ompchamber 3.4.0 → 3.6.0

package/src/server/lib/updates/single-flight.test.ts

@@ -0,0 +1,61 @@
+/**
+ * The single-flight contract for updates. Two properties matter and neither is
+ * visible from the call site: a run refusing to start while another holds the
+ * slot, and the slot always being free again afterwards — a stuck claim would
+ * answer "already running" until the server restarted.
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { runningUpdate, UpdateInProgressError, withUpdateSlot } from '@/server/lib/updates/single-flight';
+
+/** A run that stays open until `release()` is called. */
+function deferred() {
+  let release!: (value: string) => void;
+  const promise = new Promise<string>((resolve) => {
+    release = resolve;
+  });
+  return { promise, release };
+}
+
+describe('withUpdateSlot', () => {
+  test('a run is refused while another holds the slot', async () => {
+    const gate = deferred();
+    const running = withUpdateSlot('omp', () => gate.promise);
+    expect(runningUpdate()).toBe('omp');
+
+    await expect(withUpdateSlot('ompchamber', async () => 'never')).rejects.toThrow(UpdateInProgressError);
+
+    gate.release('done');
+    await expect(running).resolves.toBe('done');
+  });
+
+  test('the refusal names the update that is already running', async () => {
+    const gate = deferred();
+    const running = withUpdateSlot('ompchamber', () => gate.promise);
+
+    const error = await withUpdateSlot('omp', async () => 'never').catch((cause: unknown) => cause);
+    expect(error).toBeInstanceOf(UpdateInProgressError);
+    expect((error as Error).message).toContain('OMPChamber');
+
+    gate.release('done');
+    await expect(running).resolves.toBe('done');
+  });
+
+  test('the slot is free again once the run settles', async () => {
+    await expect(withUpdateSlot('omp', async () => 'first')).resolves.toBe('first');
+
+    expect(runningUpdate()).toBeNull();
+    await expect(withUpdateSlot('omp', async () => 'ok')).resolves.toBe('ok');
+  });
+
+  test('a run that throws does not leave the slot held', async () => {
+    await expect(
+      withUpdateSlot('omp', async () => {
+        throw new Error('boom');
+      }),
+    ).rejects.toThrow('boom');
+
+    expect(runningUpdate()).toBeNull();
+  });
+});

package/src/server/lib/updates/single-flight.ts

@@ -0,0 +1,68 @@
+/**
+ * One update at a time, for the whole server.
+ *
+ * An update is long and it replaces an install in place, so overlapping runs
+ * are not merely wasteful: two `updateOmpChamber` calls mean two
+ * `git merge --ff-only` plus two `bun install` in the same checkout, and two
+ * `omp update` calls race over the same binary.
+ *
+ * The console cannot be the gate. Its "a run is in flight" state is JavaScript,
+ * so a page reload forgets it and offers the button again while the first run
+ * is still going — measured: a reload mid-run followed by one more click left
+ * two `omp update` children alive at once.
+ *
+ * The claim is taken SYNCHRONOUSLY, before the run's first `await`, so two
+ * requests arriving in the same tick cannot both pass. Release is bound to the
+ * token `beginUpdate` issues rather than to the target name, so a stale release
+ * cannot free a claim belonging to a different run.
+ */
+
+import type { UpdateTarget } from '@/shared/types/updates';
+
+/** What the console is told when a second run is refused. */
+export function updateBusyMessage(target: UpdateTarget): string {
+  return `An ${target === 'omp' ? 'Oh-My-Pi' : 'OMPChamber'} update is already running.`;
+}
+
+export class UpdateInProgressError extends Error {
+  constructor(target: UpdateTarget) {
+    super(updateBusyMessage(target));
+    this.name = 'UpdateInProgressError';
+  }
+}
+
+let held: { token: symbol; target: UpdateTarget } | null = null;
+
+/** The target of the update in flight, or null when none is. */
+export function runningUpdate(): UpdateTarget | null {
+  return held?.target ?? null;
+}
+
+/** Take the slot. Throws when another run already holds it. */
+function beginUpdate(target: UpdateTarget): symbol {
+  if (held) throw new UpdateInProgressError(held.target);
+  const token = Symbol('update');
+  held = { token, target };
+  return token;
+}
+
+/** Release the slot; a token that no longer owns it is ignored. */
+function releaseUpdate(token: symbol): void {
+  if (held?.token === token) held = null;
+}
+
+/**
+ * Run `run` while holding the slot.
+ *
+ * The release is in a `finally`, so a failed update cannot leave the server
+ * answering "already running" forever — there is no other way to clear the
+ * flag, and a stuck flag would need a restart.
+ */
+export async function withUpdateSlot<T>(target: UpdateTarget, run: () => Promise<T>): Promise<T> {
+  const token = beginUpdate(target);
+  try {
+    return await run();
+  } finally {
+    releaseUpdate(token);
+  }
+}

