ework-daemon 0.4.5 → 0.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-daemon",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Issue-driven AI development daemon. Spawns opencode subprocesses to resolve Gitea issues.",
   "module": "src/index.ts",
   "type": "module",

package/src/db.ts

@@ -323,6 +323,159 @@ async function runMigrations(db: AsyncDatabase): Promise<void> {
     await db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
   };
 
+  // ── id/uid swap: id becomes AUTO_INCREMENT PK, uid holds the UUID ──
+  // SQLite cannot ADD PRIMARY KEY via ALTER — must rebuild. Runs before
+  // owner_daemon_id etc. so rebuild only copies base columns; ephemeral
+  // coordination data (owner_daemon_id, nudge state) is re-added below.
+  const tMessages = `${prefix}messages`;
+
+  const UID_REBUILDS: {
+    table: string;
+    sqliteCreate: string;
+    mysqlCreate: string;
+    oldCols: string;
+    newCols: string;
+  }[] = [
+    {
+      table: tIssues,
+      sqliteCreate: `CREATE TABLE ${tIssues} (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
+  tracker_type TEXT NOT NULL,
+  tracker_scope_key TEXT NOT NULL,
+  tracker_scope TEXT NOT NULL,
+  tracker_issue_id TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'created',
+  title TEXT NOT NULL DEFAULT '',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE(tracker_type, tracker_scope_key, tracker_issue_id)
+)`,
+      mysqlCreate: `CREATE TABLE ${tIssues} (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  uid VARCHAR(36) NOT NULL UNIQUE,
+  tracker_type VARCHAR(64) NOT NULL,
+  tracker_scope_key VARCHAR(255) NOT NULL,
+  tracker_scope TEXT NOT NULL,
+  tracker_issue_id VARCHAR(64) NOT NULL,
+  state VARCHAR(16) NOT NULL DEFAULT 'created',
+  title VARCHAR(512) NOT NULL DEFAULT '',
+  created_at VARCHAR(40) NOT NULL,
+  updated_at VARCHAR(40) NOT NULL,
+  UNIQUE (tracker_type, tracker_scope_key, tracker_issue_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`,
+      oldCols:
+        "id, tracker_type, tracker_scope_key, tracker_scope, tracker_issue_id, state, title, created_at, updated_at",
+      newCols:
+        "uid, tracker_type, tracker_scope_key, tracker_scope, tracker_issue_id, state, title, created_at, updated_at",
+    },
+    {
+      table: tSessions,
+      sqliteCreate: `CREATE TABLE ${tSessions} (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
+  issue_id TEXT NOT NULL REFERENCES ${tIssues}(uid) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'idle',
+  opencode_session_id TEXT,
+  opencode_pid INTEGER,
+  workdir TEXT,
+  created_at TEXT NOT NULL,
+  started_at INTEGER,
+  progress_comment_id TEXT,
+  reaction_comment_id TEXT,
+  current_prompt TEXT,
+  UNIQUE(issue_id, name)
+)`,
+      mysqlCreate: `CREATE TABLE ${tSessions} (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  uid VARCHAR(36) NOT NULL UNIQUE,
+  issue_id VARCHAR(36) NOT NULL,
+  name VARCHAR(64) NOT NULL,
+  state VARCHAR(16) NOT NULL DEFAULT 'idle',
+  opencode_session_id VARCHAR(64),
+  opencode_pid BIGINT,
+  workdir VARCHAR(1024),
+  created_at VARCHAR(40) NOT NULL,
+  started_at BIGINT,
+  progress_comment_id VARCHAR(64),
