luckytri 1.1.2 → 1.2.0

package/server/mind/view.js

@@ -1,4 +1,3 @@
-import { summarizeGroupStyle } from "../core/group-style.js";
 import { relevantContext, boundMindContext } from "./context-selection.js";
 import { interestTerms } from "./attention.js";
 import { agoLabel, elapsedLabel } from "./clock.js";
@@ -40,44 +39,6 @@ const FEEDBACK = {
   natural: "挺自然",
 };
 
-// The way a room talks is read as of `now`, not as of the wall clock: a replay
-// or a test that moves the clock must see the room as it was at that moment.
-function groupStyle(mind, session, now) {
-  try {
-    const rows = mind.db
-      .prepare(
-        "SELECT * FROM (SELECT * FROM messages WHERE session_id=? AND is_demo=0 AND time<=? ORDER BY id DESC LIMIT 200) ORDER BY id",
-      )
-      .all(session, now + 60000);
-    const ids = rows.map((row) => row.event_id).filter(Boolean);
-    const bots = new Set(
-      mind.relationships
-        .context({ room: session, now, limit: 100 })
-        .known.filter((p) => p.kind === "bot")
-        .map((p) => String(p.subjectId)),
-    );
-    const away = ids.length
-      ? new Set(
-          mind.db
-            .prepare(
-              `SELECT e.event_id FROM core_events e JOIN mind_unlived u ON u.seq=e.seq WHERE e.event_id IN (${ids.map(() => "?").join(",")})`,
-            )
-            .all(...ids)
-            .map((row) => row.event_id),
-        )
-      : new Set();
-    const profile = summarizeGroupStyle(
-      rows.filter(
-        (row) => !away.has(row.event_id) && !bots.has(String(row.user_id)),
-      ),
-      now,
-    );
-    return profile.ready ? profile.summary : "";
-  } catch {
-    return "";
-  }
-}
-
 function feedback(mind, session, now) {
   return mind.db
     .prepare(
@@ -153,18 +114,20 @@ export function innerView(
         { cues, limit: 2, requireOverlap: true },
       );
   const shownLiving = living && carries(living) ? living : null;
+  const remindedSelf = mind.self
+    .reminded({ before: now, now, cues, limit: 2 })
+    .filter(carries);
+  const remindedThoughts = mind.thoughts
+    .reminded({ now, cues, session, limit: 1 })
+    .filter((t) => mind.meetings.sayable(t.content, session));
   const reminded = [
-    ...mind.self
-      .reminded({ before: now, now, cues, limit: 2 })
-      .filter(carries)
-      .map((t) => `${SELF_KINDS[t.kind]}：${text(t.content, 80)}${FORGOTTEN}`),
-    ...mind.thoughts
-      .reminded({ now, cues, session, limit: 1 })
-      .filter((t) => mind.meetings.sayable(t.content, session))
-      .map(
-        (t) =>
-          `${elapsedLabel(t.created, now, mind.timeZone())}想到：${text(t.content, 110)}${FORGOTTEN}`,
-      ),
+    ...remindedSelf.map(
+      (t) => `${SELF_KINDS[t.kind]}：${text(t.content, 80)}${FORGOTTEN}`,
+    ),
+    ...remindedThoughts.map(
+      (t) =>
+        `${elapsedLabel(t.created, now, mind.timeZone())}想到：${text(t.content, 110)}${FORGOTTEN}`,
+    ),
     ...mind.meetings
       .reminded({ session, now, cues, limit: 1 })
       .filter((line) => mind.meetings.sayable(line, session))
@@ -184,7 +147,6 @@ export function innerView(
   const read = mind.reading
     .recent({ now, limit: 2 })
     .filter((r) => r.created > now - 7 * DAY);
-  const room = kind === "group" ? groupStyle(mind, session, now) : "";
   const spoken = (value) =>
     value && mind.meetings.sayable(value, session) ? value : "";
   const self = {
@@ -286,9 +248,12 @@ export function innerView(
   const heard = feedback(mind, session, now);
   const continuity = mind.continuity.recall({ session, people, cue, now });
   const justLived = mind.continuity.justLived({ session, people, now });
-  const expecting = mind.anticipations
-    .upcoming({ now, people, session, limit: 3 })
-    .map((a) => a.text);
+  const upcoming = mind.anticipations.upcoming({
+    now,
+    people,
+    session,
+    limit: 3,
+  });
   const withWhom = mind.meetings.recall({
     session,
     people,
@@ -325,28 +290,33 @@ export function innerView(
     }));
   const selfKnown = {
     note: "你在每个地方都是同一个人。这是你现在的状态、心情和亲近的人，你知道，不必向眼前的人汇报。",
-    state: `${affect.phaseLabel}，精力${affect.energyLabel}，心情${affect.mood}${cause ? `（${cause}）` : ""}`,
+    // Her mood is said once, in inner.state, where it shapes how she talks.
+    // A second copy here sat under "not something to report" and read as a
+    // reason to keep it out of her voice (round-19 happy-mood probe).
     ...(shownLiving ? { livingFor: text(shownLiving.content, 80) } : {}),
     ...(closeTo.length ? { closeTo } : {}),
   };