package/src/server/routes/chat/session.ts

@@ -6,7 +6,7 @@ import { getSessionData } from '@/client/data/mock/chat';
 import { isMockMode } from '@/server/mock.server';
 import { findSessionFileById } from '@/server/lib/omp/session/locator';
 import { loadSessionMessages, loadSessionModel, loadSessionThinkingLevel, loadSessionTitle } from '@/server/lib/omp/session/messages';
-import { mergeOmpAttachments } from '@/server/lib/omp/session/merge-stored';
+import { mergeOmpAttachments, overlayRowsForOmpSession } from '@/server/lib/omp/session/merge-stored';
 import { readRawHeaderLine } from '@/server/lib/omp/session/files';
 import { formatNewSessionTitle } from '@/shared/lib/omp/session/default-title';
 
@@ -202,9 +202,19 @@ export async function action({ request, params }: ActionFunctionArgs) {
         updatedMessages = [...currentMessages, data.message];
       }
 
+      // A session omp owns on disk has its transcript in the JSONL, so the
+      // overlay keeps only the rows omp cannot record there — the user turns
+      // (raw composer text, attachment metadata) and the notice rows. A session
+      // with no file is chamber-created: the DB is its only copy, so it stays
+      // whole. The gate is the file's existence, never the id's shape — an omp
+      // uuid whose file is gone still needs its full row.
+      const persistedMessages = (await findSessionFileById(sessionId))
+        ? overlayRowsForOmpSession(updatedMessages)
+        : updatedMessages;
+
       await db.run(
         'INSERT OR REPLACE INTO chat_sessions (session_id, title, messages, updated_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)',
-        [sessionId, title, JSON.stringify(updatedMessages)]
+        [sessionId, title, JSON.stringify(persistedMessages)]
       );
 
       return json({
@@ -212,7 +222,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
         session: {
           id: sessionId,
           title,
-          messages: updatedMessages,
+          messages: persistedMessages,
         },
       });
     }

package/src/server/routes/health/probe.ts

@@ -1,5 +1,6 @@
 import { json, NO_STORE_HEADERS } from '@/server/lib/remix-compat';
 import pkg from '@/../package.json';
+import { countOpenFileDescriptors } from '@/server/lib/lifecycle/fd-pressure';
 import { resolveLaunchMode } from '@/server/lib/lifecycle/launch-mode';
 import { isMockMode } from '@/server/mock.server';
 
@@ -9,6 +10,12 @@ const STARTED_ISO = new Date(STARTED_AT).toISOString();
 /**
  * GET /api/health — lightweight readiness probe for the `ompchamber status` CLI.
  * Dependency-light by design: never touches the database and never throws.
+ *
+ * It does sweep the descriptor table (`countOpenFileDescriptors`, ~1 ms): a dev
+ * server walks toward the 10,240-descriptor point where every `Bun.spawn` in
+ * the process fails, and the sweep is the only way to say so *before* the
+ * terminal panel, the omp child and git all break at once. Null where the host
+ * cannot answer.
  */
 export async function loader() {
   return json(
@@ -30,6 +37,7 @@ export async function loader() {
       launchMode: resolveLaunchMode(),
       port: Number(Bun.env.PORT) || 3000,
       host: Bun.env.HOST || 'localhost',
+      fds: countOpenFileDescriptors(),
     },
     { headers: NO_STORE_HEADERS },
   );

