commandmate 0.49.2 → 0.50.0

package/dist/server/src/lib/db/chat-db.js

@@ -30,6 +30,7 @@ exports.updatePromptData = updatePromptData;
 exports.markPendingPromptsAsAnswered = markPendingPromptsAsAnswered;
 exports.recordAnsweredPrompt = recordAnsweredPrompt;
 exports.createModelChangeMessage = createModelChangeMessage;
+exports.relaySystemRequestId = relaySystemRequestId;
 exports.relayRequestId = relayRequestId;
 exports.parseRelayRequestId = parseRelayRequestId;
 exports.getLastUserMessageForInstance = getLastUserMessageForInstance;
@@ -800,6 +801,18 @@ function createModelChangeMessage(db, params) {
 exports.RELAY_REQUEST_ID_PREFIX = 'relay:';
 /** The `request_id` prefix a relay SYSTEM row carries (`relay-sys:<relayId>:<kind>`). */
 exports.RELAY_SYSTEM_REQUEST_ID_PREFIX = 'relay-sys:';
+/**
+ * The request id of a relay SYSTEM row (Issue #4082): `relay-sys:<relayId>:<kind>`,
+ * or `relay-sys:<relayId>:<kind>:<scope>` for a line written once per payload
+ * attempt (`held`: `<payloadId>:<attemptId>`). The probe that keeps a line from
+ * being written twice and the write itself both build it here, so the two
+ * cannot key the same line differently. The `relay-sys:` prefix is what the
+ * reply readers step over.
+ */
+function relaySystemRequestId(relayId, kind, scope = null) {
+    const base = `${exports.RELAY_SYSTEM_REQUEST_ID_PREFIX}${relayId}:${kind}`;
+    return scope === null ? base : `${base}:${scope}`;
+}
 /** Build the relay message's request id from the ledger id. */
 function relayRequestId(relayId) {
     return `${exports.RELAY_REQUEST_ID_PREFIX}${relayId}`;
@@ -889,7 +902,7 @@ function createRelaySystemMessage(db, params) {
         content: params.content,
         messageType: 'normal',
         timestamp: new Date(params.at),
-        requestId: `${exports.RELAY_SYSTEM_REQUEST_ID_PREFIX}${params.relayId}:${params.kind}`,
+        requestId: relaySystemRequestId(params.relayId, params.kind, params.scope ?? null),
         cliToolId: params.cliToolId,
         instanceId: params.instanceId ?? params.cliToolId,
     });

package/dist/server/src/lib/db/db-instance.js

@@ -10,6 +10,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_DB_ROOT_ENV = exports.isInsideVitestWorker = void 0;
+exports.assertTestDatabasePathIsolated = assertTestDatabasePathIsolated;
 exports.getDbInstance = getDbInstance;
 exports.closeDbInstance = closeDbInstance;
 const path_1 = __importDefault(require("path"));
@@ -17,7 +19,83 @@ const db_migrations_1 = require("./db-migrations");
 const abi_recovery_1 = require("./abi-recovery");
 const agent_session_cost_sampler_1 = require("./agent-session-cost-sampler");
 const env_1 = require("../../lib/env");
+const system_directories_1 = require("../../config/system-directories");
+const test_run_detection_1 = require("../../lib/test-run-detection");
+Object.defineProperty(exports, "isInsideVitestWorker", { enumerable: true, get: function () { return test_run_detection_1.isInsideVitestWorker; } });
 let dbInstance = null;
+/**
+ * `fs` / `os` are required lazily, as getDbInstance() always did for `fs`: a
+ * test that mocks either module must not change how the real database is
+ * opened or which directory counts as temp.
+ */
+function nodeFs() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('fs');
+}
+function nodeTmpdir() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('os').tmpdir();
+}
+/** realpath of the nearest existing ancestor, with the missing tail re-joined. */
+function physicalPath(target) {
+    const fs = nodeFs();
+    let existing = path_1.default.resolve(target);
+    const tail = [];
+    while (!fs.existsSync(existing)) {
+        const parent = path_1.default.dirname(existing);
+        if (parent === existing)
+            break;
+        tail.unshift(path_1.default.basename(existing));
+        existing = parent;
+    }
+    try {
+        return path_1.default.join(fs.realpathSync(existing), ...tail);
+    }
+    catch {
+        return path_1.default.resolve(target);
+    }
+}
+/** Set by tests/setup.ts: the gitignored directory that holds per-process test databases. */
+exports.TEST_DB_ROOT_ENV = 'CM_TEST_DB_ROOT';
+/**
+ * Issue #4086: under Vitest, refuse any database the test run does not own.