+  reaction_comment_id VARCHAR(64),
+  current_prompt TEXT,
+  UNIQUE (issue_id, name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`,
+      oldCols:
+        "id, issue_id, name, state, opencode_session_id, opencode_pid, workdir, created_at, started_at, progress_comment_id, reaction_comment_id, current_prompt",
+      newCols:
+        "uid, issue_id, name, state, opencode_session_id, opencode_pid, workdir, created_at, started_at, progress_comment_id, reaction_comment_id, current_prompt",
+    },
+    {
+      table: tMessages,
+      sqliteCreate: `CREATE TABLE ${tMessages} (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
+  session_id TEXT NOT NULL REFERENCES ${tSessions}(uid) ON DELETE CASCADE,
+  content TEXT NOT NULL,
+  source_comment_id TEXT,
+  reaction_comment_id TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  error TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+      mysqlCreate: `CREATE TABLE ${tMessages} (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  uid VARCHAR(36) NOT NULL UNIQUE,
+  session_id VARCHAR(36) NOT NULL,
+  content LONGTEXT NOT NULL,
+  source_comment_id VARCHAR(64),
+  reaction_comment_id VARCHAR(64),
+  status VARCHAR(16) NOT NULL DEFAULT 'pending',
+  attempts INT NOT NULL DEFAULT 0,
+  error TEXT,
+  created_at VARCHAR(40) NOT NULL,
+  updated_at VARCHAR(40) NOT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`,
+      oldCols:
+        "id, session_id, content, source_comment_id, reaction_comment_id, status, attempts, error, created_at, updated_at",
+      newCols:
+        "uid, session_id, content, source_comment_id, reaction_comment_id, status, attempts, error, created_at, updated_at",
+    },
+  ];
+
+  for (const { table, sqliteCreate, mysqlCreate, oldCols, newCols } of UID_REBUILDS) {
+    if (await hasColumn(table, "uid")) continue;
+    if (sqlite) {
+      const exists = await db.get<{ cnt: number }>(
+        `SELECT COUNT(*) AS cnt FROM sqlite_master WHERE type='table' AND name='${table}'`
+      );
+      if (Number(exists?.cnt ?? 0) === 0) continue;
+      await db.exec("PRAGMA foreign_keys = OFF");
+      try {
+        await db.transaction(async () => {
+          await db.exec(`ALTER TABLE ${table} RENAME TO ${table}__old_id`);
+          await db.exec(sqliteCreate);
+          await db.exec(`INSERT INTO ${table} (${newCols}) SELECT ${oldCols} FROM ${table}__old_id`);
+          await db.exec(`DROP TABLE ${table}__old_id`);
+        });
+      } finally {
+        await db.exec("PRAGMA foreign_keys = ON");
+      }
+    } else {
+      try {
+        await db.exec("SET FOREIGN_KEY_CHECKS = 0");
+        await db.transaction(async () => {
+          await db.exec(`ALTER TABLE ${table} RENAME TO ${table}__old_id`);
+          await db.exec(mysqlCreate);
+          await db.exec(`INSERT INTO ${table} (${newCols}) SELECT ${oldCols} FROM ${table}__old_id`);
+          await db.exec(`DROP TABLE ${table}__old_id`);
+        });
+      } finally {
+        await db.exec("SET FOREIGN_KEY_CHECKS = 1");
+      }
+    }
+  }
+
   // issues.owner_daemon_id — points at the leasing daemon (nullable = unclaimed).
   await ensureColumn(
     tIssues,

