forge-openclaw-plugin 0.2.19 → 0.2.21

package/dist/server/repositories/calendar.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { getDatabase, runInTransaction } from "../db.js";
 import { recordActivityEvent } from "./activity-events.js";
+import { decorateOwnedEntity, filterOwnedEntities, inferFirstOwnedUserId, setEntityOwner } from "./entity-ownership.js";
 import { getProjectById } from "./projects.js";
 import { getTaskById } from "./tasks.js";
 import { calendarConnectionSchema, calendarContextConflictSchema, calendarEventSchema, calendarEventLinkSchema, calendarEventSourceSchema, calendarOverviewPayloadSchema, calendarSchema, calendarSchedulingRulesSchema, taskTimeboxSchema, workBlockInstanceSchema, workBlockTemplateSchema } from "../types.js";
@@ -130,6 +131,15 @@ function mapEvent(row) {
         title: row.title,
         description: row.description,
         location: row.location,
+        place: {
+            label: row.place_label,
+            address: row.place_address,
+            timezone: row.place_timezone,
+            latitude: row.place_latitude,
+            longitude: row.place_longitude,
+            source: row.place_source,
+            externalPlaceId: row.place_external_id
+        },
         startAt: row.start_at,
         endAt: row.end_at,
         timezone: normalizeTimezone(row.timezone),
@@ -181,6 +191,20 @@ function mapTimebox(row) {
         updatedAt: row.updated_at
     });
 }
+function inferCalendarEventOwnerId(input) {
+    return (input.userId ??
+        inferFirstOwnedUserId((input.links ?? []).map((link) => ({
+            entityType: link.entityType,
+            entityId: link.entityId
+        }))));
+}
+function inferTaskTimeboxOwnerId(input) {
+    return (input.userId ??
+        inferFirstOwnedUserId([
+            { entityType: "task", entityId: input.taskId },
+            { entityType: "project", entityId: input.projectId ?? null }
+        ]));
+}
 function addMinutes(date, minutes) {
     return new Date(date.getTime() + minutes * 60 * 1000);
 }
@@ -385,25 +409,28 @@ export function listCalendarEvents(query) {
     params.push(query.to);
     const rows = getDatabase()
         .prepare(`SELECT id, preferred_connection_id, preferred_calendar_id, ownership, origin_type, status, title, description, location,
+              place_label, place_address, place_timezone, place_latitude, place_longitude, place_source, place_external_id,
               start_at, end_at, timezone, is_all_day, availability, event_type, categories_json, deleted_at, created_at, updated_at
        FROM forge_events
        WHERE ${clauses.join(" AND ")}
        ORDER BY start_at ASC, title ASC`)
         .all(...params);
-    return rows.map(mapEvent);
+    return filterOwnedEntities("calendar_event", rows.map(mapEvent), query.userIds);
 }
 export function getCalendarEventById(eventId) {
     const row = getDatabase()
         .prepare(`SELECT id, preferred_connection_id, preferred_calendar_id, ownership, origin_type, status, title, description, location,
+              place_label, place_address, place_timezone, place_latitude, place_longitude, place_source, place_external_id,
               start_at, end_at, timezone, is_all_day, availability, event_type, categories_json, deleted_at, created_at, updated_at
        FROM forge_events
        WHERE id = ?`)
         .get(eventId);
-    return row ? mapEvent(row) : undefined;
+    return row ? decorateOwnedEntity("calendar_event", mapEvent(row)) : undefined;
 }
 export function getCalendarEventStorageRecord(eventId) {
     return getDatabase()
         .prepare(`SELECT id, preferred_connection_id, preferred_calendar_id, ownership, origin_type, status, title, description, location,
+              place_label, place_address, place_timezone, place_latitude, place_longitude, place_source, place_external_id,
               start_at, end_at, timezone, is_all_day, availability, event_type, categories_json, deleted_at, created_at, updated_at
        FROM forge_events
        WHERE id = ?`)
@@ -413,6 +440,8 @@ export function getCalendarEventByRemoteId(connectionId, calendarId, remoteId) {
     const row = getDatabase()
         .prepare(`SELECT forge_events.id, forge_events.preferred_connection_id, forge_events.preferred_calendar_id, forge_events.ownership,
               forge_events.origin_type, forge_events.status, forge_events.title, forge_events.description, forge_events.location,
+              forge_events.place_label, forge_events.place_address, forge_events.place_timezone, forge_events.place_latitude,
+              forge_events.place_longitude, forge_events.place_source, forge_events.place_external_id,
               forge_events.start_at, forge_events.end_at, forge_events.timezone, forge_events.is_all_day, forge_events.availability,
               forge_events.event_type, forge_events.categories_json, forge_events.deleted_at, forge_events.created_at, forge_events.updated_at
        FROM forge_event_sources
@@ -489,9 +518,10 @@ export function upsertCalendarEventRecord(connectionId, input) {
         getDatabase()
             .prepare(`UPDATE forge_events
          SET preferred_connection_id = ?, preferred_calendar_id = ?, ownership = ?, origin_type = ?, status = ?, title = ?, description = ?, location = ?,
+             place_label = ?, place_address = ?, place_timezone = ?, place_latitude = ?, place_longitude = ?, place_source = ?, place_external_id = ?,
              start_at = ?, end_at = ?, timezone = ?, is_all_day = ?, availability = ?, event_type = ?, categories_json = ?, deleted_at = ?, updated_at = ?