package/src/server/routes/omp/index.ts

@@ -3,7 +3,6 @@ import * as ompState from '@/server/routes/omp/state';
 import * as ompSidebar from '@/server/routes/omp/sidebar';
 import * as ompSessionStats from '@/server/routes/omp/session-stats';
 import * as ompSessionTodos from '@/server/routes/omp/session-todos';
-import * as ompCommands from '@/server/routes/omp/commands';
 import * as ompExtensions from '@/server/routes/omp/extensions';
 import * as ompLogin from '@/server/routes/omp/login';
 import * as ompPlugins from '@/server/routes/omp/plugins';
@@ -14,7 +13,6 @@ export const ompBindings: HandlerBinding[] = [
   ...bindingsFor(ompSidebar, '/api/omp/sidebar'),
   ...bindingsFor(ompSessionStats, '/api/omp/session-stats'),
   ...bindingsFor(ompSessionTodos, '/api/omp/session-todos'),
-  ...bindingsFor(ompCommands, '/api/omp/commands'),
   ...bindingsFor(ompExtensions, '/api/omp/extensions'),
   ...bindingsFor(ompLogin, '/api/omp/login'),
   ...bindingsFor(ompPlugins, '/api/omp/plugins'),

package/src/server/routes/sessions/delete.test.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The delete route's refusal branches.
+ *
+ * Each one guards a different failure, and two of them are about blast radius
+ * rather than tidiness: the id names a directory under the sessions root and
+ * another under the btw root, so a value that is not one segment deletes far
+ * more than the session it names (`.` normalized to the btw root itself and
+ * wiped every session's side questions — see `fs/path-segment`).
+ *
+ * The route is called directly, as the other route tests do: these are pure
+ * request-shape checks that must not reach the filesystem or spawn an omp
+ * child, and asserting that is half the point.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { deleteSession } from '@/server/routes/sessions/delete';
+
+/**
+ * The 404 branch resolves the id by scanning the sessions directory, so the
+ * agent dir is pointed at an empty temp tree. Without this the test walks the
+ * developer's real `~/.omp/agent/sessions` (read-only, but seconds of I/O and a
+ * result that depends on what happens to be installed).
+ */
+const AGENT_DIR = '/tmp/omc-delete-route-test/agent';
+
+beforeAll(() => {
+  fs.rmSync(AGENT_DIR, { recursive: true, force: true });
+  fs.mkdirSync(path.join(AGENT_DIR, 'sessions'), { recursive: true });
+  Bun.env.PI_CODING_AGENT_DIR = AGENT_DIR;
+});
+
+afterAll(() => {
+  delete Bun.env.PI_CODING_AGENT_DIR;
+  fs.rmSync('/tmp/omc-delete-route-test', { recursive: true, force: true });
+});
+
+function del(sessionId: string): Promise<Response> {
+  return deleteSession({
+    request: new Request(`http://localhost/api/sessions/${sessionId}`, { method: 'DELETE' }),
+    params: { sessionId },
+  } as never) as Promise<Response>;
+}
+
+describe('deleteSession refusals', () => {
+  test('a pending chat is refused — nothing is stored for it yet', async () => {
+    const res = await del('new-1758800000000');
+    expect(res.status).toBe(400);
+    expect(await res.json()).toMatchObject({ code: 'session_pending' });
+  });
+
+  test('`.` is refused instead of wiping the btw root', async () => {
+    const res = await del('.');
+    expect(res.status).toBe(400);
+    expect(await res.json()).toMatchObject({ error: 'Invalid session id' });
+  });
+
+  test('a traversal is refused', async () => {
+    for (const id of ['..', '../x', 'a/b', '..\\a']) {
+      expect((await del(id)).status).toBe(400);
+    }
+  });
+
+  test('an unknown but well-formed id is a 404, not a 400', async () => {
+    // Distinct from the branches above: the request is valid, the session is
+    // not there. Collapsing the two would report a typo as a malformed request.
+    const res = await del('00000000-0000-0000-0000-000000000000');
+    expect(res.status).toBe(404);
+  });
+
+  test('a wrong verb on the path is a 405', async () => {
+    const res = (await deleteSession({
+      request: new Request('http://localhost/api/sessions/x', { method: 'GET' }),
+      params: { sessionId: 'x' },
+    } as never)) as Response;
+    expect(res.status).toBe(405);
+  });
+});

