create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/migrations/v58-subagent-launch-native-subagents.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// WP-1 (codex-native-subagent-pick-enforcement-2026-10-28.html §5 D-4, §6, §9 S-4): the launch row
+// (session_subagent_pick_launch, v48) recorded WHICH pick a lead was spawned with, but not whether
+// that launch UNREGISTERED Codex's native sub-agent tools. So the UI could only re-derive the rule
+// against the CURRENT code -- and a session launched before the deny existed would be described as
+// denied although its process still advertises spawn_agent. Add ONE nullable column (no new table,
+// no JSON store) so the row states what the launch DID:
+//   NULL       = unknown (every row written before v58)
+//   ''         = a KNOWN "this launch did not deny native sub-agents"
+//   'disabled' = this launch carried CODEX_NATIVE_SUBAGENT_DENY_ARGS (lib/session-create/subagent-pick.js)
+// The column is added WITHOUT a default: an old row must stay NULL (unknown), never be converted to
+// the '' "known not denied" claim by a backfill.
+//
+// Replay-safe exactly like v50: a test template or restored snapshot can already carry the v58
+// column while its compatibility marker is intentionally lowered to exercise an earlier ladder step,
+// so this migration is idempotent and validates the post-state instead of assuming a clean v56.
+const { ensureDelegatePrefMirrorSchema } = require('./v48-delegate-pref-mirror');
+
+const LAUNCH_TABLE = 'session_subagent_pick_launch';
+
+function migrateToV58({ getDb, setSchemaVersion, log = console } = {}) {
+  if (typeof getDb !== 'function' || typeof setSchemaVersion !== 'function') throw new TypeError('migration dependencies are required');
+  const db = getDb();
+  // The launch table and its owner columns belong to v48/v49; the shared ensure keeps a partial or
+  // foreign table a hard failure instead of a silent stamp. It never adds `native_subagents` itself.
+  ensureDelegatePrefMirrorSchema({ getDb, includeLaunchOwnerColumns: true });
+  const nativeSubagentsColumn = () => db.prepare(`PRAGMA table_info(${LAUNCH_TABLE})`).all()
+    .find((row) => row.name === 'native_subagents');
+  if (!nativeSubagentsColumn()) db.exec(`ALTER TABLE ${LAUNCH_TABLE} ADD COLUMN native_subagents TEXT`);
+  // Post-state: nullable TEXT with no default. A NOT NULL or defaulted column could only come from a
+  // foreign/pre-migrated table, and stamping that as v58 would silently claim old rows hold a known
+  // value -- refuse instead.
+  const column = nativeSubagentsColumn();
+  if (!column || String(column.type || '').toUpperCase() !== 'TEXT' || column.notnull !== 0 || column.dflt_value != null) {
+    throw new Error('existing v58 native_subagents column is incompatible');
+  }
+  setSchemaVersion(58);
+  log.log('[db] Schema migrated to v58 (native subagent launch deny fact)');
+}
+
+module.exports = { migrateToV58 };

package/template/coding-task-manager/lib/migrations/v59-coding-session-model-state-dsh.js

@@ -0,0 +1,73 @@
+'use strict';
+
+// v59 (ctm-deepseek-harness-acp-agent-design §9b WP-8, step 1): DeepSeek Harness sessions
+// (agentType 'dsh') need model/effort chips, but their owner row lives in
+// `coding_session_model_state`, whose v42 `agent_type` CHECK admits only
+// claude/codex/gemini/opencode -- so a 'dsh' row is refused by SQLite. SQLite cannot ALTER a CHECK,
+// so the table is REBUILT: rename, recreate, copy every row and every column, drop, all inside ONE
+// transaction.
+//
+// v42 is untouched: it stays the published record of the schema IT created. This is the forward step
+// a database stamped v42..v58 needs.
+//
+// Idempotence is decided by the SCHEMA, never by the version counter: a table whose sqlite_master.sql
+// already admits 'dsh' is left byte-for-byte alone, so a re-run of the ladder body (a restored
+// snapshot, a partially upgraded file, or a database that already took this step) writes nothing.
