/vibe-local');
  * vibe-local shows a permission check prompt, banner, and model loading.
  */
 const VIBE_LOCAL_INIT_WAIT_MS = 5000;
+/**
+ * How long a send waits for vibe-local's input prompt (Issue #4040).
+ *
+ * Measured on vibe-local 1.3.3 (`vibe-local -y`, isolated `HOME`, private tmux
+ * socket, model `qwen3-coder:30b` not loaded in Ollama before each run): the
+ * empty `ctx:N% ❯` row was up 1.15 s, 0.62 s and 0.60 s after the launch
+ * keystroke — vibe-local loads the model on the first message, not at launch.
+ * gemini's and codex's 15 s therefore covers it with room to spare.
+ */
+const VIBE_LOCAL_PROMPT_WAIT_TIMEOUT_MS = 15000;
+/** Interval between the send's readiness polls (Issue #4040). */
+const VIBE_LOCAL_PROMPT_POLL_INTERVAL_MS = 500;
+/** Scrollback rows plus the visible pane in a readiness capture (`-S -200 -E -`). */
+const VIBE_LOCAL_PROMPT_CAPTURE_LINES = 200;
+/**
+ * Whether {@link VibeLocalTool}'s prompt wait counts this frame towards giving
+ * up on a dialog (Issue #4084): the detector reports an active prompt — what
+ * the re-check under the input lock refuses — and no turn is being generated.
+ * Unlike copilot's wait, there is no folder-trust dialog here to leave out:
+ * this wait answers none.
+ */
+function isVibeLocalWaitDialog(output) {
+    const status = (0, status_detector_1.detectSessionStatus)(output, 'vibe-local');
+    return status.hasActivePrompt && !(0, status_detector_1.isGeneratingStatus)(status);
+}
 /**
  * Vibe Local CLI tool implementation
  * Manages vibe-local interactive sessions using tmux
@@ -92,7 +120,8 @@ class VibeLocalTool extends base_1.BaseCLITool {
             }
             // Start vibe-local in interactive mode with auto-approve (-y)
             // -y flag skips the permission confirmation prompt
-            await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(vibeLocalCommand), true);
+            // Issue #3981: in one writer's turn of the input lock.
+            await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(vibeLocalCommand)]);
             // Wait for vibe-local to initialize (banner + model loading)
             await new Promise((resolve) => setTimeout(resolve, VIBE_LOCAL_INIT_WAIT_MS));
             logger.info('started-vibe-local-session');
@@ -117,6 +146,10 @@ class VibeLocalTool extends base_1.BaseCLITool {
         // same pane when the tool is gone; costs one `capture-pane` when it is not.
         await this.requireSession('Vibe Local', worktreeId, instanceId, { relaunch: true });
         try {
+            // Issue #4040: nothing is typed (the two Enters included) until the
+            // newest prompt row is up and empty — a relaunch or a fresh launch is
+            // still drawing its banner when the first send arrives.
+            await this.waitForPrompt(sessionName);
             // Issue #1471: Body/Enter separation + read-back submit verification via the
             // shared helper. vibe-local's IME mode needs TWO Enter presses (first Enter
             // inserts a newline, the second submits), preserved via submitEnterCount: 2
@@ -130,6 +163,8 @@ class VibeLocalTool extends base_1.BaseCLITool {
                 // the one call site that knew about it.
                 composer: this.describeComposer(),
                 interEnterWaitMs: cli_tool_timing_config_1.VIBE_LOCAL_DOUBLE_ENTER_WAIT_MS,
+                // Issue #4040: the same test, of the newest frame read under the input lock.
+                readiness: { label: 'Vibe Local', isReady: readiness_1.isVibeLocalComposerReady },
             });
             // Issue #405: Invalidate cache after sending message
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
@@ -137,8 +172,62 @@ class VibeLocalTool extends base_1.BaseCLITool {
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to send message to Vibe Local: ${errorMessage}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            throw new Error(`Failed to send message to Vibe Local: ${errorMessage}`, { cause: error });
+        }
+    }
+    /**
+     * Wait for vibe-local's input prompt before a send (Issue #4040).