package/src/op.ts

@@ -5,7 +5,7 @@ import type { TrackerRef, Issue, IssueState, OpSession, SessionState, Message }
 // ─── Row Types ───
 
 interface IssueRow {
-  id: string;
+  uid: string;
   tracker_type: string;
   tracker_scope_key: string;
   tracker_scope: string;
@@ -18,7 +18,7 @@ interface IssueRow {
 }
 
 interface SessionRow {
-  id: string;
+  uid: string;
   issue_id: string;
   name: string;
   state: string;
@@ -37,7 +37,7 @@ interface SessionRow {
 }
 
 interface MessageRow {
-  id: string;
+  uid: string;
   session_id: string;
   content: string;
   source_comment_id: string | null;
@@ -55,7 +55,7 @@ function rowToIssue(row: IssueRow): Issue {
   let scope: Record<string, string>;
   try { scope = JSON.parse(row.tracker_scope); } catch { scope = {}; }
   return {
-    id: row.id,
+    id: row.uid,
     trackerType: row.tracker_type,
     trackerScope: scope,
     trackerScopeKey: row.tracker_scope_key,
@@ -70,7 +70,7 @@ function rowToIssue(row: IssueRow): Issue {
 
 function rowToSession(row: SessionRow): OpSession {
   return {
-    id: row.id,
+    id: row.uid,
     issueId: row.issue_id,
     name: row.name,
     state: row.state as SessionState,
@@ -91,7 +91,7 @@ function rowToSession(row: SessionRow): OpSession {
 
 function rowToMessage(row: MessageRow): Message {
   return {
-    id: row.id,
+    id: row.uid,
     sessionId: row.session_id,
     content: row.content,
     sourceCommentId: row.source_comment_id ?? undefined,
@@ -121,7 +121,7 @@ export class Store {
   // ─── Issues ───
 
   async getIssue(id: string): Promise<Issue | undefined> {
-    const row = await getDB().get<IssueRow>("SELECT * FROM {{issues}} WHERE id = ?", [id]);
+    const row = await getDB().get<IssueRow>("SELECT * FROM {{issues}} WHERE uid = ?", [id]);
     return row ? rowToIssue(row) : undefined;
   }
 
@@ -137,7 +137,7 @@ export class Store {
     const existing = await this.findIssue(ref.trackerType, scopeKey, ref.issueId);
     if (existing) {
       if (title && existing.title !== title) {
-        await getDB().run("UPDATE {{issues}} SET title = ?, updated_at = ? WHERE id = ?", [
+        await getDB().run("UPDATE {{issues}} SET title = ?, updated_at = ? WHERE uid = ?", [
           title,
           new Date().toISOString(),
           existing.id,
@@ -150,7 +150,7 @@ export class Store {
     const now = new Date();
     const id = crypto.randomUUID();
     await getDB().run(
-      "INSERT OR IGNORE INTO {{issues}} (id, tracker_type, tracker_scope_key, tracker_scope, tracker_issue_id, state, title, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "INSERT OR IGNORE INTO {{issues}} (uid, tracker_type, tracker_scope_key, tracker_scope, tracker_issue_id, state, title, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
       [id, ref.trackerType, scopeKey, JSON.stringify(ref.scope), ref.issueId, "created", title, now.toISOString(), now.toISOString()]
     );
 
@@ -166,7 +166,7 @@ export class Store {
   }
 
   async updateIssueState(id: string, state: IssueState): Promise<void> {
-    await getDB().run("UPDATE {{issues}} SET state = ?, updated_at = ? WHERE id = ?", [
+    await getDB().run("UPDATE {{issues}} SET state = ?, updated_at = ? WHERE uid = ?", [
       state,
       new Date().toISOString(),
       id,
@@ -186,7 +186,7 @@ export class Store {
   // ─── OpSessions ───
 
   async getSession(id: string): Promise<OpSession | undefined> {
-    const row = await getDB().get<SessionRow>("SELECT * FROM {{op_sessions}} WHERE id = ?", [id]);
+    const row = await getDB().get<SessionRow>("SELECT * FROM {{op_sessions}} WHERE uid = ?", [id]);
     return row ? rowToSession(row) : undefined;
   }
 
@@ -218,14 +218,14 @@ export class Store {
       createdAt: new Date(),
     };
     await getDB().run(
-      "INSERT OR IGNORE INTO {{op_sessions}} (id, issue_id, name, state, opencode_session_id, opencode_pid, workdir, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+      "INSERT OR IGNORE INTO {{op_sessions}} (uid, issue_id, name, state, opencode_session_id, opencode_pid, workdir, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
       [session.id, session.issueId, session.name, session.state, null, null, null, session.createdAt.toISOString()]
     );
     return session;
   }
 