package/src/server/routes/sessions/delete.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * DELETE /api/sessions/:sessionId — remove a session and everything keyed to
+ * it. The mirror of `archiveSession`: archive is reversible and keeps the
+ * transcript, this one is the destructive path the user opts into from the
+ * sidebar's trash button.
+ *
+ * Order matters and is enforced here, not by the callers:
+ *  1. refuse a session whose omp child is mid-turn (a run, a live subagent, or
+ *     a dialog the agent is blocked on) — the delete would kill work the user
+ *     can still see, and omp would flush the file back on shutdown anyway;
+ *  2. destroy the child and AWAIT its exit — omp writes session state on
+ *     shutdown and would otherwise recreate the transcript just removed;
+ *  3. purge side questions, then the transcript, artifacts and chamber rows.
+ *
+ * A pending `new-…` session is refused: it is a client-side placeholder with
+ * nothing stored anywhere yet, so deleting it is the same as navigating away.
+ */
+
+import { json } from '@/server/lib/remix-compat';
+import type { ActionFunctionArgs } from '@/server/lib/remix-compat';
+import { methodNotAllowed } from '@/server/lib/route-adapter';
+import { getRpcSession } from '@/server/lib/omp/rpc/session-registry';
+import { purgeSessionData } from '@/server/lib/omp/session/delete.server';
+import { purgeBtwForSession } from '@/server/lib/btw/purge.server';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+import { isMockMode } from '@/server/mock.server';
+
+export async function deleteSession({ request, params }: ActionFunctionArgs) {
+  if (request.method !== 'DELETE') {
+    return methodNotAllowed({ request, params });
+  }
+
+  const sessionId = params.sessionId;
+  if (!sessionId) return json({ error: 'Missing session id' }, { status: 400 });
+  if (sessionId.startsWith('new-')) {
+    return json({ error: 'This chat has not been created yet.', code: 'session_pending' }, { status: 400 });
+  }
+  // The id names a directory under the sessions root and another under the btw
+  // root, so it must be exactly one path segment — see `isSinglePathSegment`
+  // for the `.` case that made this load-bearing. Both purges re-check it
+  // independently; refusing here is what turns the attempt into a 400.
+  if (!isSinglePathSegment(sessionId)) {
+    return json({ error: 'Invalid session id' }, { status: 400 });
+  }
+
+  // A live child is the only other writer of the transcript. Busy means a turn,
+  // a live subagent, or a dialog omp is parked on — all things the user can
+  // still act on, so the delete is refused with a reason rather than silently
+  // taking them down.
+  const live = getRpcSession(sessionId);
+  if (live?.isAlive()) {
+    if (live.isBusy()) {
+      return json(
+        { error: 'This session is working. Stop the run before deleting it.', code: 'session_busy' },
+        { status: 409 },
+      );
+    }
+    await live.destroyAndWait();
+  }
+
+  // Side questions live outside the session file and are removed first: their
+  // children must be gone before the parent transcript they were snapshotted
+  // from disappears.
+  const btwTopicsRemoved = isMockMode() ? 0 : await purgeBtwForSession(sessionId);
+  const purged = await purgeSessionData(sessionId);
+
+  if (!purged.found) {
+    return json({ error: 'Session not found' }, { status: 404 });
+  }
+
+  return json({
+    success: true,
+    sessionId,
+    fileRemoved: purged.fileRemoved,
+    artifactsRemoved: purged.artifactsRemoved,
+    btwTopicsRemoved,
+  });
+}

package/src/server/routes/sessions/index.ts

@@ -10,10 +10,15 @@ import {
   renameSession,
 } from '@/server/routes/sessions/session';
 import { listSubagents, readSubagentTranscript } from '@/server/routes/sessions/subagents';
+import { deleteSession } from '@/server/routes/sessions/delete';
 
 export const sessionsBindings: HandlerBinding[] = [
   ...bindingsFor(sessionsList, '/api/sessions/list'),
   ...bindingsFor(sessionsFolder, '/api/sessions/:sessionId'),
+  // DELETE-only on the same path the folder loader answers GET on: mounting it
+  // through `actionBindings` would register a 405 GET fallback that Elysia
+  // applies after the loader, replacing the workspace listing with it.
+  { method: 'DELETE', path: '/api/sessions/:sessionId', handler: deleteSession },
   ...actionBindings(archiveSession, '/api/sessions/:sessionId/archive'),
   // Per-item queue routes. `actionBindings` mounts ALL four mutating verbs on
   // one path, and Elysia lets a later registration override an earlier one —

