lastlight 0.15.0 → 0.16.1

package/dist/state/build-assets.js

@@ -1,154 +0,0 @@
-/**
- * Server-side store for build handoff docs ("server mode").
- *
- * In the default "repo" mode the per-phase docs (architect-plan.md, status.md,
- * executor-summary.md, reviewer-verdict.md, …) are committed into the target
- * repo under `.lastlight/<issueKey>/` and ride the working branch. In "server"
- * mode they live here instead — on the Last Light host, never committed — and
- * are staged into each sandbox phase from outside the repo (the same way skills
- * are) and harvested back after the phase runs.
- *
- * Layout mirrors the rest of `$STATE_DIR` (opencode-home/projects, sandboxes):
- *
- *   <root>/<owner>/<repo>/<issueKey>/<file>.md
- *
- * `root` defaults to `$STATE_DIR/build-assets` (override `BUILD_ASSETS_DIR`).
- * Every path segment is validated to stay inside `root` — the admin API serves
- * these by name, so traversal must be impossible.
- */
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "fs";
-import { join, resolve, sep } from "path";
-/**
- * Derive the stable per-run key used both as the store sub-path and (with a
- * `.lastlight/` prefix) as the in-repo `issueDir`. Issue-scoped runs share a
- * key by issue number; non-issue runs (explore, health, …) get a run-scoped
- * key so concurrent sessions never overlap. Mirrors the derivation that lived
- * inline in `src/workflows/simple.ts`.
- */
-export function buildAssetIssueKey(workflowName, issueNumber, workflowId) {
-    return issueNumber !== undefined
-        ? `issue-${issueNumber}`
-        : `${workflowName}-${workflowId.slice(0, 8)}`;
-}
-/**
- * A single path segment (owner / repo / issueKey / filename) is safe when it is
- * non-empty, carries no path separators, and is not a `.`/`..` traversal token.
- * GitHub owners/repos and our own issueKeys/filenames all satisfy this; anything
- * else is rejected rather than sanitized so a bad input fails loudly.
- */
-function assertSafeSegment(segment, label) {
-    if (!segment ||
-        segment === "." ||
-        segment === ".." ||
-        segment.includes("/") ||
-        segment.includes("\\") ||
-        segment.includes("\0")) {
-        throw new Error(`Unsafe build-asset ${label}: ${JSON.stringify(segment)}`);
-    }
-}
-/** True when `child` resolves to a path inside `parent`. */
-function isInside(parent, child) {
-    const p = resolve(parent);
-    const c = resolve(child);
-    return c === p || c.startsWith(p + sep);
-}
-export class BuildAssetStore {
-    root;
-    constructor(root) {
-        this.root = resolve(root);
-    }
-    /** Absolute directory for a run's doc set. Validates every segment. */
-    dirFor(ref) {
-        assertSafeSegment(ref.owner, "owner");
-        assertSafeSegment(ref.repo, "repo");
-        assertSafeSegment(ref.issueKey, "issueKey");
-        const dir = join(this.root, ref.owner, ref.repo, ref.issueKey);
-        if (!isInside(this.root, dir)) {
-            throw new Error(`build-asset dir escapes store root: ${dir}`);
-        }
-        return dir;
-    }
-    /** Absolute path for one doc file, with traversal validation on the name. */
-    fileFor(ref, file) {
-        assertSafeSegment(file, "filename");
-        const path = join(this.dirFor(ref), file);
-        if (!isInside(this.root, path)) {
-            throw new Error(`build-asset file escapes store root: ${path}`);
-        }
-        return path;
-    }
-    /** Read one doc, or undefined when it does not exist. */
-    read(ref, file) {
-        const path = this.fileFor(ref, file);
-        if (!existsSync(path))
-            return undefined;
-        return readFileSync(path, "utf-8");
-    }
-    /**
-     * Read one doc as raw bytes, or undefined when it does not exist. Same
-     * traversal validation as {@link read}, but no text decoding — the admin
-     * API uses this to serve binary artifacts (e.g. PNG screenshot evidence)
-     * intact, since `read()`'s utf-8 decode corrupts binary content.