+     *
+     * {@link isVibeLocalComposerReady} is the test — the newest `ctx:N% ❯` row
+     * empty with only the footer below it (or a turn being generated under it),
+     * never "the row is somewhere on the pane": the scrollback keeps every old
+     * one.
+     *
+     * Issue #4084: a dialog (`hasActivePrompt`, not while a turn is being
+     * generated) ends the wait only once it is confirmed — seen on 2 reads in a
+     * row spanning `PROMPT_WAIT_DIALOG_CONFIRM_MS` (2 s), the count copilot's
+     * wait uses (#4067) — and is then refused as `prompt-waiting` at once, on the
+     * wait's own reads. A dialog read once (a frame mid-paint) and then gone does
+     * not refuse the send; it used to end the wait on that one read. A dialog
+     * that opens after the wait is still refused by the shared sender's re-read
+     * under the input lock, on one read. No capture is waited for past the
+     * window: one still running at the deadline is not used.
+     *
+     * @throws Error (`Vibe Local prompt not ready`) when the prompt did not come
+     *   up within {@link VIBE_LOCAL_PROMPT_WAIT_TIMEOUT_MS}; nothing was typed
+     * @throws Error coded `prompt-waiting` ({@link confirmedDialogRefusal}) for a
+     *   confirmed dialog; nothing was typed
+     */
+    async waitForPrompt(sessionName) {
+        const deadline = Date.now() + VIBE_LOCAL_PROMPT_WAIT_TIMEOUT_MS;
+        const dialog = (0, prompt_wait_dialog_1.createDialogConfirmation)();
+        while (Date.now() < deadline) {
+            let confirmed = false;
+            try {
+                const output = await (0, prompt_wait_dialog_1.readBeforeDeadline)(() => (0, tmux_1.capturePane)(sessionName, VIBE_LOCAL_PROMPT_CAPTURE_LINES), deadline);
+                if (output === null)
+                    break;
+                if ((0, readiness_1.isVibeLocalComposerReady)(output))
+                    return;
+                confirmed = dialog.observe(isVibeLocalWaitDialog(output));
+            }
+            catch (error) {
+                // Capture may fail - continue polling. Not a dialog read: the run restarts.
+                dialog.reset();
+                logger.debug('vibe-local-prompt-capture-failed', { sessionName, error: (0, errors_1.getErrorMessage)(error) });
+            }
+            if (confirmed) {
+                logger.warn('vibe-local-prompt-wait-dialog', { sessionName, reads: dialog.reads });
+                throw (0, prompt_wait_dialog_1.confirmedDialogRefusal)(sessionName, 'Vibe Local');
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                break;
+            await new Promise((resolve) => setTimeout(resolve, Math.min(VIBE_LOCAL_PROMPT_POLL_INTERVAL_MS, remaining)));
         }
+        logger.info('vibe-local-prompt-not-detected');
+        throw new Error('Vibe Local prompt not ready: timed out waiting for the input prompt before sending');
     }
     /**
      * Kill vibe-local session

package/dist/server/src/lib/db/chat-db.js

@@ -30,6 +30,7 @@ exports.updatePromptData = updatePromptData;
 exports.markPendingPromptsAsAnswered = markPendingPromptsAsAnswered;
 exports.recordAnsweredPrompt = recordAnsweredPrompt;
 exports.createModelChangeMessage = createModelChangeMessage;
+exports.relaySystemRequestId = relaySystemRequestId;
 exports.relayRequestId = relayRequestId;
 exports.parseRelayRequestId = parseRelayRequestId;
 exports.getLastUserMessageForInstance = getLastUserMessageForInstance;
@@ -800,6 +801,18 @@ function createModelChangeMessage(db, params) {
 exports.RELAY_REQUEST_ID_PREFIX = 'relay:';
 /** The `request_id` prefix a relay SYSTEM row carries (`relay-sys:<relayId>:<kind>`). */
 exports.RELAY_SYSTEM_REQUEST_ID_PREFIX = 'relay-sys:';
+/**
+ * The request id of a relay SYSTEM row (Issue #4082): `relay-sys:<relayId>:<kind>`,
+ * or `relay-sys:<relayId>:<kind>:<scope>` for a line written once per payload
+ * attempt (`held`: `<payloadId>:<attemptId>`). The probe that keeps a line from
+ * being written twice and the write itself both build it here, so the two
+ * cannot key the same line differently. The `relay-sys:` prefix is what the
+ * reply readers step over.