          WHERE id = ?`)
-            .run(connectionId, calendar.id, input.ownership ?? existing.ownership, connection.provider, input.status ?? existing.status, input.title, input.description ?? "", input.location ?? "", input.startAt, input.endAt, calendar.timezone, input.isAllDay ? 1 : 0, input.availability ?? existing.availability, input.eventType ?? "", JSON.stringify(input.categories ?? []), input.deletedAt ?? null, now, existing.id);
+            .run(connectionId, calendar.id, input.ownership ?? existing.ownership, connection.provider, input.status ?? existing.status, input.title, input.description ?? "", input.location ?? "", input.location ?? "", "", "", null, null, "", "", input.startAt, input.endAt, calendar.timezone, input.isAllDay ? 1 : 0, input.availability ?? existing.availability, input.eventType ?? "", JSON.stringify(input.categories ?? []), input.deletedAt ?? null, now, existing.id);
         upsertEventSource({
             forgeEventId: existing.id,
             provider: connection.provider,
@@ -516,10 +546,11 @@ export function upsertCalendarEventRecord(connectionId, input) {
     getDatabase()
         .prepare(`INSERT INTO forge_events (
          id, preferred_connection_id, preferred_calendar_id, ownership, origin_type, status, title, description, location,
+         place_label, place_address, place_timezone, place_latitude, place_longitude, place_source, place_external_id,
          start_at, end_at, timezone, is_all_day, availability, event_type, categories_json, deleted_at, created_at, updated_at
        )
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(id, connectionId, calendar.id, input.ownership ?? "external", connection.provider, input.status ?? "confirmed", input.title, input.description ?? "", input.location ?? "", input.startAt, input.endAt, calendar.timezone, input.isAllDay ? 1 : 0, input.availability ?? "busy", input.eventType ?? "", JSON.stringify(input.categories ?? []), input.deletedAt ?? null, now, now);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(id, connectionId, calendar.id, input.ownership ?? "external", connection.provider, input.status ?? "confirmed", input.title, input.description ?? "", input.location ?? "", input.location ?? "", "", "", null, null, "", "", input.startAt, input.endAt, calendar.timezone, input.isAllDay ? 1 : 0, input.availability ?? "busy", input.eventType ?? "", JSON.stringify(input.categories ?? []), input.deletedAt ?? null, now, now);
     upsertEventSource({
         forgeEventId: id,
         provider: connection.provider,
@@ -543,6 +574,15 @@ export function upsertCalendarEventRecord(connectionId, input) {
 export function createCalendarEvent(input) {
     const now = nowIso();
     const id = `calevent_${randomUUID().replaceAll("-", "").slice(0, 10)}`;
+    const place = input.place ?? {
+        label: "",
+        address: "",
+        timezone: "",
+        latitude: null,
+        longitude: null,
+        source: "",
+        externalPlaceId: ""
+    };
     const preferredCalendar = input.preferredCalendarId === undefined
         ? getDefaultWritableCalendar() ?? null
         : input.preferredCalendarId
@@ -551,11 +591,13 @@ export function createCalendarEvent(input) {
     getDatabase()
         .prepare(`INSERT INTO forge_events (
          id, preferred_connection_id, preferred_calendar_id, ownership, origin_type, status, title, description, location,
+         place_label, place_address, place_timezone, place_latitude, place_longitude, place_source, place_external_id,
          start_at, end_at, timezone, is_all_day, availability, event_type, categories_json, created_at, updated_at
        )