+ *
+ * A worker's shell inherits the server's `CM_DB_PATH=<production db>`, and a
+ * test that reached this function opened that file, switched it to WAL and ran
+ * the checkout's migrations on it (production went to v63 under a v62 server).
+ * tests/setup.ts repoints the variables per process; this is the backstop for
+ * a path that still escapes (a test that deletes `CM_DB_PATH` and falls to the
+ * install default, a child process that inherited a real path).
+ *
+ * Owned = inside the OS temp directory (tests that mock `getEnv` and create
+ * their own `mkdtemp` database) or inside `$CM_TEST_DB_ROOT` (the per-process
+ * databases tests/setup.ts hands out — not under the temp dir, because
+ * `validateDbPath` rejects /tmp and /var, where every OS temp dir lives). Not
+ * only the one setup path, so tests that name their own database keep working.
+ * Active when {@link isUnderTest} says so; a no-op otherwise, so a real server is
+ * never affected — including one that inherited `VITEST` but runs with
+ * `NODE_ENV=production`.
+ *
+ * @param inVitestWorker - defaults to {@link isInsideVitestWorker}; a test
+ *   passes `false` to ask how a process outside Vitest would be judged
+ * @throws Error when under test and `dbPath` is in neither directory
+ */
+function assertTestDatabasePathIsolated(dbPath, env = process.env, tmpRoot = nodeTmpdir(), inVitestWorker = (0, test_run_detection_1.isInsideVitestWorker)()) {
+    if (!(0, test_run_detection_1.isUnderTest)(env, inVitestWorker))
+        return;
+    const resolved = path_1.default.resolve(dbPath);
+    const roots = [tmpRoot, env[exports.TEST_DB_ROOT_ENV]]
+        .filter((root) => typeof root === 'string' && root.trim() !== '');
+    // Compared physically: macOS's /var -> /private/var (the temp dir lives
+    // there) must not reject a temp path, and a symlink under an owned directory
+    // must not let a real database through.
+    const physical = physicalPath(resolved);
+    if (!roots.some((root) => (0, system_directories_1.isPathWithin)(physical, physicalPath(root)))) {
+        throw new Error(`[Issue #4086] Refusing to open database ${resolved} under test: it is outside the temp directory `
+            + `and outside ${exports.TEST_DB_ROOT_ENV} (${roots.join(', ')}). tests/setup.ts points CM_DB_PATH at a `
+            + 'per-process test database; a test that names its own database must create it under os.tmpdir().');
+    }
+}
 /**
  * Get or create the database instance
  *
@@ -37,9 +115,10 @@ function getDbInstance() {
         // Issue #135: Use getEnv() for consistent DB path resolution
         const env = (0, env_1.getEnv)();
         const dbPath = env.CM_DB_PATH;
+        // Issue #4086: before anything touches the path (mkdir, open, WAL, migrations).
+        assertTestDatabasePathIsolated(dbPath);
         // Ensure the database directory exists
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const fs = require('fs');
+        const fs = nodeFs();
         const dir = path_1.default.dirname(dbPath);
         if (!fs.existsSync(dir)) {
             // SEC-003: Set directory permissions to 0o700 (owner only)
@@ -70,6 +149,9 @@ function getDbInstance() {
             throw error;
         }
         dbInstance = db;
+        if ((0, test_run_detection_1.isUnderTest)()) {
+            (globalThis.__commandmateTestDbClosers ??= new Set()).add(closeDbInstance);
+        }
         // Issue #2044: the agent cost ledger needs somebody to copy the in-memory
         // telemetry in before the pane that holds it is killed. This is the one
         // place that runs once per process, after the schema is verified, in every

package/dist/server/src/lib/db/migrations/index.js

@@ -46,6 +46,9 @@ const v59_opencode_instance_settings_1 = require("./v59-opencode-instance-settin
 const v60_session_relays_1 = require("./v60-session-relays");
 const v61_session_notes_1 = require("./v61-session-notes");
 const v62_session_relays_bind_1 = require("./v62-session-relays-bind");
+const v63_session_relays_delivery_attempt_1 = require("./v63-session-relays-delivery-attempt");
+const v64_agent_roles_1 = require("./v64-agent-roles");
+const v65_agent_instance_creation_keys_1 = require("./v65-agent-instance-creation-keys");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -95,4 +98,7 @@ exports.migrations = [
     ...v60_session_relays_1.v60_migrations,
     ...v61_session_notes_1.v61_migrations,
     ...v62_session_relays_bind_1.v62_migrations,
+    ...v63_session_relays_delivery_attempt_1.v63_migrations,
+    ...v64_agent_roles_1.v64_migrations,
+    ...v65_agent_instance_creation_keys_1.v65_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -18,7 +18,7 @@ const pre_migration_backup_1 = require("./pre-migration-backup");
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 62;
+exports.CURRENT_SCHEMA_VERSION = 65;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v63-session-relays-delivery-attempt.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Migration v63: record the relay delivery's own attempt (Issue #4064).
