create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/media-journal.js

@@ -39,35 +39,83 @@ async function readCursor(journalPath) {
   }
 }
 
-async function readRecords(journalPath, startOffset = 0) {
-  const handle = await fs.promises.open(journalPath, 'r');
-  let size;
-  let absoluteStart;
-  let buffer;
-  try {
-    size = (await handle.stat()).size;
-    absoluteStart = Math.min(size, Math.max(0, Number(startOffset) || 0));
-    buffer = Buffer.allocUnsafe(size - absoluteStart);
-    let bytesRead = 0;
-    while (bytesRead < buffer.length) {
-      const read = await handle.read(buffer, bytesRead, buffer.length - bytesRead, absoluteStart + bytesRead);
-      if (read.bytesRead === 0) break;
-      bytesRead += read.bytesRead;
+// I/O working set only: neither the record size nor the recovered records array is capped.
+const JOURNAL_READ_WINDOW_BYTES = 64 * 1024;
+
+async function closeAfterJournalFailure(handle, error) {
+  try { await handle.close(); }
+  catch (closeError) {
+    throw new AggregateError([error, closeError], 'Media journal operation and owned handle cleanup failed', { cause: error });
+  }
+}
+
+async function readJournalWindow(handle, journalPath, position, length) {
+  const buffer = Buffer.allocUnsafe(length);
+  let filled = 0;
+  // Fill one window even when the filesystem returns tiny short reads. Retaining a new 64KiB
+  // buffer for each few bytes of progress would amplify a long line's working set needlessly.
+  while (filled < length) {
+    const remaining = length - filled;
+    const { bytesRead } = await handle.read(buffer, filled, remaining, position + filled);
+    if (bytesRead === 0) {
+      throw Object.assign(new Error(`Media journal ${path.basename(journalPath)} ended before its captured length; recovery is required`),
+        { code: 'CTM_MEDIA_JOURNAL_TRUNCATED' });
     }
-    if (bytesRead !== buffer.length) buffer = buffer.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
+    if (!Number.isSafeInteger(bytesRead) || bytesRead < 0 || bytesRead > remaining) {
+      throw Object.assign(new Error('Media journal read returned invalid byte progress'),
+        { code: 'CTM_MEDIA_JOURNAL_READ_INVALID' });
+    }
+    filled += bytesRead;
   }
+  return buffer;
+}
+
+async function frameJournalRecords(handle, journalPath, absoluteStart, size) {
   const records = [];
-  let lineStart = 0;
-  for (let index = 0; index < buffer.length; index += 1) {
-    if (buffer[index] !== 0x0a) continue;
-    const endOffset = absoluteStart + index + 1;
-    const raw = buffer.subarray(lineStart, index).toString('utf8').trim();
-    if (raw) records.push({ entry: JSON.parse(raw), startOffset: absoluteStart + lineStart, endOffset });
-    lineStart = index + 1;
+  let pieces = [];
+  let lineBytes = 0;
+  let lineStart = absoluteStart;
+  let position = absoluteStart;
+  while (position < size) {
+    const buffer = await readJournalWindow(handle, journalPath, position,
+      Math.min(JOURNAL_READ_WINDOW_BYTES, size - position));
+    let pieceStart = 0;
+    for (let index = 0; index < buffer.length; index += 1) {
+      if (buffer[index] !== 0x0a) continue;
+      pieces.push(buffer.subarray(pieceStart, index));
+      lineBytes += index - pieceStart;
+      const endOffset = position + index + 1;
+      const line = pieces.length === 1 ? pieces[0] : Buffer.concat(pieces, lineBytes);
+      // Decode only after newline framing: split UTF-8 sequences survive read/window boundaries.
+      const raw = line.toString('utf8').trim();
+      if (raw) records.push({ entry: JSON.parse(raw), startOffset: lineStart, endOffset });
+      pieces = [];
+      lineBytes = 0;
+      lineStart = endOffset;
+      pieceStart = index + 1;
+    }
+    if (pieceStart < buffer.length) {
+      pieces.push(buffer.subarray(pieceStart));
+      lineBytes += buffer.length - pieceStart;
+    }
+    position += buffer.length;
   }
-  return { records, size, partialOffset: absoluteStart + lineStart };
+  return { records, size, partialOffset: lineStart };
+}
+
+async function readRecords(journalPath, startOffset = 0) {
+  const handle = await fs.promises.open(journalPath, 'r');
+  let parsed;
+  try {
+    const size = (await handle.stat()).size;
+    const absoluteStart = Math.min(size, Math.max(0, Number(startOffset) || 0));
+    parsed = await frameJournalRecords(handle, journalPath, absoluteStart, size);
+  } catch (error) {
+    await closeAfterJournalFailure(handle, error);
+    throw error;
+  }
+  await handle.close();
+  return parsed;
 }
 