-       VALUES (?, ?, ?, 'forge', 'native', 'confirmed', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(id, preferredCalendar?.connectionId ?? null, preferredCalendar?.id ?? null, input.title, input.description, input.location, input.startAt, input.endAt, normalizeTimezone(input.timezone), input.isAllDay ? 1 : 0, input.availability, input.eventType, JSON.stringify(input.categories), now, now);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(id, preferredCalendar?.connectionId ?? null, preferredCalendar?.id ?? null, "forge", "native", "confirmed", input.title, input.description, input.location, place.label || input.location, place.address, place.timezone, place.latitude, place.longitude, place.source, place.externalPlaceId, input.startAt, input.endAt, normalizeTimezone(input.timezone), input.isAllDay ? 1 : 0, input.availability, input.eventType, JSON.stringify(input.categories), now, now);
     replaceEventLinks(id, input.links);
+    setEntityOwner("calendar_event", id, inferCalendarEventOwnerId(input));
     return getCalendarEventById(id);
 }
 export function updateCalendarEvent(eventId, patch) {
@@ -578,6 +620,19 @@ export function updateCalendarEvent(eventId, patch) {
         title: patch.title ?? current.title,
         description: patch.description ?? current.description,
         location: patch.location ?? current.location,
+        place: {
+            label: patch.place?.label ?? current.place.label,
+            address: patch.place?.address ?? current.place.address,
+            timezone: patch.place?.timezone ?? current.place.timezone,
+            latitude: patch.place?.latitude === undefined
+                ? current.place.latitude
+                : patch.place.latitude,
+            longitude: patch.place?.longitude === undefined
+                ? current.place.longitude
+                : patch.place.longitude,
+            source: patch.place?.source ?? current.place.source,
+            externalPlaceId: patch.place?.externalPlaceId ?? current.place.externalPlaceId
+        },
         startAt: patch.startAt ?? current.startAt,
         endAt: patch.endAt ?? current.endAt,
         timezone: normalizeTimezone(patch.timezone ?? current.timezone),
@@ -590,12 +645,21 @@ export function updateCalendarEvent(eventId, patch) {
     getDatabase()
         .prepare(`UPDATE forge_events
        SET preferred_connection_id = ?, preferred_calendar_id = ?, title = ?, description = ?, location = ?,
+           place_label = ?, place_address = ?, place_timezone = ?, place_latitude = ?, place_longitude = ?, place_source = ?, place_external_id = ?,
            start_at = ?, end_at = ?, timezone = ?, is_all_day = ?, availability = ?, event_type = ?, categories_json = ?, updated_at = ?
        WHERE id = ?`)
-        .run(next.preferredConnectionId, next.preferredCalendarId, next.title, next.description, next.location, next.startAt, next.endAt, next.timezone, next.isAllDay ? 1 : 0, next.availability, next.eventType, JSON.stringify(next.categories), next.updatedAt, eventId);
+        .run(next.preferredConnectionId, next.preferredCalendarId, next.title, next.description, next.location, next.place.label, next.place.address, next.place.timezone, next.place.latitude, next.place.longitude, next.place.source, next.place.externalPlaceId, next.startAt, next.endAt, next.timezone, next.isAllDay ? 1 : 0, next.availability, next.eventType, JSON.stringify(next.categories), next.updatedAt, eventId);
     if (patch.links) {
         replaceEventLinks(eventId, patch.links);
     }
+    if (patch.userId !== undefined || patch.links !== undefined) {
+        setEntityOwner("calendar_event", eventId, patch.userId === undefined
+            ? inferCalendarEventOwnerId({
+                userId: current.userId ?? null,
+                links: patch.links ?? current.links
+            })
+            : patch.userId);
+    }
     if (current.sourceMappings.length > 0) {
         const nextSyncState = current.deletedAt !== null ? "deleted" : current.originType === "native" ? "pending_update" : "synced";
         getDatabase()
@@ -635,16 +699,17 @@ export function createWorkBlockTemplate(input) {
          )
