gloomberb 0.19.2 → 0.19.3

package/src/components/ui/stat-grid.tsx

@@ -2,7 +2,7 @@ import { t } from "../../i18n";
 import type { ThemeColors } from "../../theme/colors";
 import { useThemeColors } from "../../theme/theme-context";
 import { Box, Text, TextAttributes, useUiCapabilities } from "../../ui";
-import { displayWidth, truncateToDisplayWidth } from "../../utils/format";
+import { clipToDisplayWidth, displayWidth, padTo, truncateToDisplayWidth } from "../../utils/format";
 import { SplitBar, type SplitBarPart } from "./split-bar";
 
 export type StatTone = "neutral" | "positive" | "negative" | "warning" | "accent" | "muted";
@@ -49,6 +49,13 @@ export interface StatGridProps {
   width: number;
   /** Fixed column count; by default as many as the widest item allows, up to 4, balanced over the rows. */
   columns?: number;
+  /**
+   * The most lines the grid takes. A whole-row cell too narrow for its value
+   * and detail wraps onto a second line, the detail under the value; with
+   * `maxLines` only the leading such cells the lines leave room for do, and
+   * the rest keep one line, cut (`statGridRows` counts the same).
+   */
+  maxLines?: number;
 }
 
 const MAX_COLUMNS = 4;
@@ -102,9 +109,207 @@ function layoutRows(items: StatItem[], columns: number): StatItem[][] {
   return rows;
 }
 