 async function createMediaJournal(options = {}) {
@@ -80,7 +128,6 @@ async function createMediaJournal(options = {}) {
   const journalPath = path.join(root, `journal-${bootId}.jsonl`);
   const handle = await fs.promises.open(journalPath, 'a', 0o600);
   await fs.promises.chmod(journalPath, 0o600).catch(() => {});
-  await syncDirectory(root);
 
   const files = new Map();
   let op = Promise.resolve();
@@ -124,7 +171,14 @@ async function createMediaJournal(options = {}) {
       files.set(filePath, { cursor: offset, records: parsed.records, size: parsed.size });
     }
   }
-  await refresh();
+  try {
+    await syncDirectory(root);
+    await refresh();
+  } catch (error) {
+    // A failed constructor returns no journal whose close() the caller could invoke.
+    await closeAfterJournalFailure(handle, error);
+    throw error;
+  }
 
   function serialize(fn) {
     const next = op.then(fn, fn);
@@ -335,6 +389,9 @@ const { DRAFT_CANONICAL_FIELDS, DRAFT_STATE_VERSION_MAX, canonicalDraftProjectio
 
 module.exports = {
   createMediaJournal,
+  JOURNAL_READ_WINDOW_BYTES,
+  readCursor,
+  readJournalWindow,
   DRAFT_CANONICAL_FIELDS,
   DRAFT_STATE_VERSION_MAX,
   canonicalDraftProjection,

package/template/coding-task-manager/lib/media-store-options.js

@@ -1,5 +1,22 @@
 'use strict';
 
+function createMediaJournalProjector(runDbWorkerOp) {
+  return (entry, projection = {}) => {
+    const urgent = entry.projectionPriority === 'urgent' || projection.urgent;
+    const effectiveEntry = urgent && entry.projectionPriority !== 'urgent'
+      ? { ...entry, projectionPriority: 'urgent' }
+      : entry;
+    return runDbWorkerOp('runDbMutation', {
+      action: 'applyMediaJournalEntry',
+      args: [effectiveEntry],
+    }, {
+      priority: urgent ? 'urgent' : 'low',
+      requestClass: urgent ? 'user-blocking' : 'background',
+      timeoutMs: urgent ? 10_000 : 30_000,
+    });
+  };
+}
+
 function buildMediaStoreOptions({
   dataDir, bootId, registry, assertDraftOwner, runDbWorkerOp, onDrainProgress,
   currentOwnerId, isSameOwnerLineage,
@@ -25,21 +42,32 @@ function buildMediaStoreOptions({
     // drain progress with the load-pressure controller so the media journal participates
     // in the same producer-debt/freshness framework as read-pool-batch/provider-index above.
     onDrainProgress,
-    projectEntry: (entry, projection = {}) => {
-      const urgent = entry.projectionPriority === 'urgent' || projection.urgent;
-      const effectiveEntry = urgent && entry.projectionPriority !== 'urgent'
-        ? { ...entry, projectionPriority: 'urgent' }
-        : entry;
-      return runDbWorkerOp('runDbMutation', {
-        action: 'applyMediaJournalEntry',
-        args: [effectiveEntry],
-      }, {
-        priority: urgent ? 'urgent' : 'low',
-        requestClass: urgent ? 'user-blocking' : 'background',
-        timeoutMs: urgent ? 10_000 : 30_000,
-      });
-    },
+    projectEntry: createMediaJournalProjector(runDbWorkerOp),
   };
 }
 