+ */
+function relaySystemRequestId(relayId, kind, scope = null) {
+    const base = `${exports.RELAY_SYSTEM_REQUEST_ID_PREFIX}${relayId}:${kind}`;
+    return scope === null ? base : `${base}:${scope}`;
+}
 /** Build the relay message's request id from the ledger id. */
 function relayRequestId(relayId) {
     return `${exports.RELAY_REQUEST_ID_PREFIX}${relayId}`;
@@ -889,7 +902,7 @@ function createRelaySystemMessage(db, params) {
         content: params.content,
         messageType: 'normal',
         timestamp: new Date(params.at),
-        requestId: `${exports.RELAY_SYSTEM_REQUEST_ID_PREFIX}${params.relayId}:${params.kind}`,
+        requestId: relaySystemRequestId(params.relayId, params.kind, params.scope ?? null),
         cliToolId: params.cliToolId,
         instanceId: params.instanceId ?? params.cliToolId,
     });

package/dist/server/src/lib/db/db-instance.js

@@ -10,6 +10,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_DB_ROOT_ENV = void 0;
+exports.isInsideVitestWorker = isInsideVitestWorker;
+exports.assertTestDatabasePathIsolated = assertTestDatabasePathIsolated;
 exports.getDbInstance = getDbInstance;
 exports.closeDbInstance = closeDbInstance;
 const path_1 = __importDefault(require("path"));
@@ -17,7 +20,112 @@ const db_migrations_1 = require("./db-migrations");
 const abi_recovery_1 = require("./abi-recovery");
 const agent_session_cost_sampler_1 = require("./agent-session-cost-sampler");
 const env_1 = require("../../lib/env");
+const system_directories_1 = require("../../config/system-directories");
 let dbInstance = null;
+/**
+ * `fs` / `os` are required lazily, as getDbInstance() always did for `fs`: a
+ * test that mocks either module must not change how the real database is
+ * opened or which directory counts as temp.
+ */
+function nodeFs() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('fs');
+}
+function nodeTmpdir() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('os').tmpdir();
+}
+/**
+ * Issue #4086: is this code running inside a Vitest worker?
+ *
+ * Read off the worker state Vitest itself installs on `globalThis` (its
+ * `getWorkerState()` reads the same `__vitest_worker__` global, in the forks
+ * and threads pools alike), not off environment variables: the environment is
+ * both inherited and editable. A test may swap `NODE_ENV` to `production`
+ * mid-run (tests/unit/pwa/ServiceWorkerRegistrar.test.tsx does) and must stay
+ * guarded, while a child process started outside Vitest inherits `VITEST` and
+ * must not be taken for a test run.
+ */
+function isInsideVitestWorker() {
+    const state = globalThis.__vitest_worker__;
+    return typeof state === 'object' && state !== null;
+}
+/**
+ * Issue #4086: is this a test run (the guard's on-switch)?
+ *
+ * Inside a Vitest worker: always, whatever `NODE_ENV` says right now.
+ * Outside one: only with `NODE_ENV=test` (a test's own child process, which
+ * also inherits the per-process CM_DB_PATH). `VITEST` alone never counts —
+ * the daemon spreads `process.env` into the server it starts
+ * (src/cli/utils/daemon.ts buildChildEnv), so a `NODE_ENV=production` server
+ * started from a shell where `VITEST` was left behind opens its real database.