+//
+// The recreate text is the table's OWN stored DDL with only the `agent_type` CHECK widened, so no
+// column, default, ordinal position, other constraint -- and the `STRICT` keyword -- can drift from
+// what the database already has.
+//
+// This step writes NO production code that inserts 'dsh' rows; it only widens the schema.
+
+const TABLE = 'coding_session_model_state';
+
+// The exact v42 text of the agent_type CHECK. v42 is frozen, so this literal is stable; a table
+// whose DDL does not match it is refused rather than silently rebuilt with a guessed shape.
+const AGENT_TYPE_CHECK = "CHECK (agent_type IN ('claude','codex','gemini','opencode'))";
+const AGENT_TYPE_CHECK_DSH = "CHECK (agent_type IN ('claude','codex','gemini','opencode','dsh'))";
+
+function _tableSql(db, table) {
+  const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return row && typeof row.sql === 'string' ? row.sql : null;
+}
+
+// Explicit indexes on the table. A PRIMARY KEY's implicit autoindex has sql = NULL and must never be
+// recreated by name, so it is filtered out. Captured BEFORE the rename, while each index's SQL still
+// names the real table: ALTER TABLE RENAME would rewrite that reference to the staging name, and the
+// DROP of the staging table takes the indexes with it.
+function _tableIndexes(db, table) {
+  return db.prepare("SELECT name, sql FROM sqlite_master WHERE type = 'index' AND tbl_name = ? AND sql IS NOT NULL").all(table)
+    .map((row) => ({ name: row.name, sql: row.sql }));
+}
+
+// Widen the agent_type CHECK. Returns the number of tables rebuilt (1), or 0 when there was nothing
+// to do (absent table, or a table that already admits dsh) -- the v57 contract.
+function migrateToV59({ getDb, setSchemaVersion, log = console } = {}) {
+  if (typeof getDb !== 'function' || typeof setSchemaVersion !== 'function') throw new TypeError('migration dependencies are required');
+  const db = getDb();
+  const rebuilt = db.transaction(() => {
+    const sql = _tableSql(db, TABLE);
+    if (!sql) return 0;
+    if (sql.includes("'dsh'")) return 0;
+    if (!sql.includes(AGENT_TYPE_CHECK)) {
+      throw new Error(`v59: ${TABLE} has no claude/codex/gemini/opencode agent_type CHECK to widen`);
+    }
+    const widened = sql.split(AGENT_TYPE_CHECK).join(AGENT_TYPE_CHECK_DSH);
+    const staging = `${TABLE}__v59`;
+    const indexes = _tableIndexes(db, TABLE);
+    // ALTER TABLE RENAME keeps the row data; the fresh CREATE below carries the widened CHECK. The
+    // INSERT copies by position, which is exactly why the recreate text must be the stored DDL.
+    db.exec(`ALTER TABLE ${TABLE} RENAME TO ${staging}`);
+    db.exec(widened);
+    db.exec(`INSERT INTO ${TABLE} SELECT * FROM ${staging}`);
+    db.exec(`DROP TABLE ${staging}`);
+    for (const index of indexes) db.exec(index.sql);
+    return 1;
+  })();
+  setSchemaVersion(59);
+  log.log(`[db] Schema migrated to v59 (coding session model state admits dsh): ${rebuilt} table(s) rebuilt`);
+  return { rebuilt };
+}
+
+module.exports = { migrateToV59, AGENT_TYPE_CHECK, AGENT_TYPE_CHECK_DSH };

package/template/coding-task-manager/lib/migrations/v60-delegate-pref-mirror-dsh.js

@@ -0,0 +1,78 @@
+'use strict';
+
+// v60 (ctm-deepseek-harness-acp-agent-design-2026-10-28.html §9b WP-10 step C, D-24):
+// `delegate_pref_mirror` gains 'dsh' as a valid `agent`, so CTM's local mirror of the stored
+// delegate ladder can hold a DeepSeek Harness lead's per-agent default rung (`default:dsh`) the
+// same way it holds `default:claude` / `default:codex` / `default:opencode`. Wall-E's
+// delegate_model_prefs admits `default:dsh` from brain migration 103; this is the CTM half of the
+// same widening, exactly the way v57 added 'opencode'.