   async updateSession(id: string, patch: Partial<OpSession>): Promise<OpSession | undefined> {
-    const row = await getDB().get<SessionRow>("SELECT * FROM {{op_sessions}} WHERE id = ?", [id]);
+    const row = await getDB().get<SessionRow>("SELECT * FROM {{op_sessions}} WHERE uid = ?", [id]);
     if (!row) return undefined;
     const existing = rowToSession(row);
     const updated = { ...existing, ...patch };
@@ -233,7 +233,7 @@ export class Store {
     await getDB().run(
       `UPDATE {{op_sessions}} SET state = ?, opencode_session_id = ?, opencode_pid = ?, workdir = ?,
        started_at = ?, progress_comment_id = ?, reaction_comment_id = ?, current_prompt = ?,
-       last_output_at = ?, nudge_rounds = ?, stuck_nudge_rounds = ?, generation = ? WHERE id = ?`,
+       last_output_at = ?, nudge_rounds = ?, stuck_nudge_rounds = ?, generation = ? WHERE uid = ?`,
       [
         updated.state,
         updated.opencodeSessionId ?? null,
@@ -275,7 +275,7 @@ export class Store {
     const now = new Date().toISOString();
     const id = crypto.randomUUID();
     await getDB().run(
-      "INSERT OR IGNORE INTO {{messages}} (id, session_id, content, source_comment_id, reaction_comment_id, status, attempts, error, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "INSERT OR IGNORE INTO {{messages}} (uid, session_id, content, source_comment_id, reaction_comment_id, status, attempts, error, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
       [id, sessionId, content, sourceCommentId ?? null, reactionCommentId ?? null, "pending", 0, null, now, now]
     );
     return {
@@ -287,7 +287,7 @@ export class Store {
   }
 
   async getMessage(id: string): Promise<Message | undefined> {
-    const row = await getDB().get<MessageRow>("SELECT * FROM {{messages}} WHERE id = ?", [id]);
+    const row = await getDB().get<MessageRow>("SELECT * FROM {{messages}} WHERE uid = ?", [id]);
     return row ? rowToMessage(row) : undefined;
   }
 
@@ -300,10 +300,10 @@ export class Store {
   }
 
   async updateMessageStatus(id: string, status: Message["status"], error?: string): Promise<void> {
-    const row = await getDB().get<MessageRow>("SELECT * FROM {{messages}} WHERE id = ?", [id]);
+    const row = await getDB().get<MessageRow>("SELECT * FROM {{messages}} WHERE uid = ?", [id]);
     const attempts = row ? row.attempts + (status === "failed" ? 1 : 0) : 0;
     await getDB().run(
-      "UPDATE {{messages}} SET status = ?, attempts = ?, error = ?, updated_at = ? WHERE id = ?",
+      "UPDATE {{messages}} SET status = ?, attempts = ?, error = ?, updated_at = ? WHERE uid = ?",
       [status, attempts, error ?? null, new Date().toISOString(), id]
     );
   }
@@ -436,7 +436,7 @@ export class Store {
    */
   async claimIssue(issueId: string, daemonId: number): Promise<boolean> {
     const res = await getDB().run(
-      "UPDATE {{issues}} SET owner_daemon_id = ? WHERE id = ? AND owner_daemon_id IS NULL",
+      "UPDATE {{issues}} SET owner_daemon_id = ? WHERE uid = ? AND owner_daemon_id IS NULL",
       [daemonId, issueId]
     );
     return res.changes === 1;
@@ -454,7 +454,7 @@ export class Store {
   /** Atomic message claim: pending → running. False = lost or already done. */
   async claimMessage(messageId: string): Promise<boolean> {
     const res = await getDB().run(
-      "UPDATE {{messages}} SET status = 'running', updated_at = ? WHERE id = ? AND status = 'pending'",
+      "UPDATE {{messages}} SET status = 'running', updated_at = ? WHERE uid = ? AND status = 'pending'",
       [new Date().toISOString(), messageId]
     );
     return res.changes === 1;
@@ -471,7 +471,7 @@ export class Store {
   async listOwnedSessions(daemonId: number): Promise<OpSession[]> {
     const rows = await getDB().all<SessionRow>(
       `SELECT s.* FROM {{op_sessions}} s
-       INNER JOIN {{issues}} i ON i.id = s.issue_id
+       INNER JOIN {{issues}} i ON i.uid = s.issue_id
        WHERE i.owner_daemon_id = ?
        ORDER BY s.created_at`,
       [daemonId]
@@ -483,8 +483,8 @@ export class Store {
   async getOwnedPendingOrRunningMessages(daemonId: number): Promise<Message[]> {
     const rows = await getDB().all<MessageRow>(
       `SELECT m.* FROM {{messages}} m
-       INNER JOIN {{op_sessions}} s ON s.id = m.session_id
-       INNER JOIN {{issues}} i ON i.id = s.issue_id
+       INNER JOIN {{op_sessions}} s ON s.uid = m.session_id
+       INNER JOIN {{issues}} i ON i.uid = s.issue_id
        WHERE i.owner_daemon_id = ? AND m.status IN ('pending', 'running')
        ORDER BY m.created_at ASC`,
       [daemonId]