package/src/server/routes/settings/commands.ts

@@ -8,6 +8,18 @@ import type { CommandItem } from '@/shared/types';
 import { isRecord } from '@/shared/lib/util/guards';
 import { createSettingsListStore } from '@/server/lib/db/settings-store';
 import { runUtilityCommand } from '@/server/lib/omp/rpc/utility';
+import { resolveDiscoveryScope, type DiscoveryScope } from '@/server/lib/omp/config/scope';
+import {
+  deleteCommandFile,
+  locateCommandFile,
+  readCommandFile,
+  writeCommandFile,
+} from '@/server/lib/omp/config/commands';
+import { reloadLiveSessions } from '@/server/lib/omp/session/reload.server';
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
 
 const commandsStore = createSettingsListStore<CommandItem>({
   key: 'omp_commands_settings',
@@ -60,19 +72,21 @@ function toLiveCommandItem(value: unknown): CommandItem | null {
     id: `omp-live-${name}`,
     name,
     description: typeof value.description === 'string' ? value.description : '',
-    scope: 'user',
+    scope: 'system',
+    source: value.source,
     template: `/${name}`,
-    isBuiltIn: true,
+    isBuiltIn: value.source !== 'file',
     ...(aliases.length ? { aliases } : {}),
     ...(subcommands.length ? { subcommands } : {}),
     ...(hint ? { inputHint: hint } : {}),
   };
 }
 
-/** Read live agent commands (builtin/skill/custom/extension/file sources) via RPC. */
-async function loadAgentCommands(): Promise<CommandItem[]> {
+/** Read live agent commands (builtin/skill/custom/extension/file sources) via
+ *  RPC, scoped to `cwd` so a workspace's own `.omp/commands` are discovered. */
+async function loadAgentCommands(cwd: string): Promise<CommandItem[]> {
   try {
-    const data = await runUtilityCommand<{ commands?: unknown }>({ type: 'get_available_commands' }, 30_000);
+    const data = await runUtilityCommand<{ commands?: unknown }>({ type: 'get_available_commands' }, 30_000, cwd);
     if (!Array.isArray(data.commands)) return [];
     return data.commands.flatMap((command) => {
       const item = toLiveCommandItem(command);
@@ -83,48 +97,121 @@ async function loadAgentCommands(): Promise<CommandItem[]> {
   }
 }
 
+/**
+ * Attach what the settings pane needs to decide whether a live command is a
+ * file the chamber owns: the file backing it (if any), its scope, and its body.
+ * `get_available_commands` reports the name, description and hint but not the
+ * path, so the answer comes from looking the name up in the roots omp reads.
+ */
+async function withCommandFile(command: CommandItem, scope: DiscoveryScope): Promise<CommandItem> {
+  const found = await locateCommandFile(command.name, scope.workspace);
+  if (!found) {
+    // No markdown file backs this name: a builtin, a `skill:<name>` entry, an
+    // extension or a TypeScript custom command. It runs, but nothing here owns
+    // a file for it.
+    return { ...command, isBuiltIn: true, managed: false };
+  }
+  const file = await readCommandFile(found.filePath);
+  return {
+    ...command,
+    // The file's scope is the truth, not omp's silence about where it found it.
+    scope: found.scope,
+    isBuiltIn: false,
+    managed: found.managed,
+    filePath: found.filePath,
+    ...(file ? { template: file.body, description: file.description || command.description } : {}),
+  };
+}
+
 /** Merge live agent commands ahead of app-local custom commands. */
-async function mergeCommands(custom: CommandItem[]): Promise<CommandItem[]> {
-  const live = await loadAgentCommands();
+async function mergeCommands(custom: CommandItem[], scope: DiscoveryScope): Promise<CommandItem[]> {
+  const live = await Promise.all((await loadAgentCommands(scope.cwd)).map((c) => withCommandFile(c, scope)));
   const liveNames = new Set(live.map((c) => c.name.toLowerCase()));
   return [...live, ...custom.filter((c) => !liveNames.has(c.name.toLowerCase()))];
 }
 