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(id, input.title, input.kind, input.color, normalizeTimezone(input.timezone), JSON.stringify(input.weekDays), input.startMinute, input.endMinute, input.startsOn ?? null, input.endsOn ?? null, input.blockingState, now, now);
+        setEntityOwner("work_block_template", id, input.userId);
         return getWorkBlockTemplateById(id);
     });
 }
-export function listWorkBlockTemplates() {
+export function listWorkBlockTemplates(filters = {}) {
     const rows = getDatabase()
         .prepare(`SELECT id, title, kind, color, timezone, weekdays_json, start_minute, end_minute, starts_on, ends_on, blocking_state, created_at, updated_at
        FROM work_block_templates
        ORDER BY COALESCE(starts_on, ''), start_minute ASC, title ASC`)
         .all();
-    return rows.map(mapWorkBlockTemplate);
+    return filterOwnedEntities("work_block_template", rows.map(mapWorkBlockTemplate), filters.userIds);
 }
 export function getWorkBlockTemplateById(templateId) {
     const row = getDatabase()
@@ -652,7 +717,9 @@ export function getWorkBlockTemplateById(templateId) {
        FROM work_block_templates
        WHERE id = ?`)
         .get(templateId);
-    return row ? mapWorkBlockTemplate(row) : undefined;
+    return row
+        ? decorateOwnedEntity("work_block_template", mapWorkBlockTemplate(row))
+        : undefined;
 }
 export function updateWorkBlockTemplate(templateId, patch) {
     const current = getWorkBlockTemplateById(templateId);
@@ -677,6 +744,9 @@ export function updateWorkBlockTemplate(templateId, patch) {
        SET title = ?, kind = ?, color = ?, timezone = ?, weekdays_json = ?, start_minute = ?, end_minute = ?, starts_on = ?, ends_on = ?, blocking_state = ?, updated_at = ?
        WHERE id = ?`)
         .run(next.title, next.kind, next.color, next.timezone, JSON.stringify(next.weekDays), next.startMinute, next.endMinute, next.startsOn, next.endsOn, next.blockingState, next.updatedAt, templateId);
+    if (patch.userId !== undefined) {
+        setEntityOwner("work_block_template", templateId, patch.userId);
+    }
     return getWorkBlockTemplateById(templateId);
 }
 export function deleteWorkBlockTemplate(templateId) {
@@ -730,7 +800,7 @@ export function ensureWorkBlockInstancesInRange(_query) {
     return [];
 }
 export function listWorkBlockInstances(query) {
-    return listWorkBlockTemplates()
+    return listWorkBlockTemplates({ userIds: query.userIds })
         .flatMap((template) => deriveWorkBlockInstances(template, query))
         .sort((left, right) => left.startAt.localeCompare(right.startAt) || left.title.localeCompare(right.title));
 }
@@ -752,7 +822,7 @@ export function listTaskTimeboxes(query) {
        WHERE ${clauses.join(" AND ")}
        ORDER BY starts_at ASC`)
         .all(...params);
-    return rows.map(mapTimebox);
+    return filterOwnedEntities("task_timebox", rows.map(mapTimebox), query.userIds);
 }
 export function getTaskTimeboxById(timeboxId) {
     const row = getDatabase()
@@ -761,7 +831,7 @@ export function getTaskTimeboxById(timeboxId) {
        FROM task_timeboxes
        WHERE id = ?`)
         .get(timeboxId);
-    return row ? mapTimebox(row) : undefined;
+    return row ? decorateOwnedEntity("task_timebox", mapTimebox(row)) : undefined;
 }
 export function createTaskTimebox(input) {
     const now = nowIso();
@@ -772,6 +842,7 @@ export function createTaskTimebox(input) {
        )
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
         .run(id, input.taskId, input.projectId ?? null, input.connectionId ?? null, input.calendarId ?? null, input.linkedTaskRunId ?? null, input.status ?? "planned", input.source ?? "manual", input.title, input.startsAt, input.endsAt, input.overrideReason ?? null, now, now);
+    setEntityOwner("task_timebox", id, inferTaskTimeboxOwnerId(input));
     return getTaskTimeboxById(id);
 }
 export function updateTaskTimebox(timeboxId, patch) {
@@ -798,6 +869,9 @@ export function updateTaskTimebox(timeboxId, patch) {
            starts_at = ?, ends_at = ?, override_reason = ?, updated_at = ?