package/src/opencode.ts

@@ -63,8 +63,9 @@ export function resolveTemplatedWorkdir(
  *  hung scripts. Failures are logged and swallowed — never throws — so a broken
  *  init/destroy never blocks the opencode task flow. */
 const HOOK_SCRIPT_TIMEOUT_MS = 60_000;
-export async function runHookScript(script: string | undefined, workdir: string, label: string, env: Record<string, string> = {}): Promise<void> {
+export async function runHookScript(script: string | undefined, workdir: string, label: string, env: Record<string, string> = {}, timeoutMs?: number): Promise<void> {
   if (!script || !script.trim()) return;
+  const effectiveTimeout = timeoutMs ?? HOOK_SCRIPT_TIMEOUT_MS;
   try {
     mkdirSync(workdir, { recursive: true });
     const proc = Bun.spawn({
@@ -74,7 +75,7 @@ export async function runHookScript(script: string | undefined, workdir: string,
       stderr: "pipe",
       env: { ...process.env, ...env },
     });
-    const timer = setTimeout(() => { try { proc.kill("SIGKILL"); } catch { /* already dead */ } }, HOOK_SCRIPT_TIMEOUT_MS);
+    const timer = setTimeout(() => { try { proc.kill("SIGKILL"); } catch { /* already dead */ } }, effectiveTimeout);
     try {
       const exitCode = await proc.exited;
       const stderr = await new Response(proc.stderr).text().catch(() => "");

package/src/schema-mysql.sql

@@ -8,7 +8,8 @@
 -- tables InnoDB + utf8mb4 for FK CASCADE + full Unicode (emoji).
 
 CREATE TABLE IF NOT EXISTS {{issues}} (
-  id                  VARCHAR(36) PRIMARY KEY,
+  id                  BIGINT       AUTO_INCREMENT PRIMARY KEY,
+  uid                 VARCHAR(36)  NOT NULL UNIQUE,
   tracker_type        VARCHAR(64)  NOT NULL,
   tracker_scope_key   VARCHAR(255) NOT NULL,
   tracker_scope       TEXT         NOT NULL,
@@ -21,7 +22,8 @@ CREATE TABLE IF NOT EXISTS {{issues}} (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 
 CREATE TABLE IF NOT EXISTS {{op_sessions}} (
-  id                  VARCHAR(36) PRIMARY KEY,
+  id                  BIGINT       AUTO_INCREMENT PRIMARY KEY,
+  uid                 VARCHAR(36)  NOT NULL UNIQUE,
   issue_id            VARCHAR(36) NOT NULL,
   name                VARCHAR(64)  NOT NULL,
   state               VARCHAR(16)  NOT NULL DEFAULT 'idle',
@@ -34,14 +36,15 @@ CREATE TABLE IF NOT EXISTS {{op_sessions}} (
   reaction_comment_id VARCHAR(64),
   current_prompt      TEXT,
   UNIQUE (issue_id, name),
-  CONSTRAINT {{fk_sessions_issue}} FOREIGN KEY (issue_id) REFERENCES {{issues}}(id) ON DELETE CASCADE
+  CONSTRAINT {{fk_sessions_issue}} FOREIGN KEY (issue_id) REFERENCES {{issues}}(uid) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 -- UNIQUE(issue_id, name) above creates a composite index whose leftmost
 -- prefix (issue_id) satisfies the FK's index requirement, so no separate
 -- idx_sessions_issue is needed on MySQL.
 