+ *
+ * Until now a payload in `pending_*` had one state — queued — and the only lock
+ * on its delivery was the in-process claim. A send whose outcome could not be
+ * told (`indeterminate`, a throw after `sent`, a throw before any state) was
+ * released like an unsent one and typed again by the next pump, and a server
+ * that died mid-send forgot the attempt altogether.
+ *
+ * The columns below say, per payload, whether a delivery has started and how
+ * it ended when that end is not known:
+ *
+ * - `delivery_state` — NULL (queued; every row that existed before this
+ *   migration, `payload_id` NULL included) | `attempting` (written before the
+ *   first key; only the writer of it sends) | `uncertain` (the attempt's outcome
+ *   is not known; never sent again automatically).
+ * - `delivery_attempt_id` — the attempt that took the payload; the result is
+ *   written only under it.
+ * - `delivery_owner` — the server boot that took it, so a restart can tell its
+ *   own live attempts from the previous boot's interrupted ones.
+ * - `delivery_reason` — why it is held (`SendAttemptReason`, `send-threw`,
+ *   `threw-after-sent`, `server-restarted`), published as is.
+ * - `delivery_at` — epoch ms of the last change of `delivery_state`.
+ *
+ * The rollback drops exactly these columns. None is indexed, part of a foreign
+ * key or named in another column's CHECK.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v63_migrations = exports.V63_SESSION_RELAY_COLUMNS = void 0;
+/** The v63 columns, in the order the rollback drops them. */
+exports.V63_SESSION_RELAY_COLUMNS = [
+    'delivery_state',
+    'delivery_attempt_id',
+    'delivery_owner',
+    'delivery_reason',
+    'delivery_at',
+];
+exports.v63_migrations = [
+    {
+        version: 63,
+        name: 'session-relays-delivery-attempt',
+        up: (db) => {
+            const statements = [
+                `ALTER TABLE session_relays ADD COLUMN delivery_state TEXT
+           CHECK (delivery_state IN ('attempting','uncertain'))`,
+                'ALTER TABLE session_relays ADD COLUMN delivery_attempt_id TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_owner TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_reason TEXT',
+                'ALTER TABLE session_relays ADD COLUMN delivery_at INTEGER',
+            ];
+            for (const statement of statements)
+                db.exec(statement);
+        },
+        down: (db) => {
+            for (const column of [...exports.V63_SESSION_RELAY_COLUMNS].reverse()) {
+                db.exec(`ALTER TABLE session_relays DROP COLUMN ${column}`);
+            }
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v64-agent-roles.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Migration v64: roles (Epic #4112, Issue #4114).
+ *
+ * ## The three states of a setting
+ *
+ * A level holds a role, an explicit "no role", or nothing, in which case the next
+ * level decides. No row is "nothing" and a NULL `role_id` is the explicit none.
+ * The system level has no explicit none (`role_id NOT NULL`): it is the last level.
+ *
+ * ## Why no reference to `agent_roles` is `ON DELETE SET NULL`
+ *
+ * NULL means "explicitly none", so a deleted role would quietly become a decision
+ * nobody made. They are `RESTRICT`, and `deleteAgentRole` with `force` removes the
+ * rows in one transaction, which reads as "inherit".
+ *
+ * ## Why `agent_instance_roles` is its own table
+ *
+ * `setAgentInstances` deletes and re-inserts every roster row, so a column on
+ * `agent_instances` would be wiped by each rename and reorder (the same reason as
+ * v59). It has no foreign key to `agent_instances` for the same reason: the
+ * replace would cascade into it. `pruneAgentInstanceRoles` removes the ids that
+ * really left. `worktree_id` follows the convention `getWorktreeChildTables()`
+ * looks for, so a row follows a worktree id rename and goes with its worktree.
+ *
+ * ## The launch record
+ *
+ * A snapshot of what was resolved, kept as evidence, so `repository_id` and
+ * `role_id` are deliberately not foreign keys: a deleted role or repository
+ * must neither take the evidence along nor block a `force` delete. There is no
+ * body and no secret column. Nothing updates a row, but there is deliberately no
+ * `RAISE(ABORT)` trigger enforcing that: `getWriteGuardedTables` reads one as
+ * "append-only ledger" and the row would no longer follow a worktree id rename.
