gestalt-mobile 0.20.1 → 0.22.0

package/dist/server/server/platform/auth/sqlite-authorization-store.js

@@ -10,6 +10,7 @@ import { DatabaseSync } from 'node:sqlite';
 import { authorizedDeviceId, localOwnerId, passkeyCeremonyId, webAuthnCredentialId, } from '../../features/auth/domain/identifiers.js';
 import { deviceNickname } from '../../features/auth/domain/device-nickname.js';
 import { CeremonyCapacityError } from '../../features/auth/domain/errors.js';
+import { AuthStatementCache, withImmediateTransaction } from './sqlite.js';
 const OWNER_ID = localOwnerId('local-owner');
 const SCHEMA_VERSION = 1;
 const SQLITE_BUSY_TIMEOUT_MS = 5_000;
@@ -24,6 +25,7 @@ export function authorizationDatabasePath(homeDirectory) {
 export class SqliteAuthorizationStore {
     path;
     db;
+    statements;
     relyingParty;
     constructor(homeDirectory, relyingParty) {
         this.path = authorizationDatabasePath(homeDirectory);
@@ -32,6 +34,7 @@ export class SqliteAuthorizationStore {
         chmodSync(parent, 0o700);
         this.relyingParty = relyingParty;
         this.db = new DatabaseSync(this.path);
+        this.statements = new AuthStatementCache(this.db);
         try {
             // journal_mode can take an exclusive lock. Install the bounded busy handler first so
             // simultaneous first opens wait for the winner instead of failing during startup.
@@ -62,8 +65,7 @@ export class SqliteAuthorizationStore {
     initializeSchemaAttempt() {
         this.db.exec('PRAGMA journal_mode = WAL;');
         this.db.exec('PRAGMA foreign_keys = ON;');
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
+        withImmediateTransaction(this.db, () => {
             this.db
                 .exec(`CREATE TABLE IF NOT EXISTS auth_settings (singleton INTEGER PRIMARY KEY CHECK (singleton = 1), schema_version INTEGER NOT NULL, rp_id TEXT NOT NULL, user_handle BLOB NOT NULL);
 CREATE TABLE IF NOT EXISTS auth_devices (id TEXT PRIMARY KEY, credential_id TEXT NOT NULL UNIQUE, public_key BLOB NOT NULL, counter INTEGER NOT NULL, transports_json TEXT NOT NULL, device_type TEXT NOT NULL, backed_up INTEGER NOT NULL CHECK(backed_up IN (0,1)), nickname TEXT NOT NULL, created_at TEXT NOT NULL, last_used_at TEXT, version INTEGER NOT NULL DEFAULT 0);
@@ -85,186 +87,129 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
                 .get();
             if (settings && settings.rp_id !== this.relyingParty.rpId && this.deviceCount() > 0)
                 throw new Error('WebAuthn RP ID hostname changed while credentials exist');
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                this.db.exec('ROLLBACK');
-            }
-            catch { }
-            throw error;
-        }
+        });
     }
     initializeOwner(userHandle) {
         if (userHandle.length === 0)
             throw new Error('Local owner handle must not be empty');
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const current = this.db
+        return withImmediateTransaction(this.db, () => {
+            const current = this.statements
                 .prepare('SELECT user_handle, rp_id FROM auth_settings WHERE singleton = 1')
                 .get();
             if (!current)
-                this.db
+                this.statements
                     .prepare('INSERT INTO auth_settings (singleton, schema_version, rp_id, user_handle) VALUES (1, ?, ?, ?)')