+ */
+function isUnderTest(env, inVitestWorker) {
+    if (inVitestWorker)
+        return true;
+    return (env.NODE_ENV ?? '').trim() === 'test';
+}
+/** realpath of the nearest existing ancestor, with the missing tail re-joined. */
+function physicalPath(target) {
+    const fs = nodeFs();
+    let existing = path_1.default.resolve(target);
+    const tail = [];
+    while (!fs.existsSync(existing)) {
+        const parent = path_1.default.dirname(existing);
+        if (parent === existing)
+            break;
+        tail.unshift(path_1.default.basename(existing));
+        existing = parent;
+    }
+    try {
+        return path_1.default.join(fs.realpathSync(existing), ...tail);
+    }
+    catch {
+        return path_1.default.resolve(target);
+    }
+}
+/** Set by tests/setup.ts: the gitignored directory that holds per-process test databases. */
+exports.TEST_DB_ROOT_ENV = 'CM_TEST_DB_ROOT';
+/**
+ * Issue #4086: under Vitest, refuse any database the test run does not own.
+ *
+ * A worker's shell inherits the server's `CM_DB_PATH=<production db>`, and a
+ * test that reached this function opened that file, switched it to WAL and ran
+ * the checkout's migrations on it (production went to v63 under a v62 server).
+ * tests/setup.ts repoints the variables per process; this is the backstop for
+ * a path that still escapes (a test that deletes `CM_DB_PATH` and falls to the
+ * install default, a child process that inherited a real path).
+ *
+ * Owned = inside the OS temp directory (tests that mock `getEnv` and create
+ * their own `mkdtemp` database) or inside `$CM_TEST_DB_ROOT` (the per-process
+ * databases tests/setup.ts hands out — not under the temp dir, because
+ * `validateDbPath` rejects /tmp and /var, where every OS temp dir lives). Not
+ * only the one setup path, so tests that name their own database keep working.
+ * Active inside a Vitest worker (even while a test has swapped `NODE_ENV`) and
+ * in a process with `NODE_ENV=test`; a no-op otherwise, so a real server is
+ * never affected — including one that inherited `VITEST` but runs with
+ * `NODE_ENV=production`.
+ *
+ * @param inVitestWorker - defaults to {@link isInsideVitestWorker}; a test
+ *   passes `false` to ask how a process outside Vitest would be judged
+ * @throws Error when under test and `dbPath` is in neither directory
+ */
+function assertTestDatabasePathIsolated(dbPath, env = process.env, tmpRoot = nodeTmpdir(), inVitestWorker = isInsideVitestWorker()) {
+    if (!isUnderTest(env, inVitestWorker))
+        return;
+    const resolved = path_1.default.resolve(dbPath);
+    const roots = [tmpRoot, env[exports.TEST_DB_ROOT_ENV]]
+        .filter((root) => typeof root === 'string' && root.trim() !== '');
+    // Compared physically: macOS's /var -> /private/var (the temp dir lives
+    // there) must not reject a temp path, and a symlink under an owned directory
+    // must not let a real database through.
+    const physical = physicalPath(resolved);
+    if (!roots.some((root) => (0, system_directories_1.isPathWithin)(physical, physicalPath(root)))) {
+        throw new Error(`[Issue #4086] Refusing to open database ${resolved} under test: it is outside the temp directory `
+            + `and outside ${exports.TEST_DB_ROOT_ENV} (${roots.join(', ')}). tests/setup.ts points CM_DB_PATH at a `
+            + 'per-process test database; a test that names its own database must create it under os.tmpdir().');
+    }
+}
 /**
  * Get or create the database instance
  *
@@ -37,9 +145,10 @@ function getDbInstance() {
         // Issue #135: Use getEnv() for consistent DB path resolution
         const env = (0, env_1.getEnv)();
         const dbPath = env.CM_DB_PATH;
+        // Issue #4086: before anything touches the path (mkdir, open, WAL, migrations).