-     */
-    readBuffer(ref, file) {
-        const path = this.fileFor(ref, file);
-        if (!existsSync(path))
-            return undefined;
-        return readFileSync(path);
-    }
-    /** Write (create or overwrite) one doc, creating the run dir as needed. */
-    write(ref, file, content) {
-        const path = this.fileFor(ref, file);
-        mkdirSync(this.dirFor(ref), { recursive: true });
-        writeFileSync(path, content);
-    }
-    /** List the `<owner>/<repo>` run keys present in the store (issueKeys). */
-    listKeys(owner, repo) {
-        assertSafeSegment(owner, "owner");
-        assertSafeSegment(repo, "repo");
-        const dir = join(this.root, owner, repo);
-        if (!isInside(this.root, dir) || !existsSync(dir))
-            return [];
-        return readdirSync(dir, { withFileTypes: true })
-            .filter((e) => e.isDirectory())
-            .map((e) => e.name)
-            .sort();
-    }
-    /** List the doc filenames stored for one run. */
-    listFiles(ref) {
-        const dir = this.dirFor(ref);
-        if (!existsSync(dir))
-            return [];
-        return readdirSync(dir, { withFileTypes: true })
-            .filter((e) => e.isFile())
-            .map((e) => e.name)
-            .sort();
-    }
-    /**
-     * Stage the run's stored docs into `localDir` (created fresh) so a sandbox
-     * phase reads prior-phase context. A no-op-with-empty-dir when nothing is
-     * stored yet — the first phase starts from a clean slate, identical to repo
-     * mode's empty `.lastlight/<issueKey>/`.
-     */
-    stageInto(ref, localDir) {
-        mkdirSync(localDir, { recursive: true });
-        const src = this.dirFor(ref);
-        if (!existsSync(src))
-            return;
-        cpSync(src, localDir, { recursive: true });
-    }
-    /**
-     * Harvest docs written by a phase back into the store, replacing the stored
-     * set with whatever the phase left in `localDir`. Last-harvest-wins; the
-     * runner is sequential per workspace so there is no concurrent writer.
-     */
-    harvestFrom(ref, localDir) {
-        if (!existsSync(localDir) || !statSync(localDir).isDirectory())
-            return;
-        const dest = this.dirFor(ref);
-        rmSync(dest, { recursive: true, force: true });
-        mkdirSync(dest, { recursive: true });
-        cpSync(localDir, dest, { recursive: true });
-    }
-}
-//# sourceMappingURL=build-assets.js.map

package/dist/state/build-assets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-assets.js","sourceRoot":"","sources":["../../src/state/build-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAS1C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,WAA+B,EAC/B,UAAkB;IAElB,OAAO,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,SAAS,WAAW,EAAE;QACxB,CAAC,CAAC,GAAG,YAAY,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,IACE,CAAC,OAAO;QACR,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa;IAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,IAAI,CAAS;IAEtB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,GAAkB;QACvB,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAkB,EAAE,IAAY;QACtC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,GAAkB,EAAE,IAAY;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,GAAkB,EAAE,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,GAAkB,EAAE,IAAY,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,KAAa,EAAE,IAAY;QAClC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7D,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,EAAE,CAAC;IACZ,CAAC;IAED,iDAAiD;IACjD,SAAS,CAAC,GAAkB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,GAAkB,EAAE,QAAgB;QAC5C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,GAAkB,EAAE,QAAgB;QAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/state/db.d.ts

@@ -1,81 +0,0 @@
-import Database from "better-sqlite3";
-import { ExecutionStore } from "./execution-store.js";
-import { ApprovalStore } from "./approval-store.js";
-import { WorkflowRunStore } from "./workflow-run-store.js";
-export type { ExecutionRecord } from "./execution-store.js";
-export type { WorkflowApproval } from "./approval-store.js";
-export type { WorkflowRun, PhaseHistoryEntry, PhaseMarker } from "./workflow-run-store.js";
-export { ExecutionStore } from "./execution-store.js";
-export { ApprovalStore } from "./approval-store.js";
-export { WorkflowRunStore } from "./workflow-run-store.js";
-export interface CronOverride {
-    name: string;
-    enabled: boolean;
-    /** Cron expression overriding the YAML default; null means use the YAML value. */
-    schedule: string | null;
-    updatedAt: string;
-    updatedBy: string | null;
-}
-/**
- * Per-workflow kill switch persisted to SQLite. When `enabled` is false,
- * `runSimpleWorkflow` short-circuits and does not create a `workflow_runs`
- * row — applies to every trigger source (cron, webhooks, mentions, Slack).
- * No row at all means "enabled" (default).