-export async function loader({ request: _request }: LoaderFunctionArgs) {
+export async function loader({ request }: LoaderFunctionArgs) {
   try {
     const db = await getDb();
     const mock = isMockMode();
     const commands = await commandsStore.read(db);
-    const merged = mock ? commands : await mergeCommands(commands);
-    return json({ commands: merged, isMock: mock });
-  } catch (error: any) {
+    if (mock) return json({ commands, isMock: true });
+
+    // The workspace root decides which project-scope commands/skills exist, so
+    // an unscoped read must not silently answer with $HOME's inventory.
+    const url = new URL(request.url);
+    const scope = await resolveDiscoveryScope(url.searchParams.get('root'), url.searchParams.get('scope'));
+    const merged = await mergeCommands(commands, scope);
+    return json({ commands: merged, isMock: false });
+  } catch (error) {
     const mock = isMockMode();
-    return json({ error: error.message, commands: mock ? DEFAULT_COMMANDS_LIST : [], isMock: mock }, { status: 500 });
+    return json({ error: errorMessage(error), commands: mock ? DEFAULT_COMMANDS_LIST : [], isMock: mock }, { status: 500 });
   }
 }
 
 export async function action({ request, params }: ActionFunctionArgs) {
   try {
     const db = await getDb();
+    const url = new URL(request.url);
 
     if (request.method === 'DELETE') {
-      const url = new URL(request.url);
       const id = url.searchParams.get('id');
       if (!id) return json({ error: 'id is required' }, { status: 400 });
+      if (isMockMode()) {
+        const list = await commandsStore.remove(db, id);
+        return json({ success: true, commands: list });
+      }
 
+      // A live command's id carries its name (`omp-live-<name>`); the pane's
+      // delete is only offered for one the chamber owns, and the file is the
+      // real thing to remove. A chamber-local row still deletes as a row.
+      const name = id.startsWith('omp-live-') ? id.slice('omp-live-'.length) : null;
+      const scope = await resolveDiscoveryScope(url.searchParams.get('root'), url.searchParams.get('scope'));
+      if (name) {
+        await deleteCommandFile(name, scope.workspace);
+        await reloadLiveSessions();
+        return json({ success: true, commands: await mergeCommands(await commandsStore.read(db), scope) });
+      }
       const list = await commandsStore.remove(db, id);
       return json({ success: true, commands: list });
     }
 
     if (request.method === 'POST' || request.method === 'PUT') {
       const body = await request.json();
+      const scope = await resolveDiscoveryScope(
+        url.searchParams.get('root') ?? (typeof body.root === 'string' ? body.root : null),
+        url.searchParams.get('scope') ?? (typeof body.scope === 'string' ? body.scope : null),
+      );
+
+      // Only a markdown file the chamber owns is written as a file. A live
+      // command from another provider (an extension command, a `.claude`
+      // command, a TypeScript custom command) has no file here, and writing one
+      // with the same name would SHADOW it — omp resolves a name present in
+      // both places to the file. A brand-new draft (no source) is a create.
+      const draft = isRecord(body.command) ? (body.command as unknown as CommandItem) : null;
+      if (!isMockMode() && draft && (draft.managed === true || (!draft.source && draft.isBuiltIn !== true))) {
+        const previousName = typeof body.previousName === 'string' ? body.previousName : null;
+        const target = draft.scope === 'project' ? 'project' : 'user';
+        await writeCommandFile({
+          scope: target,
+          projectDir: scope.workspace,
+          previousName,
+          name: draft.name,
+          description: draft.description ?? '',
+          argumentHint: draft.inputHint ?? '',
+          body: draft.template ?? '',
+        });
+        await reloadLiveSessions();
+        return json({ success: true, commands: await mergeCommands(await commandsStore.read(db), scope) });
+      }
+
       const updatedCommands = await commandsStore.upsert(db, body);
       await commandsStore.write(db, updatedCommands);
       return json({ success: true, commands: updatedCommands });
     }
 
     return methodNotAllowed({ request, params });
-  } catch (error: any) {
-    return json({ error: error.message }, { status: 500 });
+  } catch (error) {
+    return json({ error: errorMessage(error) }, { status: 500 });
   }
 }