+        assertTestDatabasePathIsolated(dbPath);
         // Ensure the database directory exists
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const fs = require('fs');
+        const fs = nodeFs();
         const dir = path_1.default.dirname(dbPath);
         if (!fs.existsSync(dir)) {
             // SEC-003: Set directory permissions to 0o700 (owner only)
@@ -70,6 +179,9 @@ function getDbInstance() {
             throw error;
         }
         dbInstance = db;
+        if (isUnderTest(process.env, isInsideVitestWorker())) {
+            (globalThis.__commandmateTestDbClosers ??= new Set()).add(closeDbInstance);
+        }
         // Issue #2044: the agent cost ledger needs somebody to copy the in-memory
         // telemetry in before the pane that holds it is killed. This is the one
         // place that runs once per process, after the schema is verified, in every

package/dist/server/src/lib/db/db-migration-path.js

@@ -15,6 +15,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveAndValidatePath = resolveAndValidatePath;
 exports.getLegacyDbPaths = getLegacyDbPaths;
 exports.migrateDbIfNeeded = migrateDbIfNeeded;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = require("os");
@@ -83,6 +85,61 @@ function getLegacyDbPaths() {
     }
     return paths;
 }
+/**
+ * Whether committed updates of `dbPath` may still live only in its `-wal` file.
+ *
+ * An empty or absent `-wal` means the main file is the whole database.
+ */
+function hasPendingWal(dbPath) {
+    try {
+        return fs_1.default.statSync(`${dbPath}-wal`).size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Write a self-contained copy of the database at `sourcePath` to `destPath`
+ * (Issue #3993).
+ *
+ * Same tool as the pre-migration backup (`migrations/pre-migration-backup.ts`,
+ * Issue #3985): `VACUUM INTO` reads inside one read transaction, so updates
+ * still in `-wal` are included, and the result is a rollback-journal file that
+ * needs no sidecar. Copying the main file alone dropped them. The source is
+ * opened read-only; the copy is written to a temporary name and renamed into
+ * place, because `VACUUM INTO` refuses a non-empty destination.
+ */
+function snapshotDatabase(sourcePath, destPath) {
+    const tempPath = `${destPath}.${crypto_1.default.randomBytes(4).toString('hex')}.partial`;
+    try {
+        // VACUUM INTO accepts an empty existing file; creating it first fixes the mode.
+        fs_1.default.closeSync(fs_1.default.openSync(tempPath, 'wx', 0o600));
+        const source = new better_sqlite3_1.default(sourcePath, { readonly: true, fileMustExist: true });
+        try {
+            source.prepare('VACUUM INTO ?').run(tempPath);
+        }
+        finally {
+            source.close();
+        }
+        fs_1.default.renameSync(tempPath, destPath);
+    }
+    catch (error) {
+        fs_1.default.rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
+/**
+ * Copy a legacy database: a consistent snapshot when it has a non-empty `-wal`,
+ * the file itself otherwise (unchanged from before Issue #3993).
+ */
+function copyLegacyDatabase(sourcePath, destPath) {
+    if (hasPendingWal(sourcePath)) {
+        snapshotDatabase(sourcePath, destPath);
+    }
+    else {
+        fs_1.default.copyFileSync(sourcePath, destPath);
+    }
+}
 /**
  * Migrate database to new path if legacy DB exists
  *
@@ -92,6 +149,10 @@ function getLegacyDbPaths() {
  * 3. Creates a backup of the legacy database
  * 4. Copies the database to the new location
  *
+ * A legacy database with a non-empty `-wal` is copied as a `VACUUM INTO`
+ * snapshot (both the backup and the new location), so updates not yet written
+ * back to the main file are kept (Issue #3993).