                     .run(SCHEMA_VERSION, this.relyingParty.rpId, userHandle);
             else if (current.rp_id !== this.relyingParty.rpId && this.deviceCount() > 0)
                 throw new Error('WebAuthn RP ID hostname changed while credentials exist');
             else if (current.rp_id !== this.relyingParty.rpId)
-                this.db
+                this.statements
                     .prepare('UPDATE auth_settings SET rp_id = ? WHERE singleton = 1')
                     .run(this.relyingParty.rpId);
-            this.db.exec('COMMIT');
             return { id: OWNER_ID, userHandle: new Uint8Array(current?.user_handle ?? userHandle) };
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     readOwner() {
-        const row = this.db
+        const row = this.statements
             .prepare('SELECT user_handle FROM auth_settings WHERE singleton = 1')
             .get();
         return row ? { id: OWNER_ID, userHandle: new Uint8Array(row.user_handle) } : null;
     }
     listAuthorizedDevices() {
-        return this.db.prepare('SELECT * FROM auth_devices ORDER BY created_at, id').all().map(toDevice);
+        return this.statements
+            .prepare('SELECT * FROM auth_devices ORDER BY created_at, id')
+            .all().map(toDevice);
     }
     claimFirstDevice(owner, device) {
         if (owner.id !== OWNER_ID || !this.readOwner())
             throw new Error('Local owner is not initialized');
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            if (this.deviceCount()) {
-                this.db.exec('COMMIT');
+        return withImmediateTransaction(this.db, () => {
+            if (this.deviceCount())
                 return 'alreadyClaimed';
-            }
             this.insertDevice(device);
-            this.db.exec('COMMIT');
             return 'claimed';
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     authorizeDevice(device) {
-        this.db.exec('BEGIN IMMEDIATE');
         try {
-            if (!this.readOwner() || !this.deviceCount()) {
-                this.db.exec('COMMIT');
-                return 'notAuthorized';
-            }
-            try {
+            return withImmediateTransaction(this.db, () => {
+                if (!this.readOwner() || !this.deviceCount())
+                    return 'notAuthorized';
                 this.insertDevice(device);
-            }
-            catch (error) {
-                if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id')) {
-                    this.db.exec('ROLLBACK');
-                    return 'duplicateCredential';
-                }
-                throw error;
-            }
-            this.db.exec('COMMIT');
-            return 'authorized';
+                return 'authorized';
+            });
         }
         catch (error) {
-            try {
-                this.db.exec('ROLLBACK');
-            }
-            catch { }
+            if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id'))
+                return 'duplicateCredential';
             throw error;
         }
     }
     findDeviceByCredentialId(id) {
-        const row = this.db.prepare('SELECT * FROM auth_devices WHERE credential_id = ?').get(id);
+        const row = this.statements
+            .prepare('SELECT * FROM auth_devices WHERE credential_id = ?')
+            .get(id);
         return row ? toDevice(row) : null;
     }
     findDevice(id) {
-        const row = this.db.prepare('SELECT * FROM auth_devices WHERE id = ?').get(id);
+        const row = this.statements.prepare('SELECT * FROM auth_devices WHERE id = ?').get(id);
         return row ? toDevice(row) : null;
     }
     renameDevice(id, expectedVersion, nickname) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const result = this.db
+        return withImmediateTransaction(this.db, () => {
+            const result = this.statements
                 .prepare('UPDATE auth_devices SET nickname = ?, version = version + 1 WHERE id = ? AND version = ?')
                 .run(nickname, id, expectedVersion);
-            if (result.changes) {
-                this.db.exec('COMMIT');
+            if (result.changes)
                 return 'renamed';
-            }
             const outcome = this.findDevice(id) ? 'stale' : 'notFound';
-            this.db.exec('COMMIT');
             return outcome;
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     advanceCounter(id, expected, expectedVersion, next, usedAt) {
-        const zeroSynced = this.db
+        const zeroSynced = this.statements
             .prepare("UPDATE auth_devices SET last_used_at = ?, version = version + 1 WHERE id = ? AND counter = ? AND version = ? AND ? = 0 AND device_type = 'multiDevice'")
             .run(usedAt, id, expected, expectedVersion, next).changes === 1;
         return (zeroSynced ||
-            this.db
+            this.statements
                 .prepare('UPDATE auth_devices SET counter = ?, last_used_at = ?, version = version + 1 WHERE id = ? AND counter = ? AND version = ? AND ? > counter')
                 .run(next, usedAt, id, expected, expectedVersion, next).changes === 1);
     }
     revokeDevice(id, revokedAt) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            if (!this.findDevice(id)) {
-                this.db.exec('COMMIT');
+        return withImmediateTransaction(this.db, () => {
+            if (!this.findDevice(id))
                 return 'notFound';
-            }
-            if (this.deviceCount() < 2) {
-                this.db.exec('COMMIT');
+            if (this.deviceCount() < 2)
                 return 'finalDevice';
-            }
-            this.db
+            this.statements
                 .prepare('UPDATE auth_sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL')
                 .run(revokedAt, id);
-            this.db.prepare('DELETE FROM auth_devices WHERE id = ?').run(id);
-            this.db.exec('COMMIT');
+            this.statements.prepare('DELETE FROM auth_devices WHERE id = ?').run(id);
             return 'revoked';
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     saveCeremony(token, ceremony, now) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
+        withImmediateTransaction(this.db, () => {
             // Admission and cleanup share one immediate transaction, so separate
             // processes cannot both observe the same remaining slot.