-/** Rows a StatGrid takes, so panes can size what sits below it. */
-export function statGridRows(items: StatItem[], width: number, columns?: number): number {
-  return layoutRows(items, Math.max(1, columns ?? statGridColumns(items, width))).length;
+/** What a grid's cells share: the label column, the inner width and one cell's width, in terminal cells. */
+function gridGeometry(items: StatItem[], width: number, columns: number, nativePaneChrome: boolean) {
+  const labels = labelChars(items);
+  const innerWidth = Math.max(1, width - (nativePaneChrome ? 0 : 2));
+  const cellWidth = Math.max(8, Math.floor((innerWidth - CELL_GAP * (columns - 1)) / columns));
+  const widestValue = Math.max(0, ...items.filter((item) => !item.wide).map((item) => displayWidth(item.value)));
+  return { labels, innerWidth, cellWidth, widestValue };
+}
+
+/**
+ * The label's column in a cell `width` wide: it grows into what the grid's
+ * widest value leaves, and never gets less than half the cell, so one long
+ * value cannot cut every label in a grid with a fixed column count.
+ */
+function cellLabelWidth(width: number, labels: number, widestValue: number): number {
+  return Math.min(labels + 1, Math.max(4, Math.floor(width * 0.5), width - widestValue - 1));
+}
+
+/** Cells a split bar takes after a value that leaves `room` in its column; none when too few to read. */
+function splitBarCells(room: number): number {
+  return room >= 4 ? Math.min(SPLIT_BAR_CELLS, room) : 0;
+}
+
+const MONTH = "(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|June?|July?|Aug(?:ust)?|Sep(?:t(?:ember)?)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\\.?";
+/** A date, time or day count in a cell: `2026-10-29`, `18:00`, `Dec 9`, `30 Sep`, `Dec '26`, `2026`, `in 40 days`, `3d ago`. */
+const DATED = new RegExp([
+  "\\d{4}-\\d{2}",
+  "\\b\\d{1,2}:\\d{2}\\b",
+  `\\b${MONTH} (?:'\\d{2}|\\d{1,4})\\b`,
+  `\\b\\d{1,2} ${MONTH}(?![a-z])`,
+  "\\b(?:19|20)\\d{2}\\b",
+  "\\bin \\d+ ?(?:d|days?|wks?|weeks?|mo|months?)\\b",
+  "\\b\\d+ ?(?:d|h|m|min|days?|hours?) ago\\b",
+].join("|"));
+
+/** `text` cut to `room` after its last whole word that fits, behind a `…`; mid-word only when its first word does not fit. */
+function clipWords(text: string, room: number): string {
+  if (displayWidth(text) <= room) return text;
+  const words = text.split(" ");
+  for (let count = words.length - 1; count > 0; count--) {
+    const kept = `${words.slice(0, count).join(" ")}…`;
+    if (displayWidth(kept) <= room) return kept;
+  }
+  return clipToDisplayWidth(text, room);
+}
+
+/**
+ * `text` cut to `width` without cutting a date: its ` · ` parts that have none
+ * give way first, from the last, cut short at a word and then to a `…` that
+ * says something is left out; then the words before a part's date
+ * (`1,561,837 shares… 16:02:15.123`). Only dates too wide for the width are
+ * cut at their end.
+ */
+function cutKeepingDates(text: string, width: number): string {
+  const parts = text.split(" · ");
+  const joined = () => parts.join(" · ");
+  const roomFor = (index: number) => width - (displayWidth(joined()) - displayWidth(parts[index]!));
+  for (let index = parts.length - 1; index >= 0 && displayWidth(joined()) > width; index--) {
+    const part = parts[index]!;
+    if (DATED.test(part)) continue;
+    const room = roomFor(index);
+    if (room >= 4) parts[index] = clipWords(part, room);
+    else if (parts[index + 1] !== "…" && part !== "…") parts[index] = "…";
+    else parts.splice(index, 1);
+  }
+  for (let index = parts.length - 1; index >= 0 && displayWidth(joined()) > width; index--) {
+    const part = parts[index]!;
+    const at = part.search(DATED);
+    if (at <= 0) continue;
+    const date = part.slice(at);
+    const room = roomFor(index) - displayWidth(date) - 1;
+    parts[index] = room >= 4 ? `${clipWords(part.slice(0, at).trimEnd(), room)} ${date}` : date;
+  }
+  return truncateToDisplayWidth(joined(), width);
+}
+
+/**
+ * `text` on at most two lines no wider than `width`: broken after the ` · `
+ * parts that fit the first, else at its last space that does; the second line
+ * is cut where it has no date (cutKeepingDates).
+ */
+function twoLines(text: string, width: number): string[] {
+  const parts = text.split(" · ");
+  let first = "";
+  let taken = 0;
+  for (; taken < parts.length; taken++) {
+    const next = first ? `${first} · ${parts[taken]}` : parts[taken]!;
+    if (displayWidth(next) > width) break;
+    first = next;
+  }
+  let rest = parts.slice(taken).join(" · ");
+  if (!first) {
+    // The first part alone is wider than a line: it breaks at a space, or is cut.
+    const words = parts[0]!.split(" ");
+    let count = 0;
+    while (count < words.length && displayWidth(words.slice(0, count + 1).join(" ")) <= width) count++;
+    first = count ? words.slice(0, count).join(" ") : truncateToDisplayWidth(words[0]!, width);
+    rest = [words.slice(Math.max(1, count)).join(" "), ...parts.slice(1)].filter(Boolean).join(" · ");
+  }
+  return rest ? [first, cutKeepingDates(rest, width)] : [first];
+}
+
+/** A whole-row cell on its two lines (wrapStatCell). */
+interface WrappedStatCell {
+  /** The value: one line, or both when it is wider than its column and the detail gives way. */
+  value: string[];
+  /** Cells of the split bar after the value on the first line; 0 for none. */
+  bar: number;
+  /** The detail on the second line, or null. */
+  detail: string | null;
+}
+
+/** Lines a wrapped cell takes: its value, then its detail. */
+const WRAPPED_CELL_LINES = 2;
+
+/**
+ * A whole-row cell (a `wide` item, or any cell of a one-column grid) that does
+ * not fit one line, on two: the value and its split bar on the first, and the
+ * detail on the second, in the longest form that fits, else cut where it has
+ * no date. A value wider than its column takes both lines, its bar after the
+ * first where it has room, when the detail can go (there is none, the pane
+ * offers an empty form, or it has no date); with a dated detail the value is
+ * cut instead, as a date is never what gives way.
+ * Null when the cell fits one line as it is, with the detail form that fits
+ * beside the value (an empty form counts: the pane chose to show none). Worked
+ * out in terminal cells for both renderers, so the grid's rows are the same
+ * count on each.
+ */
+function wrapStatCell(item: StatItem, width: number, labelWidth: number): WrappedStatCell | null {
+  const valueWidth = Math.max(1, width - labelWidth);
+  const valueCells = displayWidth(item.value);
+  const forms = item.detail ? [item.detail, ...(item.detailVariants ?? [])] : [];
+  const shown = forms.filter(Boolean);
+  const detailLine = () => shown.find((form) => displayWidth(form) <= valueWidth) ?? cutKeepingDates(shown.at(-1)!, valueWidth);
+  if (valueCells <= valueWidth) {
+    const bar = item.split ? splitBarCells(valueWidth - valueCells - 1) : 0;
+    const detailRoom = valueWidth - valueCells - (bar ? bar + 1 : 0) - 2;
+    const shortest = sizingDetail(item);
+    if (!shortest || (detailRoom > 1 && displayWidth(shortest) <= detailRoom)) return null;
+    return { value: [item.value], bar, detail: detailLine() };
+  }
+  const detailCanGo = shown.length === 0 || shown.length < forms.length || !shown.some((form) => DATED.test(form));
+  if (detailCanGo) {
+    const value = twoLines(item.value, valueWidth);
+    return { value, bar: item.split ? splitBarCells(valueWidth - displayWidth(value[0]!) - 1) : 0, detail: null };
+  }
+  return { value: [cutKeepingDates(item.value, valueWidth)], bar: 0, detail: detailLine() };
+}
+
+/** A laid-out row's one cell, wrapped, when it spans the row and does not fit one line (wrapStatCell). */
+function wrappedRow(row: StatItem[], columns: number, geometry: ReturnType<typeof gridGeometry>): WrappedStatCell | null {
+  const item = row[0];
+  if (!item || row.length > 1 || (!item.wide && columns > 1)) return null;
+  const width = item.wide ? geometry.innerWidth : geometry.cellWidth;
+  return wrapStatCell(item, width, cellLabelWidth(width, geometry.labels, geometry.widestValue));
+}
+
+/**
+ * The grid's rows and which of them wrap: every whole-row cell too narrow for
+ * one line, in order, while the grid stays within `maxLines`; past that a cell
+ * keeps its one line, cut. Decided in terminal cells on both renderers, so a
+ * pane sizes the same rows on each.
+ */
+function planStatGrid(items: StatItem[], width: number, columns: number, maxLines = Number.POSITIVE_INFINITY) {
+  const rows = layoutRows(items, columns);
+  const geometry = gridGeometry(items, width, columns, false);
+  let spare = maxLines - rows.length;
+  const wrapped = rows.map((row) => {
+    if (spare < WRAPPED_CELL_LINES - 1) return null;
+    const cell = wrappedRow(row, columns, geometry);
+    if (cell) spare -= WRAPPED_CELL_LINES - 1;
+    return cell;
+  });
+  const lines = rows.length + wrapped.filter(Boolean).length * (WRAPPED_CELL_LINES - 1);
+  return { rows, wrapped, lines };
+}
+
+/**
+ * Rows a StatGrid takes, so panes can size what sits below it: a whole-row
+ * cell that wraps counts both its lines. With `maxLines`, the grid drawn with
+ * the same `maxLines`.
+ */
+export function statGridRows(items: StatItem[], width: number, columns?: number, { maxLines }: { maxLines?: number } = {}): number {
+  return planStatGrid(items, width, Math.max(1, columns ?? statGridColumns(items, width)), maxLines).lines;
+}
+
+/**
+ * The leading items that fit a band of `maxLines`, in whole rows: as many rows
+ * as there are lines, and the rows they leave for a whole-row cell to wrap
+ * into (`maxLines` on the grid, which `lines` counts).
+ */
+export function statGridWithin(items: StatItem[], width: number, maxLines: number, columns?: number): { items: StatItem[]; lines: number } {
+  if (maxLines < 1 || items.length === 0) return { items: [], lines: 0 };
+  const resolved = Math.max(1, columns ?? statGridColumns(items, width));
+  const shown = layoutRows(items, resolved).slice(0, maxLines).flat();
+  return { items: shown, lines: statGridRows(shown, width, resolved, { maxLines }) };
+}
+
+/** A label in its column, cut and padded by terminal cells, so a wide character keeps the values aligned. */
+function labelText(label: string, labelWidth: number): string {
+  return padTo(truncateToDisplayWidth(label, labelWidth - 1), labelWidth);
 }
 