- */
-export interface WorkflowOverride {
-    name: string;
-    enabled: boolean;
-    updatedAt: string;
-    updatedBy: string | null;
-}
-/**
- * Lightweight SQLite state for operational tracking.
- * NOT for conversation history — only execution logs and rate limits.
- *
- * Construction root for the three per-table stores (issue #97): it opens the
- * single `Database` connection, runs {@link migrate}, and builds
- * {@link ExecutionStore} / {@link ApprovalStore} / {@link WorkflowRunStore} on
- * top of it (all sharing the one connection so better-sqlite3 transactions
- * span every store). Callers reach the stores via `db.runs` / `db.approvals` /
- * `db.executions`. StateDb itself retains only the cross-cutting cron-override
- * and workflow kill-switch concerns.
- */
-export declare class StateDb {
-    private db;
-    /** Owns the `executions` ledger. */
-    readonly executions: ExecutionStore;
-    /** Owns the `workflow_approvals` table. */
-    readonly approvals: ApprovalStore;
-    /** Aggregate root for `workflow_runs` + the atomic lifecycle operations. */
-    readonly runs: WorkflowRunStore;
-    constructor(dbPath?: string);
-    /** Get the override row for a single cron, or null if none. */
-    getCronOverride(name: string): CronOverride | null;
-    /** All override rows keyed by cron name. */
-    getAllCronOverrides(): Map<string, CronOverride>;
-    /**
-     * Upsert an override. Pass only the fields you want to change — undefined
-     * fields preserve the existing value (or default to enabled=1, schedule=null
-     * on insert).
-     */
-    setCronOverride(name: string, patch: {
-        enabled?: boolean;
-        schedule?: string | null;
-        updatedBy?: string;
-    }): void;
-    /** Remove the override entirely (revert to YAML defaults). */
-    clearCronOverride(name: string): void;
-    private deserializeCronOverride;
-    /**
-     * Cheap check used by every dispatch path. Returns true unless an explicit
-     * `workflow_overrides` row says otherwise.
-     */
-    isWorkflowEnabled(name: string): boolean;
-    getWorkflowOverride(name: string): WorkflowOverride | null;
-    getAllWorkflowOverrides(): Map<string, WorkflowOverride>;
-    setWorkflowEnabled(name: string, enabled: boolean, updatedBy?: string): void;
-    private deserializeWorkflowOverride;
-    /** Expose the underlying Database instance (for SessionManager, etc.) */
-    get database(): Database.Database;
-    close(): void;
-}

package/dist/state/db.js

@@ -1,155 +0,0 @@
-import Database from "better-sqlite3";
-import { resolve } from "path";
-import { migrate } from "./migrate.js";
-import { ExecutionStore } from "./execution-store.js";
-import { ApprovalStore } from "./approval-store.js";
-import { WorkflowRunStore } from "./workflow-run-store.js";
-export { ExecutionStore } from "./execution-store.js";
-export { ApprovalStore } from "./approval-store.js";
-export { WorkflowRunStore } from "./workflow-run-store.js";
-const DEFAULT_DB_PATH = "lastlight.db";
-/**
- * Lightweight SQLite state for operational tracking.
- * NOT for conversation history — only execution logs and rate limits.
- *
- * Construction root for the three per-table stores (issue #97): it opens the
- * single `Database` connection, runs {@link migrate}, and builds
- * {@link ExecutionStore} / {@link ApprovalStore} / {@link WorkflowRunStore} on
- * top of it (all sharing the one connection so better-sqlite3 transactions
- * span every store). Callers reach the stores via `db.runs` / `db.approvals` /
- * `db.executions`. StateDb itself retains only the cross-cutting cron-override
- * and workflow kill-switch concerns.
- */
-export class StateDb {
-    db;
-    /** Owns the `executions` ledger. */
-    executions;
-    /** Owns the `workflow_approvals` table. */
-    approvals;
-    /** Aggregate root for `workflow_runs` + the atomic lifecycle operations. */
-    runs;
-    constructor(dbPath) {
-        // ":memory:" stays a real per-connection in-memory DB (used by tests for
-        // isolation) — only filesystem paths go through resolve(). Previously
-        // resolve(":memory:") produced a shared on-disk file named ":memory:",
-        // which let parallel test files contend on one DB and deadlock once the
-        // stores started holding write transactions.