   const withLines = withWhom.filter(
     (line) => !fixedReplyHabit(line) && mind.meetings.sayable(line, session),
   );
-  const expectingLines = expecting.filter((line) =>
-    mind.meetings.sayable(line, session),
+  const expectingShown = upcoming.filter((a) =>
+    mind.meetings.sayable(a.text, session),
   );
+  const expectingLines = expectingShown.map((a) => a.text);
   const senses = mind.senses?.lines({ kind, now }) || [];
   const body = (mind.body?.({ kind, now }) || [])
     .map((line) => text(line, 80))
     .filter(Boolean)
     .slice(0, 8);
-  return boundMindContext({
+  const ownVoice = ownTyping(mind, session, now);
+  const view = boundMindContext({
     self,
     affect: cause ? affect : { ...affect, cause: "" },
     inner: {
       currentLife: mind.time.view({ session, now, cue, activityCue }),
-      state: `${affect.phaseLabel}，精力${affect.energyLabel}，心情${affect.mood}${cause ? `（${cause}）` : ""}${affect.lately ? `，${affect.lately}` : ""}`,
+      state: `${affect.phaseLabel}，精力${affect.energyLabel}，心情${affect.mood}${feltStrength(affect.lingering)}${cause ? `（${cause}）` : ""}${affect.lately ? `，${affect.lately}` : ""}`,
       selfKnown,
+      ...(ownVoice ? { ownVoice } : {}),
       ...(persons.length ? { people: persons } : {}),
       ...(relationships.known.length ? { relationships } : {}),
       ...(continuity ? { continuity } : {}),
@@ -373,10 +343,80 @@ export function innerView(
       ...(will ? { will } : {}),
       ...(stood.length ? { stood } : {}),
       ...(reminded.length ? { reminded } : {}),
-      ...(room ? { room } : {}),
       ...(heard.length ? { heard } : {}),
       ...(senses.length ? { senses } : {}),
       ...(body.length ? { body } : {}),
     },
   });
+  // Which of her past made it into this view after the allowance, for the
+  // record of what came to mind. Not part of what the model reads.
+  const shown = (owner, key, ids) =>
+    ids.slice(0, Array.isArray(owner?.[key]) ? owner[key].length : 0);
+  Object.defineProperty(view, "recalled", {
+    enumerable: false,
+    value: [
+      ...shown(
+        view.self,
+        "threads",
+        visibleThreads.map((t) => `self:${t.thread}`),
+      ).map((id) => ({ id, why: "core" })),
+      ...shown(
+        view.inner,
+        "relatedSelf",
+        relatedSelf.map((t) => `self:${t.thread}`),
+      ).map((id) => ({ id, why: meant ? "semantic" : "lexical" })),
+      ...shown(
+        view.inner,
+        "onMind",
+        thoughts.map((t) => `thought:${t.id}`),
+      ).map((id) => ({ id, why: "on_mind" })),
+      ...shown(view.inner, "reminded", [
+        ...remindedSelf.map((t) => `self:${t.thread}`),
+        ...remindedThoughts.map((t) => `thought:${t.id}`),
+      ]).map((id) => ({ id, why: "reminded" })),
+      ...shown(
+        view.inner,
+        "expecting",
+        expectingShown.map((a) => `anticipation:${a.id}`),
+      ).map((id) => ({ id, why: "expecting" })),
+    ],
+  });
+  return view;
+}
+
+// Whether the latest feeling is still strong or already fading. It decays
+// with time (affect.js), so what happened earlier keeps colouring how she
+// speaks for a while and then lets go.
+function feltStrength(lingering = 0) {
+  if (lingering >= 0.5) return "，还挺明显";
+  if (lingering >= 0.25) return "，淡了些";
+  return "";
+}
+
+// How she herself has been typing lately: her own habit, read from what she
+// actually sent (here first, then anywhere), never from how others type. It
+// lets the voice she has grown carry on instead of being re-derived from the
+// initial design each turn. Fewer than four of her own messages means no habit yet.
+export function ownTyping(mind, session, now) {
+  try {
+    const pick = (where, ...args) =>
+      mind.db
+        .prepare(
+          `SELECT text FROM messages WHERE role='assistant' AND is_demo=0 AND time<=? AND time>? ${where} ORDER BY id DESC LIMIT 40`,
+        )
+        .all(now + 60000, now - 14 * 86400000, ...args)
+        .map((row) => String(row.text || "").trim())
+        .filter((t) => t && !/^\[/.test(t));
+    let lines = pick("AND session_id=?", session);
+    if (lines.length < 4) lines = pick("");
+    if (lines.length < 4) return "";
+    const lengths = lines
+      .map((t) => Array.from(t).length)
+      .sort((a, b) => a - b);
+    const median = lengths[Math.floor(lengths.length / 2)];
+    const stops = lines.filter((t) => /[。.]$/.test(t)).length / lines.length;
+    return `你最近自己发的一条消息常见约 ${median} 字${stops < 0.25 ? "，句末常不带句号" : ""}`;
+  } catch {
+    return "";
+  }
 }