+ *
+ * The rollback drops the five tables, which is the whole of what this adds.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v64_migrations = exports.V64_AGENT_ROLE_TABLES = void 0;
+/** In dependency order. The rollback drops them from the end. */
+exports.V64_AGENT_ROLE_TABLES = [
+    'agent_roles',
+    'agent_role_system_defaults',
+    'agent_role_repository_defaults',
+    'agent_instance_roles',
+    'agent_role_launch_records',
+];
+exports.v64_migrations = [
+    {
+        version: 64,
+        name: 'agent-roles',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE agent_roles (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL COLLATE NOCASE UNIQUE,
+          body TEXT NOT NULL,
+          body_version INTEGER NOT NULL,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL
+        );
+
+        CREATE TABLE agent_role_system_defaults (
+          cli_tool_id TEXT PRIMARY KEY,
+          role_id TEXT NOT NULL REFERENCES agent_roles(id) ON DELETE RESTRICT,
+          updated_at INTEGER NOT NULL
+        );
+
+        CREATE TABLE agent_role_repository_defaults (
+          repository_id TEXT NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
+          cli_tool_id TEXT NOT NULL,
+          role_id TEXT REFERENCES agent_roles(id) ON DELETE RESTRICT,
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (repository_id, cli_tool_id)
+        );
+
+        CREATE TABLE agent_instance_roles (
+          worktree_id TEXT NOT NULL REFERENCES worktrees(id) ON DELETE CASCADE,
+          instance_id TEXT NOT NULL,
+          role_id TEXT REFERENCES agent_roles(id) ON DELETE RESTRICT,
+          updated_at INTEGER NOT NULL,
+          PRIMARY KEY (worktree_id, instance_id)
+        );
+
+        CREATE TABLE agent_role_launch_records (
+          id TEXT PRIMARY KEY,
+          worktree_id TEXT NOT NULL REFERENCES worktrees(id) ON DELETE CASCADE,
+          instance_id TEXT NOT NULL,
+          cli_tool_id TEXT NOT NULL,
+          phase TEXT NOT NULL CHECK (phase IN ('requested','launched')),
+          session_generation TEXT NOT NULL,
+          source TEXT NOT NULL,
+          repository_id TEXT,
+          role_id TEXT,
+          role_name TEXT,
+          body_version INTEGER,
+          body_fingerprint TEXT,
+          injection_fingerprint TEXT,
+          artifact_fingerprint TEXT,
+          adapter_id TEXT,
+          adapter_version TEXT,
+          wrapper_version TEXT,
+          artifact_path TEXT,
+          effective_agent TEXT,
+          composition_source_fingerprint TEXT,
+          no_role_reason TEXT,
+          recorded_at INTEGER NOT NULL,
+          UNIQUE (worktree_id, instance_id, session_generation, phase)
+        );
+
+        CREATE INDEX idx_agent_role_repository_defaults_role ON agent_role_repository_defaults(role_id);
+        CREATE INDEX idx_agent_instance_roles_role ON agent_instance_roles(role_id);
+        CREATE INDEX idx_agent_role_system_defaults_role ON agent_role_system_defaults(role_id);
+        CREATE INDEX idx_agent_role_launch_records_latest
+          ON agent_role_launch_records(worktree_id, instance_id, phase, recorded_at);
+      `);
+        },
+        down: (db) => {
+            for (const table of [...exports.V64_AGENT_ROLE_TABLES].reverse()) {
+                db.exec(`DROP TABLE IF EXISTS ${table}`);
+            }
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v65-agent-instance-creation-keys.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Migration v65: idempotency keys for creating an instance or saving a roster (Issue #4132).
+ *
+ * A write whose answer was lost cannot be told from another client's identical one by
+ * comparing rows, so the request carries a key, written in the transaction that makes the
+ * write. A NULL `request_fingerprint` is a key given up on (`settle`) or whose row has left
+ * the roster: a request still on its way with that key makes nothing. Otherwise a NULL
+ * `instance_id` is a roster PATCH that added not exactly one row. Design:
+ * `docs/design/agent-roles-adapters.md` §15.
+ *
+ * `worktree_id` follows the convention `getWorktreeChildTables()` looks for, so a row
+ * follows a worktree id rename and goes with its worktree. Holds no body and no secret.