-            this.db.prepare('DELETE FROM auth_ceremonies WHERE consumed_at IS NOT NULL').run();
+            this.statements.prepare('DELETE FROM auth_ceremonies WHERE consumed_at IS NOT NULL').run();
             if (now)
-                this.db.prepare('DELETE FROM auth_ceremonies WHERE expires_at <= ?').run(now);
-            const active = this.db
+                this.statements.prepare('DELETE FROM auth_ceremonies WHERE expires_at <= ?').run(now);
+            const active = this.statements
                 .prepare('SELECT count(*) AS count FROM auth_ceremonies WHERE consumed_at IS NULL')
                 .get();
             if (active.count >= 64)
                 throw new CeremonyCapacityError('Ceremony capacity reached');
-            this.db
+            this.statements
                 .prepare('INSERT INTO auth_ceremonies (token_hash, purpose, challenge, expected_origin, rp_id, expires_at, ticket_hash) VALUES (?, ?, ?, ?, ?, ?, ?)')
                 .run(hash(token), ceremony.purpose, ceremony.challenge, ceremony.expectedOrigin, ceremony.rpId, ceremony.expiresAt, ceremony.enrollmentTicket ? hash(ceremony.enrollmentTicket) : null);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     consumeCeremony(token, now) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const row = this.db
+        return withImmediateTransaction(this.db, () => {
+            const row = this.statements
                 .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ? RETURNING purpose, challenge, expected_origin, rp_id, expires_at')
                 .get(now, hash(token), now);
-            this.db.exec('COMMIT');
             return row
                 ? {
                     id: passkeyCeremonyId(token),
@@ -275,14 +220,10 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
                     expiresAt: row.expires_at,
                 }
                 : null;
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     readCeremony(token, now) {
-        const row = this.db
+        const row = this.statements
             .prepare('SELECT purpose, challenge, expected_origin, rp_id, expires_at FROM auth_ceremonies WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ?')
             .get(hash(token), now);
         return row
@@ -297,29 +238,23 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
             : null;
     }
     saveTicket(token, ticket) {
-        this.db
+        this.statements
             .prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at) VALUES (?, ?, NULL)')
             .run(hash(token), ticket.expiresAt);
     }
     issueEnrollmentTicket(token, creatorSession, expiresAt) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
+        withImmediateTransaction(this.db, () => {
             const creator = hash(creatorSession);
-            this.db
+            this.statements
                 .prepare('DELETE FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL')
                 .run(creator);
-            this.db
+            this.statements
                 .prepare('INSERT INTO auth_tickets (token_hash, expires_at, consumed_at, creator_session_hash) VALUES (?, ?, NULL, ?)')
                 .run(hash(token), expiresAt, creator);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     enrollmentTicketStatus(creatorSession, now) {
-        const row = this.db
+        const row = this.statements
             .prepare('SELECT expires_at, consumed_at FROM auth_tickets WHERE creator_session_hash = ? ORDER BY rowid DESC LIMIT 1')
             .get(hash(creatorSession));
         if (!row)
@@ -329,126 +264,90 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
         return row.expires_at > now ? 'pending' : 'expired';
     }
     cancelEnrollmentTicket(creatorSession, now) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const result = this.db
+        return withImmediateTransaction(this.db, () => {
+            const result = this.statements
                 .prepare('DELETE FROM auth_tickets WHERE rowid = (SELECT rowid FROM auth_tickets WHERE creator_session_hash = ? AND consumed_at IS NULL AND expires_at > ? ORDER BY rowid DESC LIMIT 1)')
                 .run(hash(creatorSession), now);
-            this.db.exec('COMMIT');
             return result.changes === 1;
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     consumeTicket(token, now) {
         return this.consume('auth_tickets', token, now);
     }
     ticketAvailable(token, now) {
-        return Boolean(this.db
+        return Boolean(this.statements
             .prepare('SELECT 1 FROM auth_tickets t WHERE t.token_hash = ? AND t.consumed_at IS NULL AND t.expires_at > ? AND (t.creator_session_hash IS NULL OR EXISTS (SELECT 1 FROM auth_sessions s WHERE s.token_hash = t.creator_session_hash AND s.revoked_at IS NULL AND s.expires_at > ?))')