 /**
@@ -114,16 +319,13 @@ export function statGridRows(items: StatItem[], width: number, columns?: number)
  * hairline-split cells, so the top of the pane reads as one piece of chrome;
  * the terminal draws aligned text columns.
  */
-export function StatGrid({ items, width, columns: columnsProp }: StatGridProps) {
+export function StatGrid({ items, width, columns: columnsProp, maxLines }: StatGridProps) {
   const colors = useThemeColors();
   const { nativePaneChrome } = useUiCapabilities();
   if (items.length === 0) return null;
   const columns = Math.max(1, columnsProp ?? statGridColumns(items, width));
-  const rows = layoutRows(items, columns);
-  const labels = labelChars(items);
-  const innerWidth = Math.max(1, width - (nativePaneChrome ? 0 : 2));
-  const cellWidth = Math.max(8, Math.floor((innerWidth - CELL_GAP * (columns - 1)) / columns));
-  const widestValue = Math.max(0, ...items.filter((item) => !item.wide).map((item) => displayWidth(item.value)));
+  const { rows, wrapped: wrapping, lines: lineCount } = planStatGrid(items, width, columns, maxLines);
+  const { labels, innerWidth, cellWidth, widestValue } = gridGeometry(items, width, columns, !!nativePaneChrome);
 