+//
+// `agent` is a CHECK constraint and SQLite cannot ALTER a CHECK -- so an existing table is REBUILT:
+// rename, recreate, copy every row and every column, drop, all inside ONE transaction.
+//
+// v48 is untouched: it stays the published record of the schema IT created. This is the forward
+// step a database stamped v48..v59 needs, and the read path
+// (lib/storage/delegate-pref-mirror-store) is the only consumer of the table.
+//
+// Idempotence is decided by the SCHEMA, never by the version counter: a table whose sqlite_master.sql
+// already admits 'dsh' is left byte-for-byte alone, so a re-run of the ladder body (a restored
+// snapshot, a partially upgraded file, or a database that already took this step) writes nothing.
+//
+// The recreate text is the table's OWN stored DDL with only the `agent` CHECK widened, so no column,
+// default, ordinal position or other constraint can drift from what the database already has -- the
+// v49 owner columns, the v50 `effort` column and every v48 column ride along automatically.
+//
+// WHY THIS WIDENS ONLY delegate_pref_mirror (and not session_subagent_pick_launch, as v57 did):
+// a dsh row cannot be written to `session_subagent_pick_launch` today, so widening its CHECK would
+// be dead schema. Its only writer is createDelegatePrefMirrorStore.setLaunch (lib/storage/
+// delegate-pref-mirror-store.js), which refuses any agent outside its own AGENTS set, and its only
+// production caller is lib/session-create/provider-process.js -- the PTY lead path, which a dsh
+// session never takes (dsh is an ACP child: lib/session-create/dsh-session.js /
+// structured-session.js, no PTY, no provider-process). A dsh lead reaches Wall-E's ladder directly
+// over MCP, keyed on its own agent, so CTM writes no launch row for it. If a future writer makes a
+// dsh launch row reachable, it needs its own widening step AND the store's AGENTS set widened with
+// it -- doing either one alone turns a clean TypeError into a SQLITE_CONSTRAINT_CHECK at launch.
+//
+// This step writes NO production code that inserts 'dsh' rows; it only widens the schema.
+
+const TABLE = 'delegate_pref_mirror';
+
+// The exact v48 text of the agent CHECK after v57 widened it. v48 is frozen and v57 is published,
+// so this literal is stable; a table whose DDL does not match it is refused rather than silently
+// rebuilt with a guessed shape.
+const AGENT_CHECK = "CHECK (agent IN ('claude','codex','opencode'))";
+const AGENT_CHECK_DSH = "CHECK (agent IN ('claude','codex','opencode','dsh'))";
+
+function _tableSql(db, table) {
+  const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return row && typeof row.sql === 'string' ? row.sql : null;
+}
+
+// Widen the agent CHECK. Returns the number of tables rebuilt (1), or 0 when there was nothing to do
+// (absent table, or a table that already admits dsh) -- the v57 contract.
+function migrateToV60({ getDb, setSchemaVersion, log = console } = {}) {
+  if (typeof getDb !== 'function' || typeof setSchemaVersion !== 'function') throw new TypeError('migration dependencies are required');
+  const db = getDb();
+  const rebuilt = db.transaction(() => {
+    const sql = _tableSql(db, TABLE);
+    if (!sql) return 0;
+    if (sql.includes("'dsh'")) return 0;
+    if (!sql.includes(AGENT_CHECK)) {
+      throw new Error(`v60: ${TABLE} has no claude/codex/opencode agent CHECK to widen`);
+    }
+    const widened = sql.split(AGENT_CHECK).join(AGENT_CHECK_DSH);
+    const staging = `${TABLE}__v60`;
+    // ALTER TABLE RENAME keeps the row data; the fresh CREATE below carries the widened CHECK. The
+    // INSERT copies by position, which is exactly why the recreate text must be the stored DDL.