+ *
+ * The rollback drops the table, which forgets recent keys and nothing else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v65_migrations = void 0;
+exports.v65_migrations = [
+    {
+        version: 65,
+        name: 'agent-instance-creation-keys',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE agent_instance_creation_keys (
+          worktree_id TEXT NOT NULL REFERENCES worktrees(id) ON DELETE CASCADE,
+          idempotency_key TEXT NOT NULL,
+          instance_id TEXT,
+          request_fingerprint TEXT,
+          created_at INTEGER NOT NULL,
+          PRIMARY KEY (worktree_id, idempotency_key)
+        );
+
+        CREATE INDEX idx_agent_instance_creation_keys_created_at
+          ON agent_instance_creation_keys(created_at);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP TABLE IF EXISTS agent_instance_creation_keys');
+        },
+    },
+];

package/dist/server/src/lib/db/relay-bind-db-base.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * The relay ledger's shared row shape, mapper and SQL fragments, split out of
+ * `relay-bind-db` (Issue #4095). Imported by `relay-bind-db` and its other
+ * split modules; this module imports none of them.
+ *
+ * @module lib/db/relay-bind-db-base
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPEN_STATE_PLACEHOLDERS = exports.KEEP_HELD_PAYLOAD_SET = exports.RELAY_COLUMNS = void 0;
+exports.mapRelay = mapRelay;
+exports.parseJson = parseJson;
+const types_1 = require("../../lib/relay/types");
+/** Every column, in one place, so the readers cannot drift from each other. */
+exports.RELAY_COLUMNS = `
+  id, from_worktree_id, from_instance_id, to_worktree_id, to_instance_id,
+  state, hops, sent_request_id, pending_kind, pending_body, prompt_signature,
+  created_at, updated_at, expires_at, delivered_at,
+  bind_mode, send_state, input_boundary_at, boundary_kind, turn_open_at_send,
+  obs_state, hold_reason, overlap,
+  delivery_state, delivery_reason, delivery_at,
+  CASE WHEN delivery_state IS NULL THEN NULL ELSE payload_id END AS delivery_payload_id,
+  CASE WHEN delivery_state IS NULL THEN NULL ELSE delivery_attempt_id END AS delivery_hold_attempt_id
+`;
+function mapRelay(row) {
+    return {
+        id: row.id,
+        from: { worktreeId: row.from_worktree_id, instanceId: row.from_instance_id },
+        to: { worktreeId: row.to_worktree_id, instanceId: row.to_instance_id },
+        state: row.state,
+        hops: row.hops,
+        sentRequestId: row.sent_request_id,
+        pendingKind: row.pending_kind ?? null,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        expiresAt: row.expires_at,
+        deliveredAt: row.delivered_at,
+        bindMode: row.bind_mode ?? 'legacy',
+        sendState: row.send_state ?? null,
+        inputBoundaryAt: row.input_boundary_at,
+        boundaryKind: row.boundary_kind ?? null,
+        turnOpenAtSend: row.turn_open_at_send === null ? null : row.turn_open_at_send === 1,
+        obsState: row.obs_state ?? null,
+        holdReason: row.hold_reason,
+        overlap: row.overlap ?? null,
+        deliveryHold: mapDeliveryHold(row),
+    };
+}
+/** The delivery hold a row carries, or null (Issue #4064). */
+function mapDeliveryHold(row) {
+    if (row.delivery_state === null || row.delivery_state === undefined)
+        return null;
+    return {
+        state: row.delivery_state,
+        payloadId: row.delivery_payload_id ?? null,
+        attemptId: row.delivery_hold_attempt_id ?? null,
+        kind: row.pending_kind ?? null,
+        reason: row.delivery_reason ?? null,
+        at: row.delivery_at ?? null,
+        checkCommand: (0, types_1.relayRequesterPaneCommand)({
+            worktreeId: row.from_worktree_id,
+            instanceId: row.from_instance_id,
+        }),
+    };
+}
+/**
+ * `SET` assignments that empty the pending slot unless its payload is under a
+ * delivery hold (Issue #4064). For the writers that close a relay (cancel, the
+ * restart recovery's cancel): they stop later deliveries, and a held payload's
+ * body, id and reason stay readable — closing a relay does not prove that what
+ * may already be in A's composer is not.
+ */
+exports.KEEP_HELD_PAYLOAD_SET = `
+  pending_kind = CASE WHEN delivery_state IS NULL THEN NULL ELSE pending_kind END,
+  pending_body = CASE WHEN delivery_state IS NULL THEN NULL ELSE pending_body END,
+  payload_id = CASE WHEN delivery_state IS NULL THEN NULL ELSE payload_id END
+`;
+/** Placeholders for an `IN (…)` over the open states. */
+exports.OPEN_STATE_PLACEHOLDERS = types_1.OPEN_RELAY_STATES.map(() => '?').join(', ');
+function parseJson(text, fallback) {
+    if (text === null)
+        return fallback;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return fallback;
+    }
+}