             .get(hash(token), now, now));
     }
     completeRegistration(input) {
         if (input.session.deviceId !== input.device.id)
             throw new Error('AUTHORIZATION_SESSION_DEVICE_MISMATCH');
-        this.db.exec('BEGIN IMMEDIATE');
         try {
-            const ceremony = this.db
-                .prepare('SELECT ticket_hash FROM auth_ceremonies WHERE token_hash = ? AND purpose = ? AND consumed_at IS NULL AND expires_at > ?')
-                .get(hash(input.ceremony), 'registration', input.now);
-            if (!ceremony) {
-                this.db.exec('COMMIT');
-                return 'ceremonyUnavailable';
-            }
-            if (ceremony.ticket_hash) {
-                const result = this.db
-                    .prepare('UPDATE auth_tickets SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ? AND (creator_session_hash IS NULL OR EXISTS (SELECT 1 FROM auth_sessions WHERE token_hash = auth_tickets.creator_session_hash AND revoked_at IS NULL AND expires_at > ?))')
-                    .run(input.now, ceremony.ticket_hash, input.now, input.now);
-                if (result.changes !== 1) {
-                    this.db.exec('COMMIT');
-                    return 'ticketUnavailable';
+            return withImmediateTransaction(this.db, () => {
+                const ceremony = this.statements
+                    .prepare('SELECT ticket_hash FROM auth_ceremonies WHERE token_hash = ? AND purpose = ? AND consumed_at IS NULL AND expires_at > ?')
+                    .get(hash(input.ceremony), 'registration', input.now);
+                if (!ceremony)
+                    return 'ceremonyUnavailable';
+                if (ceremony.ticket_hash) {
+                    const result = this.statements
+                        .prepare('UPDATE auth_tickets SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ? AND (creator_session_hash IS NULL OR EXISTS (SELECT 1 FROM auth_sessions WHERE token_hash = auth_tickets.creator_session_hash AND revoked_at IS NULL AND expires_at > ?))')
+                        .run(input.now, ceremony.ticket_hash, input.now, input.now);
+                    if (result.changes !== 1)
+                        return 'ticketUnavailable';
                 }
-            }
-            else if (this.deviceCount() !== 0) {
-                this.db.exec('COMMIT');
-                return 'bootstrapAlreadyClaimed';
-            }
-            try {
+                else if (this.deviceCount() !== 0)
+                    return 'bootstrapAlreadyClaimed';
                 this.insertDevice(input.device);
-            }
-            catch (error) {
-                if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id')) {
-                    this.db.exec('ROLLBACK');
-                    return 'duplicateCredential';
-                }
-                throw error;
-            }
-            this.db
-                .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
-                .run(hash(input.session.id), input.session.deviceId, input.session.expiresAt);
-            this.db
-                .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ?')
-                .run(input.now, hash(input.ceremony));
-            this.db.exec('COMMIT');
-            return 'registered';
+                this.statements
+                    .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
+                    .run(hash(input.session.id), input.session.deviceId, input.session.expiresAt);
+                this.statements
+                    .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ?')
+                    .run(input.now, hash(input.ceremony));
+                return 'registered';
+            });
         }
         catch (error) {
-            try {
-                this.db.exec('ROLLBACK');
-            }
-            catch { }
+            if (String(error).includes('UNIQUE constraint failed: auth_devices.credential_id'))
+                return 'duplicateCredential';
             throw error;
         }
     }
     completeAuthentication(input) {
         if (input.session.deviceId !== input.device.id)
             throw new Error('AUTHORIZATION_SESSION_DEVICE_MISMATCH');
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const ceremony = this.db
+        return withImmediateTransaction(this.db, () => {
+            const ceremony = this.statements
                 .prepare('SELECT 1 FROM auth_ceremonies WHERE token_hash = ? AND purpose = ? AND consumed_at IS NULL AND expires_at > ?')