-        const target = dbPath === ":memory:" ? ":memory:" : resolve(dbPath || DEFAULT_DB_PATH);
-        this.db = new Database(target);
-        this.db.pragma("journal_mode = WAL");
-        migrate(this.db);
-        this.executions = new ExecutionStore(this.db);
-        this.approvals = new ApprovalStore(this.db);
-        this.runs = new WorkflowRunStore(this.db, { approvals: this.approvals });
-    }
-    // ── Cron overrides ─────────────────────────────────────────────
-    /** Get the override row for a single cron, or null if none. */
-    getCronOverride(name) {
-        const row = this.db
-            .prepare(`SELECT name, enabled, schedule, updated_at, updated_by FROM cron_overrides WHERE name = ?`)
-            .get(name);
-        return row ? this.deserializeCronOverride(row) : null;
-    }
-    /** All override rows keyed by cron name. */
-    getAllCronOverrides() {
-        const rows = this.db
-            .prepare(`SELECT name, enabled, schedule, updated_at, updated_by FROM cron_overrides`)
-            .all();
-        const map = new Map();
-        for (const row of rows) {
-            const o = this.deserializeCronOverride(row);
-            map.set(o.name, o);
-        }
-        return map;
-    }
-    /**
-     * Upsert an override. Pass only the fields you want to change — undefined
-     * fields preserve the existing value (or default to enabled=1, schedule=null
-     * on insert).
-     */
-    setCronOverride(name, patch) {
-        const now = new Date().toISOString();
-        const existing = this.getCronOverride(name);
-        const enabled = patch.enabled ?? existing?.enabled ?? true;
-        const schedule = patch.schedule === undefined ? existing?.schedule ?? null : patch.schedule;
-        this.db
-            .prepare(`INSERT INTO cron_overrides (name, enabled, schedule, updated_at, updated_by)
-         VALUES (?, ?, ?, ?, ?)
-         ON CONFLICT(name) DO UPDATE SET
-           enabled = excluded.enabled,
-           schedule = excluded.schedule,
-           updated_at = excluded.updated_at,
-           updated_by = excluded.updated_by`)
-            .run(name, enabled ? 1 : 0, schedule, now, patch.updatedBy ?? null);
-    }
-    /** Remove the override entirely (revert to YAML defaults). */
-    clearCronOverride(name) {
-        this.db.prepare(`DELETE FROM cron_overrides WHERE name = ?`).run(name);
-    }
-    deserializeCronOverride(row) {
-        return {
-            name: row.name,
-            enabled: row.enabled === 1,
-            schedule: row.schedule ?? null,
-            updatedAt: row.updated_at,
-            updatedBy: row.updated_by ?? null,
-        };
-    }
-    // ── Workflow overrides (kill switch) ───────────────────────────
-    /**
-     * Cheap check used by every dispatch path. Returns true unless an explicit
-     * `workflow_overrides` row says otherwise.
-     */
-    isWorkflowEnabled(name) {
-        const row = this.db
-            .prepare(`SELECT enabled FROM workflow_overrides WHERE name = ?`)
-            .get(name);
-        if (!row)
-            return true;
-        return row.enabled === 1;
-    }
-    getWorkflowOverride(name) {
-        const row = this.db
-            .prepare(`SELECT name, enabled, updated_at, updated_by FROM workflow_overrides WHERE name = ?`)
-            .get(name);
-        return row ? this.deserializeWorkflowOverride(row) : null;
-    }
-    getAllWorkflowOverrides() {
-        const rows = this.db
-            .prepare(`SELECT name, enabled, updated_at, updated_by FROM workflow_overrides`)
-            .all();
-        const map = new Map();
-        for (const row of rows) {
-            const o = this.deserializeWorkflowOverride(row);
-            map.set(o.name, o);
-        }
-        return map;
-    }
-    setWorkflowEnabled(name, enabled, updatedBy) {
-        const now = new Date().toISOString();
-        this.db
-            .prepare(`INSERT INTO workflow_overrides (name, enabled, updated_at, updated_by)
-         VALUES (?, ?, ?, ?)