package/server/plugins/install.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { lookup } from "node:dns/promises";
-import { cpSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { mkdirSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { assertPublicHost } from "../core/net-guard.js";
 import { VERSION } from "../version.js";
@@ -288,8 +288,3 @@ export function createInstaller(host) {
 function bytesToText(bytes) {
   return Buffer.from(bytes).toString("utf8");
 }
-
-export function copyPlugin(from, to) {
-  mkdirSync(to, { recursive: true });
-  cpSync(from, to, { recursive: true });
-}

package/server/plugins/zip.js

@@ -1,6 +1,6 @@
 import { inflateRawSync } from "node:zlib";
 import { mkdirSync, writeFileSync } from "node:fs";
-import { dirname, join, normalize } from "node:path";
+import { dirname, join, normalize, resolve, sep } from "node:path";
 
 const MAX_FILES = 200;
 const MAX_BYTES = 60 * 1024 * 1024;
@@ -76,8 +76,21 @@ export function readZip(buffer) {
       buffer.readUInt16LE(local + 26) +
       buffer.readUInt16LE(local + 28);
     const compressed = buffer.subarray(dataAt, dataAt + compressedSize);
-    const bytes =
-      method === 0 ? Buffer.from(compressed) : inflateRawSync(compressed);
+    // The size a stranger's header declares is not trusted: inflation itself
+    // stops at what is still allowed, so one entry cannot exhaust memory.
+    let bytes;
+    try {
+      bytes =
+        method === 0
+          ? Buffer.from(compressed)
+          : inflateRawSync(compressed, {
+              maxOutputLength: MAX_BYTES - total + 1,
+            });
+    } catch (error) {
+      if (error?.code === "ERR_BUFFER_TOO_LARGE")
+        throw new Error("压缩包解压后过大");
+      throw new Error("压缩包无法读取");
+    }
     if (size && bytes.length !== size) throw new Error("压缩包内容不完整");
     total += bytes.length;
     if (total > MAX_BYTES) throw new Error("压缩包解压后过大");
@@ -105,7 +118,8 @@ export function writeTree(dir, files) {
       dir,
       ...normalize(file.name).split(/[\\/]/).filter(Boolean),
     );
-    if (!target.startsWith(dir)) throw new Error("压缩包路径无效");
+    const root = resolve(dir) + sep;
+    if (!resolve(target).startsWith(root)) throw new Error("压缩包路径无效");
     mkdirSync(dirname(target), { recursive: true });
     writeFileSync(target, file.bytes);
   }