                 .get(hash(input.ceremony), 'authentication', input.now);
-            if (!ceremony) {
-                this.db.exec('COMMIT');
+            if (!ceremony)
                 return false;
-            }
             const updated = this.advanceCounter(input.device.id, input.device.counter, input.device.version ?? 0, input.nextCounter, input.now);
-            if (!updated) {
-                this.db.exec('COMMIT');
+            if (!updated)
                 return false;
-            }
-            this.db
+            this.statements
                 .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
                 .run(hash(input.session.id), input.session.deviceId, input.session.expiresAt);
-            this.db
+            this.statements
                 .prepare('UPDATE auth_ceremonies SET consumed_at = ? WHERE token_hash = ?')
                 .run(input.now, hash(input.ceremony));
-            this.db.exec('COMMIT');
             return true;
-        }
-        catch (error) {
-            try {
-                this.db.exec('ROLLBACK');
-            }
-            catch { }
-            throw error;
-        }
+        });
     }
     saveSession(token, session) {
-        this.db
+        this.statements
             .prepare('INSERT INTO auth_sessions (token_hash, device_id, expires_at) VALUES (?, ?, ?)')
             .run(hash(token), session.deviceId, session.expiresAt);
     }
     sessionDevice(token, now) {
-        const row = this.db
+        const row = this.statements
             .prepare('SELECT device_id FROM auth_sessions WHERE token_hash = ? AND revoked_at IS NULL AND expires_at > ?')
             .get(hash(token), now);
         return row?.device_id ? authorizedDeviceId(row.device_id) : null;
     }
     revokeSession(token, now) {
-        return (this.db
+        return (this.statements
             .prepare('UPDATE auth_sessions SET revoked_at = ? WHERE token_hash = ? AND revoked_at IS NULL')
             .run(now, hash(token)).changes === 1);
     }
@@ -456,26 +355,20 @@ CREATE TABLE IF NOT EXISTS auth_sessions (token_hash TEXT PRIMARY KEY, device_id
         this.db.close();
     }
     insertDevice(device) {
-        this.db
+        this.statements
             .prepare('INSERT INTO auth_devices (id, credential_id, public_key, counter, transports_json, device_type, backed_up, nickname, created_at, last_used_at, version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
             .run(device.id, device.credentialId, device.publicKey, device.counter, JSON.stringify(device.transports), device.deviceType, device.backedUp ? 1 : 0, device.nickname, device.createdAt, device.lastUsedAt ?? null, device.version ?? 0);
     }
     consume(table, token, now) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
+        return withImmediateTransaction(this.db, () => {
             const changes = this.db
                 .prepare(`UPDATE ${table} SET consumed_at = ? WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > ?`)
                 .run(now, hash(token), now).changes;
-            this.db.exec('COMMIT');
             return changes === 1;
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
+        });
     }
     deviceCount() {
-        return this.db.prepare('SELECT COUNT(*) AS count FROM auth_devices').get().count;
+        return this.statements.prepare('SELECT COUNT(*) AS count FROM auth_devices').get().count;
     }
 }
 function toDevice(row) {

package/dist/server/server/platform/auth/sqlite.js

@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2026 Dyne.org foundation
+ * Designed by Denis Roio <jaromil@dyne.org>
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+export function withImmediateTransaction(db, action) {
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        const result = action();
+        db.exec('COMMIT');
+        return result;
+    }
+    catch (error) {
+        if (db.isTransaction) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { }
+        }
+        throw error;
+    }
+}
+/**
+ * Auth has existing positional-parameter SQL, while SQLTagStore only accepts
+ * tagged-template parameters. This small LRU keeps that SQL unchanged and only
+ * receives repeated static statements from the authorization store.