-         ON CONFLICT(name) DO UPDATE SET
-           enabled = excluded.enabled,
-           updated_at = excluded.updated_at,
-           updated_by = excluded.updated_by`)
-            .run(name, enabled ? 1 : 0, now, updatedBy ?? null);
-    }
-    deserializeWorkflowOverride(row) {
-        return {
-            name: row.name,
-            enabled: row.enabled === 1,
-            updatedAt: row.updated_at,
-            updatedBy: row.updated_by ?? null,
-        };
-    }
-    /** Expose the underlying Database instance (for SessionManager, etc.) */
-    get database() {
-        return this.db;
-    }
-    close() {
-        this.db.close();
-    }
-}
-//# sourceMappingURL=db.js.map

package/dist/state/db.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/state/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAU3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,eAAe,GAAG,cAAc,CAAC;AAwBvC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,OAAO;IACV,EAAE,CAAoB;IAE9B,oCAAoC;IAC3B,UAAU,CAAiB;IACpC,2CAA2C;IAClC,SAAS,CAAgB;IAClC,4EAA4E;IACnE,IAAI,CAAmB;IAEhC,YAAY,MAAe;QACzB,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;QACvF,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,kEAAkE;IAElE,+DAA+D;IAC/D,eAAe,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,2FAA2F,CAAC;aACpG,GAAG,CAAC,IAAI,CAAwC,CAAC;QACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,mBAAmB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,4EAA4E,CAAC;aACrF,GAAG,EAA+B,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC5C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,eAAe,CACb,IAAY,EACZ,KAA0E;QAE1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5F,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;4CAMoC,CACrC;aACA,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,8DAA8D;IAC9D,iBAAiB,CAAC,IAAY;QAC5B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAEO,uBAAuB,CAAC,GAA4B;QAC1D,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,OAAO,EAAG,GAAG,CAAC,OAAkB,KAAK,CAAC;YACtC,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;YACjD,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,kEAAkE;IAElE;;;OAGG;IACH,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,IAAI,CAAoC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,qFAAqF,CAAC;aAC9F,GAAG,CAAC,IAAI,CAAwC,CAAC;QACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,uBAAuB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,sEAAsE,CAAC;aAC/E,GAAG,EAA+B,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,OAAgB,EAAE,SAAkB;QACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;4CAKoC,CACrC;aACA,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;IACxD,CAAC;IAEO,2BAA2B,CAAC,GAA4B;QAC9D,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,OAAO,EAAG,GAAG,CAAC,OAAkB,KAAK,CAAC;YACtC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/state/execution-store.d.ts

@@ -1,257 +0,0 @@
-import type Database from "better-sqlite3";
-export interface ExecutionRecord {
-    id: string;
-    triggerType: "webhook" | "cron" | "chat" | "api";
-    triggerId: string;
-    skill: string;
-    repo?: string;
-    issueNumber?: number;
-    startedAt: string;
-    finishedAt?: string;
-    success?: boolean;
-    error?: string;
-    turns?: number;
-    durationMs?: number;
-    /**
-     * Runtime session id (OpenCode `ses_…`) captured from the event stream.
-     * Used by the dashboard to look up the session log for a given phase.
-     */
-    sessionId?: string;
-    /** Total USD cost reported by the runtime on the final step. Zero under OAuth/subscription auth. */
-    costUsd?: number;
-    /** Fresh input tokens (no cache hit). */
-    inputTokens?: number;
-    /** Tokens that triggered a cache write. */
-    cacheCreationInputTokens?: number;
-    /** Tokens served from prompt cache. */
-    cacheReadInputTokens?: number;
-    /** Output tokens generated by the model. */
-    outputTokens?: number;
-    /** API-side duration (excludes orchestrator overhead). */
-    apiDurationMs?: number;
-    /** Result subtype, e.g. "success" or "error_max_turns". */
-    stopReason?: string;
-    /**
-     * JSON-serialized {@link ExtensionStatusMap} — which agentic-pi extensions
-     * (file-search / github / web-search) were active for this execution.
-     */
-    extensionStatus?: string;
-    /**
-     * JSON-serialized {@link SkillsStatus} — agentic-pi's skill-loading status
-     * for this execution (which skills were discovered/available). Null when
-     * the run reported no skills.
-     */
-    skillsStatus?: string;
-    /**
-     * Workflow run that owns this execution. Scopes dedup: a fresh re-trigger
-     * creates a new workflow_run_id, so `shouldRunPhase` won't find matching
-     * rows from the prior run and will correctly run the phase again.
-     */
-    workflowRunId?: string;
-}
-/**
- * Owns every read/write against the `executions` table — the harness's
- * append-only ledger of agent runs. The dashboard derives phase status from
- * this table (primary source, ahead of the `phase_history` fallback), and the
- * runner's resume path skips already-completed phases via {@link shouldRunPhase}.