-module.exports = { buildMediaStoreOptions };
+async function prepareMainMediaStore({
+  createStore, getDataDir, bootId, runDbWorkerOp, assertDraftOwner,
+  onDrainProgress, getCurrentOwnerId, isSameOwnerLineage,
+}) {
+  const registry = await runDbWorkerOp('loadMediaStoreRegistry', {}, {
+    // Listener activation depends on this registry. It is boot-critical
+    // maintenance, while the journal projections below remain background work.
+    priority: 'high',
+    requestClass: 'maintenance',
+    timeoutMs: 30_000,
+  });
+  return createStore(buildMediaStoreOptions({
+    dataDir: getDataDir(), bootId, registry, assertDraftOwner, runDbWorkerOp, onDrainProgress,
+    // WP-1 (docs/image-draft-event-ordering-and-verified-adoption-2026-10-14.html §6.4): the store
+    // is the single draft version allocator. It recovers the highest pending journal version and
+    // then applies verified owner-lineage normalization as one journaled mutation — the draft
+    // restamp was removed from db.js restampOwnerLineage so the two can never allocate concurrently.
+    // Review finding 9: getCurrentOwnerId delegates to the existing LAZY, MEMOIZED identity
+    // accessor only after the DB is open. It returns no invented hostname/port-derived identity.
+    // isSameOwnerLineage is the existing dbModule-free lineage snapshot, not a new DB boundary.
+    currentOwnerId: getCurrentOwnerId(), isSameOwnerLineage,
+  }));
+}
+
+module.exports = { buildMediaStoreOptions, createMediaJournalProjector, prepareMainMediaStore };

package/template/coding-task-manager/lib/migrations/v56-host-samples-and-machine-pool.js

@@ -0,0 +1,76 @@
+'use strict';
+
+// WP-1 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §5 D-4/D-7/D-11, §6.1, §8 WP-1,
+// §9 S-3): the machine-pool schema, in one migration because every piece of it lands with the same
+// reader (lib/host-stats.js today; WP-2/WP-3 for the pairing/self tables).
+//
+//   host_samples           D-11 — the box owns its own 24 h time series (one row per 60 s tick;
+//                                 ≤1440 rows/machine). No hub-side samples table exists.
+//   machine_self           D-4 rev 2 — this machine's OWN user settings (display name, favorite,
+//                                 hidden). Exactly one row, id = 1.
+//   machine_pairing_offers D-6 — the RFC 8628-shaped code a joining member redeems. The plaintext
+//                                 code is never stored, only its hash.
+//   machines.urls_json     P-1/P-4 rev 2 — the member's dialable URLs in dial order.
+//
+// Rev 2 deliberately has NO peer_credentials table: D-7 is one shared pool secret in
+// machine-pool.json, never in the DB.
+//
+// The shape follows v55-agent-origin-backfill.js: a narrow dependency object, idempotent SQL, and
+// the version stamp LAST so a failure leaves the ladder where it was. ALTER TABLE has no
+// `IF NOT EXISTS` in SQLite, so the column add is guarded by its own PRAGMA read — which also
+// makes a re-run (a restored snapshot, a partially upgraded file) a no-op rather than an error.
+
+const TABLES_DDL = `
+  CREATE TABLE IF NOT EXISTS host_samples (
+    at INTEGER PRIMARY KEY,
+    sample_json TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS machine_self (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    display_name TEXT NOT NULL DEFAULT '',
+    favorite INTEGER NOT NULL DEFAULT 0,
+    hidden INTEGER NOT NULL DEFAULT 0,
+    updated_at INTEGER NOT NULL DEFAULT 0
+  );
+  CREATE TABLE IF NOT EXISTS machine_pairing_offers (
+    id TEXT PRIMARY KEY,
+    code_hash TEXT NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    redeemed_at INTEGER,
+    redeemed_by TEXT
+  );
+`;
+
+function _tableExists(db, table) {
+  try {
+    return !!db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  } catch {
+    return false; // expected: a handle that cannot read sqlite_master (pre-boot) has nothing to alter
+  }
+}
+
+function _tableHasColumn(db, table, column) {
+  try {
+    return db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name === column);
+  } catch {
+    return false; // expected: no such table on an old/partial database -> nothing to alter
+  }
+}
+
+function migrateToV56({ getDb, setSchemaVersion, log = console } = {}) {
+  if (typeof getDb !== 'function' || typeof setSchemaVersion !== 'function') throw new TypeError('migration dependencies are required');
+  const db = getDb();
+  db.exec(TABLES_DDL);
+  // S-3: existing databases get the column by ALTER; db.js's machines CREATE literal carries the
+  // same column for a fresh file, and the two must stay in the same ordinal position.
+  let altered = 0;
+  if (_tableExists(db, 'machines') && !_tableHasColumn(db, 'machines', 'urls_json')) {
+    db.exec("ALTER TABLE machines ADD COLUMN urls_json TEXT NOT NULL DEFAULT '[]'");
+    altered = 1;
+  }
+  setSchemaVersion(56);
+  log.log(`[db] Schema migrated to v56 (host samples + machine pool): ${altered} column(s) added`);
+}
+
+module.exports = { migrateToV56 };