package/server/runtime/data-migration.js

@@ -0,0 +1,193 @@
+import { existsSync, statSync, unlinkSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { Repository } from "../core/repository.js";
+import { Mind } from "../mind/index.js";
+import {
+  archiveIdentity,
+  DATABASE_VERSION,
+  inspectDatabase,
+} from "../storage/archive.js";
+import { createStore } from "../storage/store.js";
+import { VERSION } from "../version.js";
+
+// Bump this only when an update needs a new full pass over durable memory.
+export const RELEASE_DATA_MIGRATION_ID = "memory-index-v1.2.0";
+
+const DERIVED = new Set([
+  "core_vector_buckets",
+  "mind_index",
+  "mind_index_people",
+  "mind_roots",
+  "mind_rooted",
+  "mind_vectors",
+]);
+
+function quoted(name) {
+  return `"${String(name).replaceAll('"', '""')}"`;
+}
+
+function rowCounts(db) {
+  const result = {};
+  const tables = db
+    .prepare(
+      "SELECT name,sql FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name",
+    )
+    .all();
+  for (const table of tables) {
+    if (
+      DERIVED.has(table.name) ||
+      /_fts(?:_|$)/i.test(table.name) ||
+      /CREATE\s+VIRTUAL\s+TABLE/i.test(table.sql || "")
+    )
+      continue;
+    result[table.name] = Number(
+      db.prepare(`SELECT COUNT(*) n FROM ${quoted(table.name)}`).get().n,
+    );
+  }
+  return result;
+}
+
+export function durableRowCounts(file) {
+  const db = new DatabaseSync(file, { readOnly: true });
+  try {
+    return rowCounts(db);
+  } finally {
+    db.close();
+  }
+}
+
+export function assertDurableRowsPreserved(before, after) {
+  for (const [table, count] of Object.entries(before)) {
+    if (!(table in after)) throw Error(`迁移后缺少原数据表：${table}`);
+    if (after[table] < count)
+      throw Error(
+        `迁移后 ${table} 记录数减少（${count} → ${after[table]}），已停止更新`,
+      );
+  }
+}
+
+const scalar = (db, table) => {
+  const exists = db
+    .prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?")
+    .get(table);
+  return exists
+    ? Number(db.prepare(`SELECT COUNT(*) n FROM ${quoted(table)}`).get().n)
+    : 0;
+};
+
+export async function migrateReleaseData(
+  mind,
+  { fromVersion = "", version = VERSION, now = Date.now } = {},
+) {
+  const repo = mind.repo;
+  const existing = repo.config("release-data-migration", null);
+  if (existing?.id === RELEASE_DATA_MIGRATION_ID)
+    return { ...existing, skipped: true };
+
+  const at = typeof now === "function" ? now() : now;
+  const before = {
+    messages: scalar(repo.db, "core_events"),
+    facts: scalar(repo.db, "core_memories"),
+    thoughts: scalar(repo.db, "mind_thoughts"),
+    episodes: scalar(repo.db, "mind_episodes"),
+    self: scalar(repo.db, "mind_self"),
+    diaries: scalar(repo.db, "mind_diary"),
+    plans: scalar(repo.db, "mind_anticipations"),
+    works: scalar(repo.db, "mind_time_works"),
+  };
+
+  console.error(
+    "正在按当前版本重建记忆索引与经历关联；原始记忆和向量数据会保留。",
+  );