+ */
+export class AuthStatementCache {
+    db;
+    maxSize;
+    statements = new Map();
+    constructor(db, maxSize = 32) {
+        this.db = db;
+        this.maxSize = maxSize;
+        if (!Number.isInteger(maxSize) || maxSize < 1)
+            throw new RangeError('Statement cache size must be a positive integer');
+    }
+    prepare(sql) {
+        const cached = this.statements.get(sql);
+        if (cached) {
+            this.statements.delete(sql);
+            this.statements.set(sql, cached);
+            return cached;
+        }
+        const statement = this.db.prepare(sql);
+        if (this.statements.size === this.maxSize) {
+            const oldest = this.statements.keys().next().value;
+            if (oldest !== undefined)
+                this.statements.delete(oldest);
+        }
+        this.statements.set(sql, statement);
+        return statement;
+    }
+}

package/dist/server/server/platform/codex/activity-facts.js

@@ -95,6 +95,9 @@ export function decodeAgentActivityFacts(sessionId, occurredAt, input) {
                 : typeof item.status === 'string' && item.status.length <= 64
                     ? item.status
                     : undefined;
+            const model = action === 'spawn_agent' && typeof item.model === 'string' && item.model.length <= 256
+                ? item.model
+                : undefined;
             return {
                 sessionId,
                 occurredAt,
@@ -105,6 +108,7 @@ export function decodeAgentActivityFacts(sessionId, occurredAt, input) {
                     ? { childStatus: currentStatus ?? legacyStatus }
                     : {}),
                 ...(action ? { collaborationAction: action } : {}),
+                ...(model ? { childModel: model } : {}),
             };
         };
         return children.length > 0 ? children.map((child) => fact(child)) : [fact()];

package/dist/server/server/platform/codex/recent-thread-lister.js

@@ -3,18 +3,36 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
+import { readRolloutExecutionPolicy } from './rollout-execution-policy.js';
 export function createRecentThreadLister(deps) {
+    const rolloutPaths = new Map();
+    const list = async () => {
+        const profiles = (await deps.profiles.list()).filter((profile) => profile.state === 'ok');
+        const listed = await Promise.all(profiles.map(async ({ name }) => listProfileThreads(deps.launch, name, deps.root)));
+        const byId = new Map();
+        for (const thread of listed.flat()) {
+            const known = byId.get(thread.id);
+            if (!known || (thread.recencyAt ?? 0) > (known.recencyAt ?? 0))
+                byId.set(thread.id, thread);
+        }
+        rolloutPaths.clear();
+        return [...byId.values()]
+            .sort((a, b) => (b.recencyAt ?? 0) - (a.recencyAt ?? 0))
+            .map(({ rolloutPath, ...thread }) => {
+            if (rolloutPath)
+                rolloutPaths.set(thread.id, rolloutPath);
+            return thread;
+        });
+    };
     return {
-        async list() {
-            const profiles = (await deps.profiles.list()).filter((profile) => profile.state === 'ok');
-            const listed = await Promise.all(profiles.map(async ({ name }) => listProfileThreads(deps.launch, name, deps.root)));
-            const byId = new Map();
-            for (const thread of listed.flat()) {
-                const known = byId.get(thread.id);
-                if (!known || (thread.recencyAt ?? 0) > (known.recencyAt ?? 0))
-                    byId.set(thread.id, thread);
-            }
-            return [...byId.values()].sort((a, b) => (b.recencyAt ?? 0) - (a.recencyAt ?? 0));
+        list,
+        executionPolicy: async (threadId) => {
+            if (!rolloutPaths.has(threadId))
+                await list();
+            const rolloutPath = rolloutPaths.get(threadId);
+            return rolloutPath
+                ? (deps.readExecutionPolicy ?? readRolloutExecutionPolicy)(rolloutPath)
+                : undefined;
         },
     };
 }
@@ -34,7 +52,15 @@ async function listProfileThreads(launch, profile, cwd) {
         return (result.data ?? []).flatMap((thread) => {
             if (typeof thread.id !== 'string' || typeof thread.cwd !== 'string')
                 return [];
-            return [{ id: thread.id, cwd: thread.cwd, profile, recencyAt: toRecency(thread.recencyAt) }];
+            return [
+                {
+                    id: thread.id,
+                    cwd: thread.cwd,
+                    profile,
+                    recencyAt: toRecency(thread.recencyAt),
+                    ...(typeof thread.path === 'string' ? { rolloutPath: thread.path } : {}),
+                },
+            ];
         });
     }
     catch {