package/template/coding-task-manager/lib/mirror-feed-sanitize.js

@@ -151,9 +151,14 @@ function createHostedMirrorFeedCoalescer(options = {}) {
     clear();
     if (!buffer) return false;
     const batch = buffer;
+    // WP-4 (clock-free-tests-followups-r4-2026-10-24.html §5 R-9, §6.5): the batch's FIRST-byte
+    // time, not the drain time -- a held/buffered batch was received when its first byte arrived,
+    // and the hold is exactly the delay this stamp exists to expose. Captured before `startedAt`
+    // is cleared below.
+    const receivedAt = startedAt || now();
     buffer = '';
     startedAt = 0;
-    deliver(sanitizeAndCoalesceHostedMirrorFeed(batch, command()));
+    deliver(sanitizeAndCoalesceHostedMirrorFeed(batch, command()), { receivedAt });
     return true;
   };
   const arm = (ms, opts = {}) => {
@@ -174,7 +179,8 @@ function createHostedMirrorFeedCoalescer(options = {}) {
     const hasSyncControl = _hasSyncFrameControl(text);
     const hasRedrawControl = _hasCursorRedrawControl(text);
     if (!buffer && !hasSyncControl && !hasRedrawControl) {
-      deliver(sanitizeHostedMirrorFeed(text, command()));
+      // WP-4 (R-9, §6.5): the immediate path was never held, so its receipt time IS now.
+      deliver(sanitizeHostedMirrorFeed(text, command()), { receivedAt: now() });
       return true;
     }
     if (!startedAt) startedAt = now();
@@ -204,7 +210,10 @@ function createHostedMirrorFeedCoalescer(options = {}) {
     const prefix = buffer.slice(0, lastOff + SYNC_OFF.length);
     const trailing = buffer.slice(lastOff + SYNC_OFF.length);
     buffer = trailing;
-    deliver(sanitizeAndCoalesceHostedMirrorFeed(prefix, command()));
+    // WP-4 (R-9, §6.5): this prefix came out of the same buffer as flush()'s batch, so it carries
+    // the same first-byte time. `startedAt` is still live here when `trailing` is non-empty; the
+    // `|| now()` fallback only covers a zeroed clock.
+    deliver(sanitizeAndCoalesceHostedMirrorFeed(prefix, command()), { receivedAt: startedAt || now() });
     if (trailing) {
       // Keep startedAt running for the trailing incomplete fragment and re-arm the safety timer.
       arm(2000, { reset: true });

package/template/coding-task-manager/lib/model-proxy/anthropic-face.js

@@ -92,6 +92,10 @@ function anthropicErrorType(kind) {
   if (kind === 'rate_limit_exceeded') return 'rate_limit_error';
   if (kind === 'insufficient_quota') return 'billing_error';
   if (kind === 'server_is_overloaded') return 'overloaded_error';
+  // WP-2 D-5: the two truthful refusal classes carry their own HTTP status (400 / 403), so the type
+  // must not collapse into api_error -- a permission denial is not an upstream fault.
+  if (kind === 'model_not_invocable') return 'invalid_request_error';
+  if (kind === 'model_access_denied') return 'permission_error';
   return 'api_error';
 }
 

package/template/coding-task-manager/lib/model-proxy/chat-response-translators.js

@@ -20,6 +20,9 @@ function createChatResponseTranslators({ normalizeUpstreamOutcome, firstString,
     if (kind === 'rate_limit_exceeded') return 'rate_limit_error';
     if (kind === 'insufficient_quota') return 'billing_error';
     if (kind === 'server_is_overloaded') return 'overloaded_error';
+    // WP-2 D-5: same two mappings as anthropic-face.js (HTTP 400 / 403 respectively).
+    if (kind === 'model_not_invocable') return 'invalid_request_error';
+    if (kind === 'model_access_denied') return 'permission_error';
     return 'api_error';
   }