   const toneColor = (item: StatItem): string =>
     item.color || (statToneColor(item.tone, colors) ?? (nativePaneChrome ? colors.textBright : colors.text));
@@ -132,25 +334,66 @@ export function StatGrid({ items, width, columns: columnsProp }: StatGridProps)
     <Box
       flexDirection="column"
       paddingX={nativePaneChrome ? 0 : 1}
-      height={rows.length}
+      height={lineCount}
       flexShrink={0}
       data-gloom-role="stat-grid"
       style={nativePaneChrome ? { "--stat-label-w": `${labels}ch`, "--stat-columns": String(columns) } : undefined}
     >
-      {rows.map((row, rowIndex) => (
+      {rows.map((row, rowIndex) => {
+        const wrapped = wrapping[rowIndex];
+        if (wrapped) {
+          const item = row[0]!;
+          const label = t(item.label);
+          const width = item.wide ? innerWidth : cellWidth;
+          const labelWidth = cellLabelWidth(width, labels, widestValue);
+          const [firstValue, ...moreValue] = wrapped.value;
+          return (
+            <Box key={rowIndex} height={WRAPPED_CELL_LINES} flexDirection="row" data-gloom-role="stat-grid-row">
+              <Box
+                key={item.id ?? `${rowIndex}:0`}
+                width={nativePaneChrome ? undefined : width}
+                height={WRAPPED_CELL_LINES}
+                flexDirection="row"
+                overflow="hidden"
+                data-gloom-role="stat-grid-cell"
+                data-wide={item.wide ? "true" : undefined}
+                data-wrapped="true"
+                data-gloom-stat-id={item.id}
+              >
+                <Text fg={colors.textDim} data-gloom-role="stat-grid-label">
+                  {nativePaneChrome ? label : labelText(label, labelWidth)}
+                </Text>
+                <Box flexDirection="column" flexGrow={1} minWidth={0}>
+                  <Box height={1} flexDirection="row">
+                    <Text fg={toneColor(item)} attributes={TextAttributes.BOLD} data-gloom-role="stat-grid-value">{firstValue}</Text>
+                    {item.split && wrapped.bar ? (
+                      <Box marginLeft={nativePaneChrome ? 0 : 1} flexShrink={nativePaneChrome ? 1 : 0} style={nativePaneChrome ? { minWidth: 0 } : undefined}>
+                        <SplitBar parts={item.split} width={nativePaneChrome ? SPLIT_BAR_CELLS : wrapped.bar} />
+                      </Box>
+                    ) : null}
+                  </Box>
+                  {moreValue.map((line, index) => (
+                    <Text key={`value:${index}`} fg={toneColor(item)} attributes={TextAttributes.BOLD} data-gloom-role="stat-grid-value">{line}</Text>
+                  ))}
+                  {wrapped.detail != null ? (
+                    <Text fg={colors.textDim} data-gloom-role="stat-grid-detail">{wrapped.detail}</Text>
+                  ) : null}
+                </Box>
+              </Box>
+            </Box>
+          );
+        }
+        return (
         <Box key={rowIndex} height={1} flexDirection="row" gap={nativePaneChrome ? 0 : CELL_GAP} data-gloom-role="stat-grid-row">
           {row.map((item, index) => {
             const label = t(item.label);
             const width = item.wide ? innerWidth : cellWidth;
-            // The label grows into what the grid's widest value leaves, and
-            // never gets less than half the cell, so one long value cannot cut
-            // every label in a grid with a fixed column count.
-            const labelWidth = Math.min(labels + 1, Math.max(4, Math.floor(width * 0.5), width - widestValue - 1));
+            const labelWidth = cellLabelWidth(width, labels, widestValue);
             const valueWidth = Math.max(1, width - labelWidth);
             const value = nativePaneChrome ? item.value : truncateToDisplayWidth(item.value, valueWidth);
             // The bar shows only whole enough to read; the value never gives way to it.
             const barRoom = valueWidth - displayWidth(value) - 1;
-            const barCells = !item.split ? 0 : nativePaneChrome ? SPLIT_BAR_CELLS : barRoom >= 4 ? Math.min(SPLIT_BAR_CELLS, barRoom) : 0;
+            const barCells = !item.split ? 0 : nativePaneChrome ? SPLIT_BAR_CELLS : splitBarCells(barRoom);
             const detailWidth = valueWidth - displayWidth(value) - (barCells ? barCells + 1 : 0) - 2;
             // The desktop cell has no gap between cells: its label column, inset and gaps take the room
             // (measured short, as a cell is wider than a character, so a form that fits is never clipped).
@@ -177,7 +420,7 @@ export function StatGrid({ items, width, columns: columnsProp }: StatGridProps)
                   : undefined}
               >
                 <Text fg={colors.textDim} data-gloom-role="stat-grid-label">
-                  {nativePaneChrome ? label : truncateToDisplayWidth(label, labelWidth - 1).padEnd(labelWidth)}
+                  {nativePaneChrome ? label : labelText(label, labelWidth)}
                 </Text>
                 <Text fg={toneColor(item)} attributes={TextAttributes.BOLD} data-gloom-role="stat-grid-value">{value}</Text>
                 {item.split && barCells ? (
@@ -192,7 +435,8 @@ export function StatGrid({ items, width, columns: columnsProp }: StatGridProps)
             );
           })}
         </Box>
-      ))}
+        );
+      })}
     </Box>
   );
 }