- *
- * Carved out of the old `StateDb` god-class (issue #97). Constructed from the
- * single shared `Database` so it sits in the same connection / transaction
- * scope as the other stores.
- */
-export declare class ExecutionStore {
-    private db;
-    constructor(db: Database.Database);
-    recordStart(record: Omit<ExecutionRecord, "finishedAt" | "success" | "error" | "turns" | "durationMs">): void;
-    /**
-     * Mid-run update: persist the agent session id as soon as the executor sees
-     * the stream-json `system/init` line. Lets the dashboard surface the live
-     * session log for an in-flight phase, not just for completed ones.
-     */
-    recordSessionId(id: string, sessionId: string): void;
-    /**
-     * Persist the final assistant text for a loop-iteration execution.
-     * Used by the runner when a scratch slot would otherwise inline the
-     * full LLM output into `workflow_runs.scratch` — the scratch entry
-     * stores `lastOutputExecutionId` and resolves the text through
-     * `getExecutionOutput` on read.
-     */
-    recordOutputText(id: string, output: string): void;
-    /** Read the persisted output text for an execution, or null if none. */
-    getExecutionOutput(id: string): string | null;
-    /**
-     * Most recent finished execution's `output_text` for a phase (`skill`), or
-     * null. Used by the reviewer loop on resume to re-derive a completed review's
-     * verdict from its persisted output (a dedup-`done` review must not be
-     * assumed APPROVED — it may have requested changes).
-     */
-    getPhaseOutput(skill: string, triggerId: string, workflowRunId?: string): string | null;
-    recordFinish(id: string, result: {
-        success: boolean;
-        error?: string;
-        turns?: number;
-        durationMs?: number;
-        sessionId?: string;
-        costUsd?: number;
-        inputTokens?: number;
-        cacheCreationInputTokens?: number;
-        cacheReadInputTokens?: number;
-        outputTokens?: number;
-        apiDurationMs?: number;
-        stopReason?: string;
-        /** JSON-serialized ExtensionStatusMap (extensions active this run). */
-        extensionStatus?: string;
-        /** JSON-serialized SkillsStatus (skills available this run). */
-        skillsStatus?: string;
-    }): void;
-    /**
-     * Record a phase that the scheduler skipped because its trigger rule was
-     * not satisfied (a failed/skipped upstream cascaded down a chain). The
-     * executions ledger is the single source of truth the dashboard derives
-     * phase status from, so skips are written here too — as a finished,
-     * non-successful row (`success = 0`, `stop_reason = 'skipped'`). Because it
-     * is not `success = 1`, `shouldRunPhase` re-evaluates it on resume (the node
-     * will simply be re-skipped if the upstream is still failed).
-     */
-    recordSkippedPhase(skill: string, triggerId: string, workflowRunId?: string, repo?: string): void;
-    /**
-     * List chat threads aggregated from the executions table.
-     *
-     * Each row collapses every execution sharing a `trigger_id` (the messaging
-     * session id) into one summary so the dashboard's chat-sessions tab can
-     * show one card per Slack thread, not one per turn. Joined with
-     * `messaging_sessions` for the agent SDK session id (used to resolve to
-     * the on-disk jsonl when streaming messages) and with `messaging_messages`
-     * for the most recent assistant text (preview snippet).
-     */
-    listChatThreads(limit: number): {
-        triggerId: string;
-        agentSessionId: string | null;
-        platform: string | null;
-        firstStartedAt: string;
-        lastActivityAt: string;
-        turnCount: number;
-        totalCost: number;
-        inputTokens: number;
-        outputTokens: number;
-        cacheReadTokens: number;
-        lastAssistantContent: string | null;
-    }[];
-    /** Look up a single chat thread by its messaging session id (= trigger_id). */
-    getChatThread(triggerId: string): {
-        triggerId: string;
-        agentSessionId: string | null;
-        platform: string | null;
-        firstStartedAt: string;
-        lastActivityAt: string;
-        turnCount: number;
-        totalCost: number;
-        inputTokens: number;
-        outputTokens: number;
-        cacheReadTokens: number;
-        lastAssistantContent: string | null;
-    } | null;
-    /** Check if a skill is currently running for a given trigger */
-    isRunning(skill: string, triggerId: string): boolean;
-    /** Check if a skill has already completed successfully for a given trigger */
-    isCompleted(skill: string, triggerId: string): boolean;
-    /**
-     * Check if a phase should run: not currently running AND not already
-     * succeeded. When `workflowRunId` is provided, scopes the check to that
-     * specific run — a fresh re-trigger (new workflow_run_id) will see no
-     * matching rows and correctly return "run" even if a prior completed run
-     * for the same trigger exists. Omit `workflowRunId` for legacy callers
-     * (e.g. chat/status-report dedup) that want the old trigger-wide scope.