+    db.exec(`ALTER TABLE ${TABLE} RENAME TO ${staging}`);
+    db.exec(widened);
+    db.exec(`INSERT INTO ${TABLE} SELECT * FROM ${staging}`);
+    db.exec(`DROP TABLE ${staging}`);
+    return 1;
+  })();
+  setSchemaVersion(60);
+  log.log(`[db] Schema migrated to v60 (delegate pref mirror admits dsh): ${rebuilt} table(s) rebuilt`);
+  return { rebuilt };
+}
+
+module.exports = { migrateToV60, AGENT_CHECK, AGENT_CHECK_DSH };

package/template/coding-task-manager/lib/migrations/v61-conversation-item-clock.js

@@ -0,0 +1,71 @@
+'use strict';
+
+// v61 (WP-5, docs/shared-memory-every-machine-2026-10-31.html §5 D-3, §6.8): the conversation-item
+// change clock — the tables behind lib/conversation-item-clock.js.
+//
+// Three tables and one index:
+//   conversation_item_clock  one row per admitted/corrected/deleted item, addressed by
+//                            (origin_instance_id, origin_seq) — the compacted log the sync feed
+//                            (lib/conversation-sync.js) serves as a version vector.
+//   conversation_vv          the "seen through" watermark per origin.
+//   conversation_local_seq   this host's monotonic local-sequence allocator.
+//
+// WHERE THESE LIVE. They were declared inline by lib/conversation-store-v2.js's
+// ensureConversationStoreV2, but that module is a ratcheted lazy store whose DDL ceiling is frozen
+// (coding-task-manager/lint/ddl-outside-runner.config.json), while lib/migrations/** is sanctioned
+// — so the tables move here, exactly as v31's turn index moved to lib/migrations/v31-*.js (which
+// lib/conversation-turn-index.js still reaches for a fresh install). The store keeps reaching THIS
+// DDL on its own boot path through ensureConversationItemClockSchema below, so a bare in-memory
+// store, a fresh database and a migrated database all converge on the same schema.
+//
+// DOMAIN. conversation_text_items_v2 is classified 'firehose' (lib/db-domain-tables.js), and the
+// clock is stamped in the same transaction as the text row it addresses, so the ladder entry hands
+// this migration dbFor('conversation_text_items_v2') — the same handle, and therefore the same
+// database file, as the text table.
+//
+// Idempotent by construction: every statement is IF NOT EXISTS, so a re-run of the ladder body (a
+// restored snapshot, a partially upgraded file, or a database that already took this step) writes
+// nothing.
+
+const CONVERSATION_CLOCK_DDL = `
+    CREATE TABLE IF NOT EXISTS conversation_item_clock (
+      stable_key TEXT PRIMARY KEY,
+      session_id TEXT NOT NULL,
+      origin_instance_id TEXT NOT NULL,
+      origin_seq INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      deleted INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_conv_item_clock_origin
+      ON conversation_item_clock(origin_instance_id, origin_seq);
+
+    CREATE TABLE IF NOT EXISTS conversation_vv (
+      origin_instance_id TEXT PRIMARY KEY,
+      max_seq INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS conversation_local_seq (
+      id INTEGER PRIMARY KEY CHECK (id = 1),
+      next_seq INTEGER NOT NULL
+    );
+`;
+
+// The idempotent schema ensure. Called by the v61 ladder step AND by
+// lib/conversation-store-v2.js's ensureConversationStoreV2, so a store opened outside the ladder
+// still has the clock tables its writer stamps.
+function ensureConversationItemClockSchema({ getDb } = {}) {
+  if (typeof getDb !== 'function') throw new TypeError('getDb is required');
+  const db = getDb();
+  db.exec(CONVERSATION_CLOCK_DDL);
+  return db;
+}
+
+function migrateToV61({ getDb, setSchemaVersion, log = console } = {}) {
+  if (typeof getDb !== 'function' || typeof setSchemaVersion !== 'function') throw new TypeError('migration dependencies are required');
+  ensureConversationItemClockSchema({ getDb });
+  setSchemaVersion(61);
+  log.log('[db] Schema migrated to v61 (conversation item clock: conversation_item_clock, conversation_vv, conversation_local_seq)');
+}
+
+module.exports = { migrateToV61, ensureConversationItemClockSchema, CONVERSATION_CLOCK_DDL };