package/src/data/config/store/node.ts

@@ -1,6 +1,6 @@
 import { logFailure } from "../../../utils/log-failure";
 import { existsSync, readdirSync, type Dirent } from "fs";
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { readFile, rename, rm } from "fs/promises";
 import { dirname, join, resolve } from "path";
 import { expandUserHome, getGloomberbDirs } from "../home";
 import type { AppConfig } from "../../../types/config";
@@ -8,6 +8,8 @@ import { createDefaultConfig } from "../../../types/config";
 import { debugLog } from "../../../utils/debug-log";
 import { findAbsorbedCheckout, isDirectoryOrLink, isPluginDirectory } from "../../../plugins/loader";
 import { EXTRACTED_PLUGINS } from "../../../plugins/extracted-plugins";
+import { makePrivateDir, writePrivateFile } from "../../../utils/private-files";
+import { tightenProfilePermissions } from "../../profile-permissions";
 import type { ConfigMigrationHost } from "./migrations";
 import {
   normalizeConfigForSave,
@@ -113,11 +115,12 @@ const saveQueues = new Map<string, Promise<void>>();
 let tempFileCounter = 0;
 
 async function writeConfigFile(configPath: string, contents: string): Promise<void> {
-  await mkdir(dirname(configPath), { recursive: true });
+  await makePrivateDir(dirname(configPath));
   // Unique per call: a clock tick is not, and two saves can land in one.
   const tempPath = `${configPath}.${process.pid}.${Date.now()}.${tempFileCounter++}.tmp`;
   try {
-    await writeFile(tempPath, contents, "utf-8");
+    // Readable by the user alone: config.json holds broker credentials.
+    await writePrivateFile(tempPath, contents);
     await rename(tempPath, configPath);
   } catch (error) {
     await rm(tempPath, { force: true }).catch(() => { /* Intentional ignore: Remove a partial temporary file while preserving the write error rethrown below. */ });
@@ -149,11 +152,12 @@ export async function saveConfig(config: AppConfig): Promise<void> {
 
 export async function initDataDir(dataDir: string): Promise<AppConfig> {
   configLog.info(`Initializing data directory: ${dataDir}`);
-  await mkdir(dataDir, { recursive: true });
+  await makePrivateDir(dataDir);
   const { config, needsSave } = await loadConfigState(dataDir);
   if (needsSave) {
     await saveConfig(config);
   }
+  await tightenProfilePermissions(dataDir, [configFileFor(dataDir), getGloomberbDirs().configFile]);
   return config;
 }
 