+ *
  * Security features:
  * - SEC-002: Symlink resolution via realpathSync
  * - SEC-003: Directory creation with mode 0o700
@@ -125,7 +186,7 @@ function migrateDbIfNeeded(targetPath) {
         }
         // Create backup (SEC-006)
         const backupPath = `${resolvedLegacyPath}.bak`;
-        fs_1.default.copyFileSync(resolvedLegacyPath, backupPath);
+        copyLegacyDatabase(resolvedLegacyPath, backupPath);
         fs_1.default.chmodSync(backupPath, 0o600);
         // Create target directory if needed (SEC-003)
         const targetDir = path_1.default.dirname(resolvedTargetPath);
@@ -133,7 +194,7 @@ function migrateDbIfNeeded(targetPath) {
             fs_1.default.mkdirSync(targetDir, { recursive: true, mode: 0o700 });
         }
         // Copy database to new location
-        fs_1.default.copyFileSync(resolvedLegacyPath, resolvedTargetPath);
+        copyLegacyDatabase(resolvedLegacyPath, resolvedTargetPath);
         logger.info(`[Migration] Database migrated from ${resolvedLegacyPath} to ${resolvedTargetPath}`);
         logger.info(`[Migration] Backup created at ${backupPath}`);
         return {

package/dist/server/src/lib/db/migrations/index.js

@@ -46,6 +46,7 @@ const v59_opencode_instance_settings_1 = require("./v59-opencode-instance-settin
 const v60_session_relays_1 = require("./v60-session-relays");
 const v61_session_notes_1 = require("./v61-session-notes");
 const v62_session_relays_bind_1 = require("./v62-session-relays-bind");
+const v63_session_relays_delivery_attempt_1 = require("./v63-session-relays-delivery-attempt");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -95,4 +96,5 @@ exports.migrations = [
     ...v60_session_relays_1.v60_migrations,
     ...v61_session_notes_1.v61_migrations,
     ...v62_session_relays_bind_1.v62_migrations,
+    ...v63_session_relays_delivery_attempt_1.v63_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -18,7 +18,7 @@ const pre_migration_backup_1 = require("./pre-migration-backup");
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 62;
+exports.CURRENT_SCHEMA_VERSION = 63;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v63-session-relays-delivery-attempt.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Migration v63: record the relay delivery's own attempt (Issue #4064).
+ *
+ * Until now a payload in `pending_*` had one state — queued — and the only lock
+ * on its delivery was the in-process claim. A send whose outcome could not be
+ * told (`indeterminate`, a throw after `sent`, a throw before any state) was
+ * released like an unsent one and typed again by the next pump, and a server
+ * that died mid-send forgot the attempt altogether.
+ *
+ * The columns below say, per payload, whether a delivery has started and how
+ * it ended when that end is not known:
+ *
+ * - `delivery_state` — NULL (queued; every row that existed before this
+ *   migration, `payload_id` NULL included) | `attempting` (written before the
+ *   first key; only the writer of it sends) | `uncertain` (the attempt's outcome
+ *   is not known; never sent again automatically).
+ * - `delivery_attempt_id` — the attempt that took the payload; the result is
+ *   written only under it.
+ * - `delivery_owner` — the server boot that took it, so a restart can tell its
+ *   own live attempts from the previous boot's interrupted ones.
+ * - `delivery_reason` — why it is held (`SendAttemptReason`, `send-threw`,
+ *   `threw-after-sent`, `server-restarted`), published as is.
+ * - `delivery_at` — epoch ms of the last change of `delivery_state`.
+ *
+ * The rollback drops exactly these columns. None is indexed, part of a foreign
+ * key or named in another column's CHECK.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v63_migrations = exports.V63_SESSION_RELAY_COLUMNS = void 0;
+/** The v63 columns, in the order the rollback drops them. */
+exports.V63_SESSION_RELAY_COLUMNS = [
+    'delivery_state',
+    'delivery_attempt_id',
+    'delivery_owner',
+    'delivery_reason',
+    'delivery_at',
+];
+exports.v63_migrations = [
+    {
+        version: 63,
+        name: 'session-relays-delivery-attempt',
+        up: (db) => {
+            const statements = [
+                `ALTER TABLE session_relays ADD COLUMN delivery_state TEXT
+           CHECK (delivery_state IN ('attempting','uncertain'))`,
+                'ALTER TABLE session_relays ADD COLUMN delivery_attempt_id TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_owner TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_reason TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_at INTEGER',
+            ];
+            for (const statement of statements)
+                db.exec(statement);
+        },
+        down: (db) => {
+            for (const column of [...exports.V63_SESSION_RELAY_COLUMNS].reverse()) {
+                db.exec(`ALTER TABLE session_relays DROP COLUMN ${column}`);
+            }
+        },
+    },
+];

package/dist/server/src/lib/db/relay-bind-db-base.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * The relay ledger's shared row shape, mapper and SQL fragments, split out of
+ * `relay-bind-db` (Issue #4095). Imported by `relay-bind-db` and its other
+ * split modules; this module imports none of them.