        WHERE id = ?`)
         .run(next.connectionId, next.calendarId, next.remoteEventId, next.linkedTaskRunId, next.status, next.source, next.title, next.startsAt, next.endsAt, next.overrideReason, next.updatedAt, timeboxId);
+    if (patch.userId !== undefined) {
+        setEntityOwner("task_timebox", timeboxId, patch.userId);
+    }
     return getTaskTimeboxById(timeboxId);
 }
 export function deleteTaskTimebox(timeboxId) {
@@ -1082,7 +1156,7 @@ export function getCalendarOverview(query) {
         connections: listCalendarConnections().map(({ credentialsSecretId: _secret, ...connection }) => connection),
         calendars: listCalendars(),
         events: listCalendarEvents(query),
-        workBlockTemplates: listWorkBlockTemplates(),
+        workBlockTemplates: listWorkBlockTemplates({ userIds: query.userIds }),
         workBlockInstances: listWorkBlockInstances(query),
         timeboxes: listTaskTimeboxes(query)
     });

package/dist/server/repositories/collaboration.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { getDatabase } from "../db.js";
+import { decorateOwnedEntity, filterOwnedEntities, inferFirstOwnedUserId, setEntityOwner } from "./entity-ownership.js";
 import { filterDeletedEntities, isEntityDeleted } from "./deleted-entities.js";
 import { recordActivityEvent } from "./activity-events.js";
 import { recordEventLog } from "./event-log.js";
@@ -8,7 +9,7 @@ import { createTask } from "./tasks.js";
 import { recordInsightAppliedReward } from "./rewards.js";
 import { agentActionSchema, approvalRequestSchema, createAgentActionSchema, createInsightFeedbackSchema, createInsightSchema, insightFeedbackSchema, insightSchema, updateInsightSchema } from "../types.js";
 function mapInsight(row) {
-    return insightSchema.parse({
+    return insightSchema.parse(decorateOwnedEntity("insight", {
         id: row.id,
         originType: row.origin_type,
         originAgentId: row.origin_agent_id,
@@ -27,7 +28,7 @@ function mapInsight(row) {
         evidence: JSON.parse(row.evidence_json),
         createdAt: row.created_at,
         updatedAt: row.updated_at
-    });
+    }));
 }
 function mapFeedback(row) {
     return insightFeedbackSchema.parse({
@@ -132,7 +133,7 @@ export function listInsights(filters = {}) {
        ORDER BY created_at DESC
        ${limitSql}`)
         .all(...params);
-    return filterDeletedEntities("insight", rows.map(mapInsight));
+    return filterDeletedEntities("insight", filterOwnedEntities("insight", rows.map(mapInsight), filters.userIds));
 }
 export function getInsightById(insightId) {
     if (isEntityDeleted("insight", insightId)) {
@@ -151,6 +152,9 @@ export function createInsight(input, context) {
         title, summary, recommendation, rationale, confidence, cta_label, evidence_json, created_at, updated_at
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
         .run(insightId, parsed.originType, parsed.originAgentId, parsed.originLabel, parsed.visibility, parsed.status, parsed.entityType, parsed.entityId, parsed.timeframeLabel, parsed.title, parsed.summary, parsed.recommendation, parsed.rationale, parsed.confidence, parsed.ctaLabel, JSON.stringify(parsed.evidence), now, now);
+    setEntityOwner("insight", insightId, inferFirstOwnedUserId(parsed.entityType && parsed.entityId
+        ? [{ entityType: parsed.entityType, entityId: parsed.entityId }]
+        : []), context.actor ?? parsed.originLabel ?? null);
     recordActivityEvent({
         entityType: "insight",
         entityId: insightId,
@@ -191,6 +195,7 @@ export function updateInsight(insightId, input, context) {
            recommendation = ?, rationale = ?, confidence = ?, cta_label = ?, evidence_json = ?, updated_at = ?