@@ -166,7 +170,9 @@ export async function resetAllData(dataDir: string): Promise<void> {
 
 export async function exportConfig(config: AppConfig, destPath: string): Promise<void> {
   const { dataDir, ...rest } = config;
-  await writeFile(expandHomePath(destPath), JSON.stringify(rest, null, 2), "utf-8");
+  // The export carries broker credentials as config.json does: readable by the
+  // user alone, an existing file included, and never written through a link.
+  await writePrivateFile(expandHomePath(destPath), JSON.stringify(rest, null, 2));
 }
 
 export async function importConfig(dataDir: string, srcPath: string): Promise<AppConfig> {

package/src/data/config/store/normalize.ts

@@ -30,6 +30,7 @@ import { DEFAULT_THEME, themes } from "../../../theme/themes";
 import { sanitizeStarPrompt } from "../../../app/star-prompt/model";
 import { sanitizeCommandBarOpens } from "../../../app/command-bar-intro";
 import { sanitizeUpdatesConfig } from "../../../updater/channel";
+import { ATTENTION_NOTICE_ACCOUNTS } from "../../../telemetry/attention-setting";
 
 const configLog = debugLog.createLogger("config");
 const reportedUnknownThemes = new Set<string>();
@@ -201,17 +202,28 @@ function withUpdates(updates: AppConfig["updates"]): Pick<AppConfig, "updates">
   return updates ? { updates } : {};
 }
 
-/** Only the switches that are set survive; an empty object is the same as none. */
+/**
+ * Only the switches that are set survive; an empty object is the same as none.
+ * Attention Counts is on by default, so a value that cannot be read turns it
+ * off instead: a hand-edited "false" or a broken block never counts as on.
+ */
 function sanitizeTelemetry(value: unknown): TelemetryConfig | undefined {
-  if (!isRecord(value)) return undefined;
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) return { attention: false };
   const telemetry: TelemetryConfig = {
     ...(typeof value.crashReports === "boolean" ? { crashReports: value.crashReports } : {}),
     ...(typeof value.usage === "boolean" ? { usage: value.usage } : {}),
-    ...(typeof value.attention === "boolean" ? { attention: value.attention } : {}),
+    ...(value.attention !== undefined ? { attention: value.attention === true } : {}),
+    ...sanitizeAttentionNotice(value.attentionNoticeShownTo),
   };
   return Object.keys(telemetry).length > 0 ? telemetry : undefined;
 }
 
+function sanitizeAttentionNotice(value: unknown): Pick<TelemetryConfig, "attentionNoticeShownTo"> {
+  const accounts = sanitizeUniqueStringList(value).slice(-ATTENTION_NOTICE_ACCOUNTS);
+  return accounts.length > 0 ? { attentionNoticeShownTo: accounts } : {};
+}
+
 /**
  * Keeps the shape honest without judging the contents: a chord that does not
  * parse stays in the file and is reported when the table resolves, so a typo
@@ -286,6 +298,7 @@ function sanitizeOnboardingProgress(value: unknown): OnboardingProgress | undefi
     accountStatus,
     checkoutOpenedAt: typeof value.checkoutOpenedAt === "string" ? value.checkoutOpenedAt : undefined,
     desks: Array.isArray(value.desks) ? sanitizeUniqueStringList(value.desks) : undefined,
+    rerun: value.rerun === true ? true : undefined,
   };
 }
 

package/src/data/profile-permissions.ts

@@ -0,0 +1,47 @@
+import { readdir } from "fs/promises";
+import { dirname, join } from "path";
+import { logFailure } from "../utils/log-failure";
+import { restrictDir, restrictFile } from "../utils/private-files";
+
+/** The data folder's files that hold the Cloud session and cache, or logs of what the user did. */
+const PRIVATE_DATA_FILES = [
+  ".gloomberb-cache.db",
+  ".gloomberb-cache.db-wal",
+  ".gloomberb-cache.db-shm",
+  "stall-log.txt",
+  "stall-reports.json",
+  "crash-reports.json",
+  "desktop-view-ids.json",
+];
+/** `remote-control.json` and one per app (`remote-control.tui.json`): each holds the remote-control token. */
+const REMOTE_ENDPOINT_FILE = /^remote-control(?:\.[\w-]+)?\.json$/;
+
+/**
+ * Tightens a profile made before its folders and files were created private,
+ * or under a umask that let others read them: the data folder and each
+ * config.json's folder open to the user alone, config.json (broker
+ * credentials) and the files above readable by the user alone. A step that
+ * fails (a folder another account owns, a disk without POSIX modes) is logged
+ * and the others still run; startup goes on either way. Nothing to do on
+ * Windows (see private-files.ts).
+ */
+export async function tightenProfilePermissions(dataDir: string, configFiles: readonly string[]): Promise<void> {
+  if (process.platform === "win32") return;
+  const steps: Array<() => Promise<void>> = [
+    ...[...new Set([dataDir, ...configFiles.map((file) => dirname(file))])].map((dir) => () => restrictDir(dir)),
+    ...[...new Set(configFiles)].map((file) => () => restrictFile(file)),
+    ...PRIVATE_DATA_FILES.map((name) => () => restrictFile(join(dataDir, name))),
+    async () => {
+      for (const name of await readdir(dataDir)) {
+        if (REMOTE_ENDPOINT_FILE.test(name)) await restrictFile(join(dataDir, name));
+      }
+    },
+  ];
+  for (const step of steps) {
+    try {
+      await step();
+    } catch (error) {
+      logFailure("data.profile-permissions", "Restricting a profile file to its user failed")(error);
+    }
+  }
+}