 CREATE TABLE IF NOT EXISTS {{messages}} (
-  id                  VARCHAR(36) PRIMARY KEY,
+  id                  BIGINT       AUTO_INCREMENT PRIMARY KEY,
+  uid                 VARCHAR(36)  NOT NULL UNIQUE,
   session_id          VARCHAR(36) NOT NULL,
   content             LONGTEXT    NOT NULL,
   source_comment_id   VARCHAR(64),
@@ -51,7 +54,7 @@ CREATE TABLE IF NOT EXISTS {{messages}} (
   error               TEXT,
   created_at          VARCHAR(40) NOT NULL,
   updated_at          VARCHAR(40) NOT NULL,
-  CONSTRAINT {{fk_messages_session}} FOREIGN KEY (session_id) REFERENCES {{op_sessions}}(id) ON DELETE CASCADE
+  CONSTRAINT {{fk_messages_session}} FOREIGN KEY (session_id) REFERENCES {{op_sessions}}(uid) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 CREATE INDEX idx_messages_session ON {{messages}} (session_id);
 CREATE INDEX idx_messages_status ON {{messages}} (status);

package/src/schema-sqlite.sql

@@ -4,7 +4,8 @@
 -- share one DB across multiple daemon instances.
 
 CREATE TABLE IF NOT EXISTS {{issues}} (
-  id TEXT PRIMARY KEY,
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
   tracker_type TEXT NOT NULL,
   tracker_scope_key TEXT NOT NULL,
   tracker_scope TEXT NOT NULL,
@@ -17,8 +18,9 @@ CREATE TABLE IF NOT EXISTS {{issues}} (
 );
 
 CREATE TABLE IF NOT EXISTS {{op_sessions}} (
-  id TEXT PRIMARY KEY,
-  issue_id TEXT NOT NULL REFERENCES {{issues}}(id) ON DELETE CASCADE,
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
+  issue_id TEXT NOT NULL REFERENCES {{issues}}(uid) ON DELETE CASCADE,
   name TEXT NOT NULL,
   state TEXT NOT NULL DEFAULT 'idle',
   opencode_session_id TEXT,
@@ -33,8 +35,9 @@ CREATE TABLE IF NOT EXISTS {{op_sessions}} (
 );
 
 CREATE TABLE IF NOT EXISTS {{messages}} (
-  id TEXT PRIMARY KEY,
-  session_id TEXT NOT NULL REFERENCES {{op_sessions}}(id) ON DELETE CASCADE,
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uid TEXT NOT NULL UNIQUE,
+  session_id TEXT NOT NULL REFERENCES {{op_sessions}}(uid) ON DELETE CASCADE,
   content TEXT NOT NULL,
   source_comment_id TEXT,
   reaction_comment_id TEXT,

package/src/server.ts

@@ -11,10 +11,17 @@ type TrackerMap = Map<string, IssueTracker>;
 
 export function parseGroupConfigHeader(raw: string | null): GroupConfig | undefined {
   if (!raw) return undefined;
+  if (raw.length > 16_384) return undefined;
   try {
     const decoded = Buffer.from(raw, "base64").toString("utf8");
     const parsed = JSON.parse(decoded);
-    if (typeof parsed === "object" && parsed !== null) return parsed as GroupConfig;
+    if (typeof parsed !== "object" || parsed === null) return undefined;
+    const gc = parsed as Record<string, unknown>;
+    if (gc.workdirTemplate !== undefined && typeof gc.workdirTemplate !== "string") return undefined;
+    if (gc.initScript !== undefined && typeof gc.initScript !== "string") return undefined;
+    if (gc.destroyScript !== undefined && typeof gc.destroyScript !== "string") return undefined;
+    if (gc.envInitScript !== undefined && typeof gc.envInitScript !== "string") return undefined;
+    return gc as GroupConfig;
   } catch {
   }
   return undefined;