+  await mind.recall.prepare(at, { vectors: false });
+
+  let rooted = 0;
+  for (;;) {
+    const count = mind.recall.fillRoots(500, { strict: true });
+    rooted += count;
+    if (!count) break;
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+
+  const report = {
+    id: RELEASE_DATA_MIGRATION_ID,
+    fromVersion: fromVersion || existing?.version || "unknown",
+    version,
+    databaseVersion: DATABASE_VERSION,
+    completed: at,
+    rows: before,
+    indexes: {
+      memories: scalar(repo.db, "mind_index"),
+      roots: scalar(repo.db, "mind_roots"),
+      rooted: scalar(repo.db, "mind_rooted"),
+      rootRecordsProcessed: rooted,
+    },
+  };
+  repo.saveConfig("release-data-migration", report);
+  console.error(
+    `记忆迁移完成：${report.indexes.memories} 条索引，${report.indexes.rooted} 条经历关联记录；没有重新发送或嵌入记忆。`,
+  );
+  return report;
+}
+
+export async function migrateDatabaseFile(
+  file,
+  { fromVersion = "", version = VERSION, databaseId = "", now = Date.now } = {},
+) {
+  const target = resolve(file);
+  if (
+    file === ":memory:" ||
+    !isAbsolute(file) ||
+    !existsSync(target) ||
+    !statSync(target).isFile()
+  )
+    throw Error("迁移目标不是现有的绝对路径数据库文件");
+  if (version !== VERSION) throw Error("迁移目标版本与候选程序不一致");
+
+  const beforeSchema = inspectDatabase(target);
+  const beforeRows = durableRowCounts(target);
+  const originalIdentity = archiveIdentity(target);
+  if (databaseId && originalIdentity !== databaseId)
+    throw Error("迁移目标数据库与更新前备份不匹配");
+
+  const store = createStore(target, { quietMigration: true });
+  let safeToRemoveSidecars = false;
+  try {
+    const repo = new Repository(store);
+    const mind = new Mind(repo);
+    const report = await migrateReleaseData(mind, {
+      fromVersion,
+      version,
+      now,
+    });
+    const afterSchema = inspectDatabase(target);
+    const afterRows = durableRowCounts(target);
+    assertDurableRowsPreserved(beforeRows, afterRows);
+    if (afterSchema.schemaVersion !== DATABASE_VERSION)
+      throw Error("数据库未迁移到候选版本要求的结构");
+    if (databaseId && archiveIdentity(target) !== databaseId)
+      throw Error("迁移后数据库身份发生变化");
+    const checkpoint = store.db
+      .prepare("PRAGMA wal_checkpoint(TRUNCATE)")
+      .get();
+    if (checkpoint.busy || checkpoint.log !== checkpoint.checkpointed)
+      throw Error("迁移后的数据库仍有未关闭的 SQLite 事务");
+    safeToRemoveSidecars = true;
+    return {
+      ...report,
+      fromDatabaseVersion: beforeSchema.schemaVersion,
+      toDatabaseVersion: afterSchema.schemaVersion,
+      durableTablesChecked: Object.keys(beforeRows).length,
+      durableRowsChecked: Object.values(beforeRows).reduce(
+        (sum, count) => sum + count,
+        0,
+      ),
+    };
+  } finally {
+    store.db.close();
+    if (safeToRemoveSidecars)
+      for (const suffix of ["-wal", "-shm"])
+        if (existsSync(target + suffix)) unlinkSync(target + suffix);
+  }
+}