package/src/data/resource-store.ts

@@ -277,22 +277,18 @@ export class ResourceStore {
     // Eviction goes by the order on disk, which has to hold the latest reads.
     if (!this.flushTouches()) return false;
 
-    const candidates = this.db.query<{
-      namespace: string;
-      kind: string;
-      entity_key: string;
-      variant_key: string;
-      source_key: string;
-      size_bytes: number;
-    }, [number]>(
-      `SELECT namespace, kind, entity_key, variant_key, source_key, size_bytes
+    // Only the row ids, which the recency index holds: a row's size sits
+    // after its payload, and reading it walks the whole payload from disk.
+    // Asking it of the oldest 512 rows read 10 MB to pick what to evict.
+    const candidates = this.db.query<{ rowid: number }, [number]>(
+      `SELECT rowid
        FROM resource_cache
        ORDER BY last_accessed_at ASC, fetched_at ASC
        LIMIT ?`,
     );
-    const remove = this.db.query(
-      `DELETE FROM resource_cache
-       WHERE namespace = ? AND kind = ? AND entity_key = ? AND variant_key = ? AND source_key = ?`,
+    // Deleting a row reads its payload anyway, to free it: the size comes along.
+    const remove = this.db.query<{ size_bytes: number }, [number]>(
+      "DELETE FROM resource_cache WHERE rowid = ? RETURNING size_bytes",
     );
 
     // A cache at its limit holds tens of thousands of rows, so eviction reads
@@ -306,24 +302,23 @@ export class ResourceStore {
       if (!batch) return false;
       if (batch.length === 0) return true;
 
-      const rowsToDelete = [] as typeof batch;
-      for (const row of batch) {
-        if (this.withinSoftLimits(remainingCount, remainingSize)) break;
-        rowsToDelete.push(row);
-        remainingCount -= 1;
-        remainingSize -= row.size_bytes;
-      }
-      if (rowsToDelete.length === 0) return true;
-
+      let left = { count: remainingCount, size: remainingSize };
       const pruned = this.access.writeCache("prune least recently used cached resources", () => {
+        left = { count: remainingCount, size: remainingSize };
         const tx = this.db.transaction(() => {
-          for (const row of rowsToDelete) {
-            remove.run(row.namespace, row.kind, row.entity_key, row.variant_key, row.source_key);
+          for (const { rowid } of batch) {
+            if (this.withinSoftLimits(left.count, left.size)) break;
+            const removed = remove.get(rowid);
+            if (!removed) continue;
+            left.count -= 1;
+            left.size -= removed.size_bytes;
           }
         });
         tx();
       });
       if (!pruned) return false;
+      remainingCount = left.count;
+      remainingSize = left.size;
     }
     return true;
   }
@@ -382,25 +377,33 @@ export class ResourceStore {
     key: Pick<ResourceCacheKey, "namespace" | "kind" | "entityKey">,
     options: ListResourceOptions = {},
   ): CachedResourceRecord<T>[] {
+    const variantKeys = options.variantKeys ? [...new Set(options.variantKeys.map(normalizeVariantKey))] : null;
+    const sourceKeys = options.sourceKeys ? [...new Set(options.sourceKeys.map(normalizeSourceKey))] : null;
+    if (variantKeys?.length === 0 || sourceKeys?.length === 0) return [];
+    // The rows asked for only: an entity can hold dozens of variants (every
+    // range of a price history, from every source), megabytes of payload
+    // that a filter after the read threw away. The keys come from the
+    // primary key's index. Expiry stays below: the column sits after the
+    // payload, and checking it here walked a 10 MB payload twice.
+    const filters = [
+      ...(variantKeys ? [`variant_key IN (${variantKeys.map(() => "?").join(", ")})`] : []),
+      ...(sourceKeys ? [`source_key IN (${sourceKeys.map(() => "?").join(", ")})`] : []),
+    ];
+    const params: string[] = [key.namespace, key.kind, key.entityKey, ...(variantKeys ?? []), ...(sourceKeys ?? [])];
     const rows = this.access.readCache("list cached resources", () => (
       this.db
-        .query<ResourceCacheRow, [string, string, string]>(
+        .query<ResourceCacheRow, string[]>(
           `SELECT namespace, kind, entity_key, variant_key, source_key, schema_version, payload, provenance,
                   fetched_at, stale_at, expires_at, last_accessed_at, size_bytes
            FROM resource_cache
-           WHERE namespace = ? AND kind = ? AND entity_key = ?`,
+           WHERE ${["namespace = ?", "kind = ?", "entity_key = ?", ...filters].join(" AND ")}`,
         )
-        .all(key.namespace, key.kind, key.entityKey)
+        .all(...params)
     )) ?? [];
 