        WHERE id = ?`)
         .run(parsed.visibility ?? current.visibility, parsed.status ?? current.status, parsed.entityType === undefined ? current.entityType : parsed.entityType, parsed.entityId === undefined ? current.entityId : parsed.entityId, parsed.timeframeLabel === undefined ? current.timeframeLabel : parsed.timeframeLabel, parsed.title ?? current.title, parsed.summary ?? current.summary, parsed.recommendation ?? current.recommendation, parsed.rationale ?? current.rationale, parsed.confidence ?? current.confidence, parsed.ctaLabel ?? current.ctaLabel, JSON.stringify(parsed.evidence ?? current.evidence), updatedAt, insightId);
+    setEntityOwner("insight", insightId, current.userId, context.actor ?? current.originLabel ?? null);
     recordEventLog({
         eventKind: "insight.updated",
         entityType: "insight",

package/dist/server/repositories/diagnostic-logs.js

@@ -0,0 +1,243 @@
+import { randomUUID } from "node:crypto";
+import { Buffer } from "node:buffer";
+import { getDatabase } from "../db.js";
+import { createDiagnosticLogSchema, diagnosticLogEntrySchema } from "../types.js";
+const MAX_LOG_ENTRIES = 5_000;
+export const DIAGNOSTIC_LOG_RETENTION_DAYS = 14;
+export const DIAGNOSTIC_LOG_RETENTION_SWEEP_INTERVAL_MS = 15 * 60 * 1000;
+const MAX_STRING_LENGTH = 4_000;
+const MAX_ARRAY_ITEMS = 24;
+const MAX_OBJECT_KEYS = 40;
+const MAX_DEPTH = 4;
+let nextRetentionSweepAt = 0;
+function nowIso() {
+    return new Date().toISOString();
+}
+function sanitizeDiagnosticValue(value, depth = 0) {
+    if (value === null ||
+        typeof value === "boolean" ||
+        typeof value === "number") {
+        return value;
+    }
+    if (typeof value === "string") {
+        return value.length > MAX_STRING_LENGTH
+            ? `${value.slice(0, MAX_STRING_LENGTH)}…`
+            : value;
+    }
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    if (typeof value === "function" || typeof value === "symbol") {
+        return String(value);
+    }
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: value.message,
+            stack: typeof value.stack === "string"
+                ? sanitizeDiagnosticValue(value.stack, depth + 1)
+                : null
+        };
+    }
+    if (Buffer.isBuffer(value)) {
+        return {
+            type: "Buffer",
+            bytes: value.byteLength
+        };
+    }
+    if (depth >= MAX_DEPTH) {
+        if (Array.isArray(value)) {
+            return `[Array(${value.length})]`;
+        }
+        return "[Object]";
+    }
+    if (Array.isArray(value)) {
+        return value
+            .slice(0, MAX_ARRAY_ITEMS)
+            .map((entry) => sanitizeDiagnosticValue(entry, depth + 1));
+    }
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value).slice(0, MAX_OBJECT_KEYS);
+        return Object.fromEntries(entries.map(([key, entry]) => [
+            key,
+            sanitizeDiagnosticValue(entry, depth + 1)
+        ]));
+    }
+    return String(value);
+}
+function sanitizeDetails(details) {
+    if (!details) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(details).map(([key, value]) => [
+        key,
+        sanitizeDiagnosticValue(value)
+    ]));
+}
+function mapRow(row) {
+    return diagnosticLogEntrySchema.parse({
+        id: row.id,
+        level: row.level,
+        source: row.source,
+        scope: row.scope,
+        eventKey: row.event_key,
+        message: row.message,
+        route: row.route,
+        functionName: row.function_name,
+        requestId: row.request_id,
+        entityType: row.entity_type,
+        entityId: row.entity_id,
+        jobId: row.job_id,
+        details: JSON.parse(row.details_json),
+        createdAt: row.created_at
+    });
+}
+function pruneDiagnosticLogs() {
+    const expiredBefore = new Date(Date.now() - DIAGNOSTIC_LOG_RETENTION_DAYS * 24 * 60 * 60 * 1_000).toISOString();
+    const expiredResult = getDatabase()
+        .prepare(`DELETE FROM diagnostic_logs
+       WHERE created_at < ?`)
+        .run(expiredBefore);
+    const overflowResult = getDatabase().prepare(`DELETE FROM diagnostic_logs
+     WHERE id IN (
+       SELECT id
+       FROM diagnostic_logs
+       ORDER BY created_at DESC
+       LIMIT -1 OFFSET ?