package/server/runtime/update-execution.js

@@ -1,4 +1,5 @@
 import { copyFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
 import {
   readActive,
   writeActive,
@@ -13,7 +14,7 @@ import {
   UPDATE_RECOVERY_FAILED,
 } from "./update-manager.js";
 import { backupDatabase } from "../../scripts/backup.js";
-import { verifyArchive } from "../storage/archive.js";
+import { restoreToNewFile, verifyArchive } from "../storage/archive.js";
 
 // Executed outside the server so a large verified snapshot does not stall the
 // WebUI. Dependencies are explicit for failure, restart and rollback tests.
@@ -23,6 +24,7 @@ export async function performUpdate(
   {
     install,
     check,
+    migrate,
     stop,
     claim,
     start,
@@ -34,6 +36,8 @@ export async function performUpdate(
   let job = readUpdateJob(paths.home, id),
     stopped = false,
     changed = false,
+    databaseChanged = false,
+    migrationFile = null,
     child = null,
     claimed = false,
     backup = null;
@@ -43,6 +47,8 @@ export async function performUpdate(
   };
   try {
     if (job.status !== "queued") throw Error("更新任务已经处理");
+    if (typeof migrate !== "function")
+      throw Error("缺少候选版本的数据迁移器，已停止更新");
     save("downloading");
     const slot = updatePath(paths.home, id);
     mkdirSync(slot, { recursive: true, mode: 0o700 });
@@ -57,10 +63,36 @@ export async function performUpdate(
     if (!claimed) throw Error("另一次启动正在进行");
     save("backup");
     backup = snapshot(paths.database, paths.backups);
-    verifyArchive(backup);
+    const backupInfo = verifyArchive(backup);
+    const liveDatabase = new DatabaseSync(paths.database);
+    try {
+      const checkpoint = liveDatabase
+        .prepare("PRAGMA wal_checkpoint(TRUNCATE)")
+        .get();
+      if (checkpoint.busy) throw Error("旧数据库仍被占用，无法安全切换");
+    } finally {
+      liveDatabase.close();
+    }
+    save("migrating");
+    migrationFile = `${paths.database}.${id}.migrate`;
+    restoreToNewFile(backup, migrationFile);
+    databaseChanged = true;
+    await migrate(candidate, migrationFile, {
+      previous: job.previous,
+      version: job.version,
+      databaseId: backupInfo.databaseId,
+    });
+    for (const suffix of ["-wal", "-shm"])
+      if (
+        existsSync(migrationFile + suffix) ||
+        existsSync(paths.database + suffix)
+      )
+        throw Error("数据库仍有未关闭的 SQLite 事务文件，请重试更新");
     save("restarting");
     writeActive(paths.home, { id, version: job.version });
     changed = true;
+    renameSync(migrationFile, paths.database);
+    migrationFile = null;
     child = await start(candidate);
     save("verifying", { childPid: child });
     await health(child, job.version);
@@ -95,7 +127,7 @@ export async function performUpdate(
         release();
         if (!claim()) throw Error("启动锁尚未释放");
       }
-      if (changed) {
+      if (changed || databaseChanged) {
         verifyArchive(backup);
         const temporary = `${paths.database}.${id}.restore`;
         copyFileSync(backup, temporary);
@@ -108,8 +140,15 @@ export async function performUpdate(
               `${paths.database}.update-failed-${id}${suffix}`,
             );
         renameSync(temporary, paths.database);
-        writeActive(paths.home, previous);
+        if (changed) writeActive(paths.home, previous);
       }
+      if (migrationFile)
+        for (const suffix of ["", "-wal", "-shm"])
+          if (existsSync(migrationFile + suffix))
+            renameSync(
+              migrationFile + suffix,
+              `${paths.database}.update-failed-${id}.migration${suffix}`,
+            );
       const restored = await start(paths.package);
       await health(restored, job.previous);
       save("error", {

package/server/runtime/update-manager.js

@@ -17,6 +17,7 @@ const ACTIVE = new Set([
   "checking",
   "stopping",
   "backup",
+  "migrating",
   "restarting",
   "verifying",
   "restoring",
@@ -76,7 +77,9 @@ export class InstanceUpdater {
       job = writeUpdateJob(this.paths.home, {
         ...job,
         status: "error",
-        error: ["queued", "downloading", "checking"].includes(job.status)
+        error: ["queued", "downloading", "checking", "migrating"].includes(
+          job.status,
+        )
           ? UPDATE_FAILED
           : UPDATE_RECOVERY_FAILED,
         finished: this.now(),

package/server/storage/archive.js

@@ -16,7 +16,7 @@ import { dirname, basename, resolve, join } from "node:path";
 import { VERSION } from "../version.js";
 import { withBackupLock } from "./backup-lock.js";
 
-export const DATABASE_VERSION = 5;
+export const DATABASE_VERSION = 6;
 const appVersion = VERSION;
 const IDENTITY = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
 

package/server/storage/backup-scheduler.js

@@ -76,7 +76,7 @@ export function createBackupScheduler({
       if (!due) return false;
       const child = start(process.execPath, [SCRIPT, "--auto"], {
         env: {
-          ...env,
+          ...withoutCredentials(env),
           LUCKYTRI_HOME: runtimePaths(env).home,
           DB_PATH: source,
           BACKUP_DIR: directory,
@@ -93,8 +93,10 @@ export function createBackupScheduler({
         /* Not every platform lets a process lower another's priority. */
       }
       let output = "";
-      child.stdout?.on("data", (chunk) => (output += chunk));
-      child.stderr?.on("data", (chunk) => (output += chunk));
+      // Only the tail is reported; a chatty child cannot grow this forever.
+      const keep = (chunk) => (output = (output + chunk).slice(-4000));
+      child.stdout?.on("data", keep);
+      child.stderr?.on("data", keep);
       const done = (code, error) => {
         if (running !== child) return;
         running = null;
@@ -129,3 +131,13 @@ export function createBackupScheduler({
     },
   };
 }
+
+// Copying a file needs no model or channel credentials; the child does not
+// receive them.
+export function withoutCredentials(env) {
+  return Object.fromEntries(
+    Object.entries(env || {}).filter(
+      ([name]) => !/(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|COOKIE)/i.test(name),
+    ),
+  );
+}