-     */
-    shouldRunPhase(skill: string, triggerId: string, workflowRunId?: string): "run" | "running" | "done";
-    /** Mark all stale "running" executions for a skill/trigger as failed.
-     *  Called when we detect no matching Docker container is alive. */
-    markStaleAsFailed(skill: string, triggerId: string, workflowRunId?: string): number;
-    /**
-     * Mark every unfinished execution row for a trigger as failed, regardless
-     * of skill. Used by the boot-time recovery sweep to clear out phases that
-     * were running when the harness crashed/restarted, so the runner's dedup
-     * logic doesn't think they're still in flight.
-     */
-    markAllStaleForTrigger(triggerId: string, reason: string): number;
-    /**
-     * Mark the most recent execution for a skill/trigger as failed.
-     * Used when the agent SDK reported success but the orchestrator decided
-     * the business outcome was a failure (e.g. guardrails BLOCKED, reviewer
-     * REQUEST_CHANGES). Without this, runPhase would skip the phase on the
-     * next run because the DB still says success=1.
-     */
-    markLatestAsFailed(skill: string, triggerId: string, reason: string, workflowRunId?: string): number;
-    /** Get recent executions for a skill */
-    recentExecutions(skill: string, limit?: number): ExecutionRecord[];
-    /** Count consecutive failures for a skill (for cron failure tracking) */
-    consecutiveFailures(skill: string): number;
-    /** Get all executions with pagination */
-    allExecutions(limit?: number, offset?: number): ExecutionRecord[];
-    /**
-     * Free-text search across the `executions` ledger — matches `error`, `skill`,
-     * or `repo` against a substring (case-insensitive via SQLite's LIKE). Used by
-     * the `/admin/api/log-search` endpoint and the `lastlight logs search` CLI to
-     * find failing/relevant phases without SSHing to the box. Parameterized; the
-     * pattern is escaped so user input can't smuggle LIKE wildcards.
-     */
-    searchErrors(query: string, limit?: number): Array<{
-        id: string;
-        skill: string;
-        repo?: string;
-        error?: string;
-        success?: boolean;
-        startedAt: string;
-        finishedAt?: string;
-        sessionId?: string;
-        workflowRunId?: string;
-        triggerId: string;
-    }>;
-    /**
-     * Get every execution recorded for a workflow run, with camelCase fields
-     * ready for the dashboard. Ordered by start time ascending so phases
-     * display in the order they ran. Scopes to a specific `workflow_run_id`
-     * when provided (preferred — isolates fresh re-triggers from prior runs);
-     * falls back to the legacy trigger-wide scope for rows written before the
-     * workflow_run_id column existed.
-     */
-    getExecutionsForWorkflowRun(workflowRunId: string, triggerId: string, workflowName?: string): ExecutionRecord[];
-    /** Get currently running executions (no finished_at) */
-    runningExecutions(): ExecutionRecord[];
-    /** Aggregate execution stats */
-    executionStats(): {
-        total_executions: number;
-        today_count: number;
-        by_skill: Record<string, {
-            count: number;
-            success: number;
-            fail: number;
-        }>;
-        by_trigger: Record<string, number>;
-        running: number;
-    };
-    /** Daily aggregated stats for the last N days */
-    dailyStats(days: number): {
-        date: string;
-        executions: number;
-        successes: number;
-        failures: number;
-        totalTokens: number;
-        inputTokens: number;
-        outputTokens: number;
-        cacheReadTokens: number;
-        costUsd: number;
-    }[];
-    /** Hourly aggregated stats for the last N hours (UTC). Bucket key is `YYYY-MM-DDTHH`. */
-    hourlyStats(hours: number): {
-        date: string;
-        executions: number;
-        successes: number;
-        failures: number;
-        totalTokens: number;
-        inputTokens: number;
-        outputTokens: number;
-        cacheReadTokens: number;
-        costUsd: number;
-    }[];
-}