-    const allowedVariantKeys = options.variantKeys ? new Set(options.variantKeys.map(normalizeVariantKey)) : null;
-    const allowedSourceKeys = options.sourceKeys ? new Set(options.sourceKeys.map(normalizeSourceKey)) : null;
-
     const records: CachedResourceRecord<T>[] = [];
     for (const row of sortRows(rows)) {
       if (!options.allowExpired && isExpired(row.expires_at)) continue;
-      if (allowedVariantKeys && !allowedVariantKeys.has(row.variant_key)) continue;
-      if (allowedSourceKeys && !allowedSourceKeys.has(row.source_key)) continue;
       if (options.schemaVersion != null && row.schema_version !== options.schemaVersion) {
         this.deleteExact({
           namespace: row.namespace,

package/src/data/sqlite/access.ts

@@ -43,9 +43,13 @@ const sqliteLog = debugLog.createLogger("sqlite");
  *
  * In WAL mode the connection commits with `synchronous=NORMAL`: a commit no
  * longer flushes the disk, and a power cut can cost the last few, never the
- * database. A write of user data flushes as before (`FULL`), which also
- * flushes everything committed ahead of it. Where WAL does not take (a
- * network share), every commit flushes.
+ * database. A write of user data is flushed within a second or two by the
+ * checkpointer's thread, which flushes the WAL before copying it (see
+ * checkpointer.ts): on Windows the flush took the app's thread for seconds
+ * at a time. Where nothing else flushes (a command, a checkpointer that
+ * stopped), a write of user data flushes itself (`FULL`), and with it
+ * everything committed ahead of it. Where WAL does not take (a network
+ * share), every commit flushes.
  *
  * On the app's connection the cache writes of one turn of the event loop
  * share a transaction and commit together once the turn is over: a batch of
@@ -99,6 +103,12 @@ export interface SqliteAccessOptions {
    * connection's own level is left alone.
    */
   relaxedCommits?: boolean;
+  /**
+   * Whether another thread flushes the WAL soon after each commit (the
+   * checkpointer, while it runs). A write of user data then commits at
+   * `NORMAL` like the cache's.
+   */
+  flushedElsewhere?: () => boolean;
   /** After each commit of the app's connection (see checkpointer.ts). */
   onCommit?: () => void;
 }
@@ -152,16 +162,17 @@ export function createSqliteAccess(db: Database, options: SqliteAccessOptions =
   };
 
   /**
-   * Commits `write` with a full flush when the connection's own level is
-   * NORMAL. The cache writes of the turn commit first, wherever they came
-   * from (a queued write's `settled`, the write before), so the user write
-   * never lands inside their batch at NORMAL.
+   * Commits `write` on its own, with a full flush when the connection's own
+   * level is NORMAL and nothing else flushes it. The cache writes of the turn
+   * commit first, wherever they came from (a queued write's `settled`, the
+   * write before), so the user write never lands inside their batch, which
+   * a failed commit rolls back whole.
    */
   const durable = <T>(write: () => T): T => {
     commitCacheBatch();
     durableWrites += 1;
     try {
-      if (!options.relaxedCommits || db.inTransaction) return write();
+      if (!options.relaxedCommits || db.inTransaction || options.flushedElsewhere?.()) return write();
       db.exec("PRAGMA synchronous=FULL");
       try {
         return write();