+ *
+ * @module lib/db/relay-bind-db-base
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPEN_STATE_PLACEHOLDERS = exports.KEEP_HELD_PAYLOAD_SET = exports.RELAY_COLUMNS = void 0;
+exports.mapRelay = mapRelay;
+exports.parseJson = parseJson;
+const types_1 = require("../../lib/relay/types");
+/** Every column, in one place, so the readers cannot drift from each other. */
+exports.RELAY_COLUMNS = `
+  id, from_worktree_id, from_instance_id, to_worktree_id, to_instance_id,
+  state, hops, sent_request_id, pending_kind, pending_body, prompt_signature,
+  created_at, updated_at, expires_at, delivered_at,
+  bind_mode, send_state, input_boundary_at, boundary_kind, turn_open_at_send,
+  obs_state, hold_reason, overlap,
+  delivery_state, delivery_reason, delivery_at,
+  CASE WHEN delivery_state IS NULL THEN NULL ELSE payload_id END AS delivery_payload_id,
+  CASE WHEN delivery_state IS NULL THEN NULL ELSE delivery_attempt_id END AS delivery_hold_attempt_id
+`;
+function mapRelay(row) {
+    return {
+        id: row.id,
+        from: { worktreeId: row.from_worktree_id, instanceId: row.from_instance_id },
+        to: { worktreeId: row.to_worktree_id, instanceId: row.to_instance_id },
+        state: row.state,
+        hops: row.hops,
+        sentRequestId: row.sent_request_id,
+        pendingKind: row.pending_kind ?? null,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        expiresAt: row.expires_at,
+        deliveredAt: row.delivered_at,
+        bindMode: row.bind_mode ?? 'legacy',
+        sendState: row.send_state ?? null,
+        inputBoundaryAt: row.input_boundary_at,
+        boundaryKind: row.boundary_kind ?? null,
+        turnOpenAtSend: row.turn_open_at_send === null ? null : row.turn_open_at_send === 1,
+        obsState: row.obs_state ?? null,
+        holdReason: row.hold_reason,
+        overlap: row.overlap ?? null,
+        deliveryHold: mapDeliveryHold(row),
+    };
+}
+/** The delivery hold a row carries, or null (Issue #4064). */
+function mapDeliveryHold(row) {
+    if (row.delivery_state === null || row.delivery_state === undefined)
+        return null;
+    return {
+        state: row.delivery_state,
+        payloadId: row.delivery_payload_id ?? null,
+        attemptId: row.delivery_hold_attempt_id ?? null,
+        kind: row.pending_kind ?? null,
+        reason: row.delivery_reason ?? null,
+        at: row.delivery_at ?? null,
+        checkCommand: (0, types_1.relayRequesterPaneCommand)({
+            worktreeId: row.from_worktree_id,
+            instanceId: row.from_instance_id,
+        }),
+    };
+}
+/**
+ * `SET` assignments that empty the pending slot unless its payload is under a
+ * delivery hold (Issue #4064). For the writers that close a relay (cancel, the
+ * restart recovery's cancel): they stop later deliveries, and a held payload's
+ * body, id and reason stay readable — closing a relay does not prove that what
+ * may already be in A's composer is not.
+ */
+exports.KEEP_HELD_PAYLOAD_SET = `
+  pending_kind = CASE WHEN delivery_state IS NULL THEN NULL ELSE pending_kind END,
+  pending_body = CASE WHEN delivery_state IS NULL THEN NULL ELSE pending_body END,
+  payload_id = CASE WHEN delivery_state IS NULL THEN NULL ELSE payload_id END
+`;
+/** Placeholders for an `IN (…)` over the open states. */
+exports.OPEN_STATE_PLACEHOLDERS = types_1.OPEN_RELAY_STATES.map(() => '?').join(', ');
+function parseJson(text, fallback) {
+    if (text === null)
+        return fallback;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return fallback;
+    }
+}