+     )`).run(MAX_LOG_ENTRIES);
+    return (expiredResult.changes ?? 0) + (overflowResult.changes ?? 0);
+}
+function checkpointDiagnosticLogStore() {
+    getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE);");
+}
+export function enforceDiagnosticLogRetention(options = {}) {
+    const now = options.now ?? new Date();
+    const startedAt = now.getTime();
+    if (!options.force && startedAt < nextRetentionSweepAt) {
+        return { prunedCount: 0, ran: false };
+    }
+    nextRetentionSweepAt =
+        startedAt + DIAGNOSTIC_LOG_RETENTION_SWEEP_INTERVAL_MS;
+    const prunedCount = pruneDiagnosticLogs();
+    if (prunedCount > 0) {
+        checkpointDiagnosticLogStore();
+    }
+    return {
+        prunedCount,
+        ran: true
+    };
+}
+export function recordDiagnosticLog(input, now = new Date()) {
+    const parsed = createDiagnosticLogSchema.parse(input);
+    const entry = diagnosticLogEntrySchema.parse({
+        id: `diag_${randomUUID().replaceAll("-", "").slice(0, 10)}`,
+        level: parsed.level,
+        source: parsed.source ?? "server",
+        scope: parsed.scope,
+        eventKey: parsed.eventKey,
+        message: parsed.message,
+        route: parsed.route ?? null,
+        functionName: parsed.functionName ?? null,
+        requestId: parsed.requestId ?? null,
+        entityType: parsed.entityType ?? null,
+        entityId: parsed.entityId ?? null,
+        jobId: parsed.jobId ?? null,
+        details: sanitizeDetails(parsed.details),
+        createdAt: now.toISOString()
+    });
+    getDatabase().prepare(`INSERT INTO diagnostic_logs (
+      id, level, source, scope, event_key, message, route, function_name,
+      request_id, entity_type, entity_id, job_id, details_json, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(entry.id, entry.level, entry.source, entry.scope, entry.eventKey, entry.message, entry.route, entry.functionName, entry.requestId, entry.entityType, entry.entityId, entry.jobId, JSON.stringify(entry.details), entry.createdAt);
+    enforceDiagnosticLogRetention({ now });
+    return entry;
+}
+export function listDiagnosticLogs(filters = {}) {
+    enforceDiagnosticLogRetention();
+    const whereClauses = [];
+    const params = [];
+    if (filters.level) {
+        whereClauses.push("level = ?");
+        params.push(filters.level);
+    }
+    if (filters.source) {
+        whereClauses.push("source = ?");
+        params.push(filters.source);
+    }
+    if (filters.scope) {
+        whereClauses.push("scope = ?");
+        params.push(filters.scope);
+    }
+    if (filters.route) {
+        whereClauses.push("route = ?");
+        params.push(filters.route);
+    }
+    if (filters.entityType) {
+        whereClauses.push("entity_type = ?");
+        params.push(filters.entityType);
+    }
+    if (filters.entityId) {
+        whereClauses.push("entity_id = ?");
+        params.push(filters.entityId);
+    }
+    if (filters.jobId) {
+        whereClauses.push("job_id = ?");
+        params.push(filters.jobId);
+    }
+    if (filters.search) {
+        whereClauses.push("(message LIKE ? OR scope LIKE ? OR event_key LIKE ? OR IFNULL(route, '') LIKE ? OR details_json LIKE ?)");
+        const term = `%${filters.search}%`;
+        params.push(term, term, term, term, term);
+    }
+    if (filters.beforeCreatedAt && filters.beforeId) {
+        whereClauses.push("(created_at < ? OR (created_at = ? AND id < ?))");
+        params.push(filters.beforeCreatedAt, filters.beforeCreatedAt, filters.beforeId);
+    }
+    const whereSql = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
+    const limit = filters.limit ?? 200;
+    const rows = getDatabase()
+        .prepare(`SELECT id, level, source, scope, event_key, message, route, function_name,
+              request_id, entity_type, entity_id, job_id, details_json, created_at
+       FROM diagnostic_logs
+       ${whereSql}
+       ORDER BY created_at DESC, id DESC
+       LIMIT ?`)
+        .all(...params, limit);
+    const logs = rows.map(mapRow);
+    const tail = rows.at(-1) ?? null;
+    return {
+        logs,
+        nextCursor: rows.length >= limit && tail
+            ? {
+                beforeCreatedAt: tail.created_at,
+                beforeId: tail.id
+            }
+            : null
+    };
+}
+export function normalizeDiagnosticSource(value) {
+    return value === "ui" ||
+        value === "openclaw" ||
+        value === "agent" ||
+        value === "system" ||
+        value === "server"
+        ? value
+        : "server";
+}
+export function serializeDiagnosticError(error) {
+    return sanitizeDiagnosticValue(error);
+}
+export function createDiagnosticMessage(input) {
+    const method = input.method?.toUpperCase() || "CALL";
+    const route = input.route || "unknown-route";
+    if (typeof input.statusCode === "number") {
+        return `${method} ${route} -> ${input.statusCode}`;
+    }
+    return `${method} ${route}`;
+}
+export function createDiagnosticTimestamp() {
+    return nowIso();
+}

package/dist/server/repositories/entity-ownership.js

@@ -0,0 +1,92 @@
+import { getDatabase } from "../db.js";
+import { listUsersByIds, resolveUserForMutation } from "./users.js";
+export function setEntityOwner(entityType, entityId, userId, fallbackLabel) {
+    const user = resolveUserForMutation(userId, fallbackLabel);
+    const now = new Date().toISOString();
+    getDatabase()
+        .prepare(`INSERT INTO entity_owners (entity_type, entity_id, user_id, role, created_at, updated_at)
+       VALUES (?, ?, ?, 'owner', ?, ?)
+       ON CONFLICT(entity_type, entity_id)
+       DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`)
+        .run(entityType, entityId, user.id, now, now);
+    return { userId: user.id, user };
+}
+export function clearEntityOwner(entityType, entityId) {
+    getDatabase()
+        .prepare(`DELETE FROM entity_owners WHERE entity_type = ? AND entity_id = ?`)
+        .run(entityType, entityId);
+}
+export function getEntityOwnerId(entityType, entityId) {
+    const row = getDatabase()
+        .prepare(`SELECT user_id
+       FROM entity_owners
+       WHERE entity_type = ? AND entity_id = ?`)
+        .get(entityType, entityId);
+    return row?.user_id ?? null;
+}
+export function getEntityOwner(entityType, entityId) {
+    const userId = getEntityOwnerId(entityType, entityId);
+    return userId ? (listUsersByIds([userId])[0] ?? null) : null;
+}
+export function inferFirstOwnedUserId(candidates) {
+    for (const candidate of candidates) {
+        if (!candidate.entityId) {
+            continue;
+        }
+        const userId = getEntityOwnerId(candidate.entityType, candidate.entityId);
+        if (userId) {
+            return userId;
+        }
+    }
+    return null;
+}
+function listOwnerRows(entityType, entityIds) {
+    if (entityIds.length === 0) {
+        return [];
+    }
+    const placeholders = entityIds.map(() => "?").join(", ");
+    return getDatabase()
+        .prepare(`SELECT entity_id, user_id
+       FROM entity_owners
+       WHERE entity_type = ?
+         AND entity_id IN (${placeholders})`)
+        .all(entityType, ...entityIds);
+}
+export function buildEntityOwnerIndex(entityType, entityIds) {
+    const rows = listOwnerRows(entityType, entityIds);
+    const userIds = Array.from(new Set(rows.map((row) => row.user_id)));
+    const usersById = new Map(listUsersByIds(userIds).map((user) => [user.id, user]));
+    const index = new Map();
+    for (const entityId of entityIds) {
+        index.set(entityId, { userId: null, user: null });
+    }
+    for (const row of rows) {
+        index.set(row.entity_id, {
+            userId: row.user_id,
+            user: usersById.get(row.user_id) ?? null
+        });
+    }
+    return index;
+}
+export function decorateOwnedEntities(entityType, entities) {
+    const ownerIndex = buildEntityOwnerIndex(entityType, entities.map((entity) => entity.id));
+    return entities.map((entity) => {
+        const owner = ownerIndex.get(entity.id) ?? { userId: null, user: null };
+        return {
+            ...entity,
+            userId: owner.userId,
+            user: owner.user
+        };
+    });
+}
+export function decorateOwnedEntity(entityType, entity) {
+    return decorateOwnedEntities(entityType, [entity])[0];
+}
+export function filterOwnedEntities(entityType, entities, userIds) {
+    const decorated = decorateOwnedEntities(entityType, entities);
+    if (!userIds || userIds.length === 0) {
+        return decorated;
+    }
+    const allowed = new Set(userIds);
+    return decorated.filter((entity) => entity.userId !== null && allowed.has(entity.userId));
+}