pi-roundtable 0.1.0

package/src/core/runtime/extensions/ask-user.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, test } from "bun:test";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { OwnerAnswer, OwnerQuestion } from "../../domain/owner-prompts.ts";
+import { messages } from "../../i18n/index.ts";
+import { TEST_OWNER as OWNER } from "../../testing/owner.ts";
+import { PromptSlot } from "../prompt-slot.ts";
+import { ASK_USER_TOOL, askUserExtension } from "./ask-user.ts";
+
+interface Tool {
+	name: string;
+	execute: (
+		id: string,
+		params: unknown,
+		signal?: AbortSignal,
+	) => Promise<{ content: { text: string }[] }>;
+}
+
+/** ask_user over a slot whose cards answer with `answer`, recording each question. */
+function askUser(answer: OwnerAnswer | undefined, bound = true) {
+	const asked: { title: string; question: OwnerQuestion }[] = [];
+	const slot = new PromptSlot();
+	slot.bind(
+		bound
+			? {
+					confirm: async () => "expired",
+					ask: async (title, question) => {
+						asked.push({ title, question });
+						return answer;
+					},
+				}
+			: undefined,
+		"infra",
+	);
+	let tool: Tool | undefined;
+	askUserExtension(
+		slot,
+		OWNER,
+	)({
+		registerTool: (t: Tool) => {
+			tool = t;
+		},
+	} as unknown as ExtensionAPI);
+	if (tool?.name !== ASK_USER_TOOL) throw new Error("ask_user not registered");
+	const t = tool;
+	return {
+		asked,
+		call: async (params: unknown) =>
+			(await t.execute("call-1", params)).content[0]?.text ?? "",
+	};
+}
+
+describe("ask_user", () => {
+	test("a single choice comes back as the chosen label", async () => {
+		const { asked, call } = askUser({ choices: ["Sunday"] });
+		const text = await call({
+			question: "Which day?",
+			options: [
+				{ label: "Saturday" },
+				{ label: "Sunday", description: "afternoon" },
+			],
+		});
+		expect(text).toBe("Riley chose: Sunday");
+		expect(asked[0]).toEqual({
+			title: messages().askTitle("infra"),
+			question: {
+				question: "Which day?",
+				options: [
+					{ label: "Saturday" },
+					{ label: "Sunday", description: "afternoon" },
+				],
+				multi: false,
+				allowOther: false,
+			},
+		});
+	});
+
+	test("several choices and the owner's own words", async () => {
+		const { asked, call } = askUser({
+			choices: ["Saturday", "Monday"],
+			text: "Wednesday works too",
+		});
+		const text = await call({
+			question: "Which days?",
+			options: [{ label: "Saturday" }, { label: "Monday" }],
+			multi: true,
+			allow_other: true,
+		});
+		expect(text).toBe(
+			"Riley chose: Saturday; Monday\nRiley wrote: Wednesday works too",
+		);
+		expect(asked[0]?.question).toMatchObject({ multi: true, allowOther: true });
+	});
+
+	test("a free-text question", async () => {
+		const { asked, call } = askUser({ choices: [], text: "call me Nova" });
+		expect(await call({ question: "What name?" })).toBe(
+			"Riley wrote: call me Nova",
+		);
+		expect(asked[0]?.question.options).toEqual([]);
+	});
+
+	test("no answer in time says so", async () => {
+		const { call } = askUser(undefined);
+		expect(await call({ question: "?" })).toStartWith("No answer");
+	});
+
+	test("a turn he did not start tells the model to ask in its reply", async () => {
+		const { asked, call } = askUser({ choices: ["x"] }, false);
+		expect(await call({ question: "?" })).toContain(
+			"Ask him in your reply instead",
+		);
+		expect(asked).toHaveLength(0);
+	});
+});

package/src/core/runtime/extensions/ask-user.ts

@@ -0,0 +1,98 @@
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import type { OwnerAnswer, OwnerQuestion } from "../../domain/owner-prompts.ts";
+import { messages } from "../../i18n/index.ts";
+import { type OwnerIdentity, ownerWords } from "../../identity.ts";
+import { toolText } from "../../shared/tool-result.ts";
+import type { PromptSlot } from "../prompt-slot.ts";
+
+export const ASK_USER_TOOL = "ask_user";
+
+/** The tool's result: what the owner chose and wrote. */
+export function answerText(
+	answer: OwnerAnswer | undefined,
+	owner: OwnerIdentity,
+): string {
+	const o = ownerWords(owner);
+	if (!answer)
+		return `No answer: ${o.name} did not answer in time. Go on without it if you safely can, otherwise ask in your reply.`;
+	const lines = [
+		...(answer.choices.length > 0
+			? [`${o.name} chose: ${answer.choices.join("; ")}`]
+			: []),
+		...(answer.text !== undefined ? [`${o.name} wrote: ${answer.text}`] : []),
+	];
+	return lines.length > 0 ? lines.join("\n") : `${o.name} chose nothing.`;
+}
+
+/** Registers ask_user, which asks the owner on a card in the turn's channel and waits. */
+export function askUserExtension(
+	slot: PromptSlot,
+	owner: OwnerIdentity,
+	/** Whom the running turn is for, when not the owner; the answer's words name them. */
+	addressee?: () => OwnerIdentity,
+): ExtensionFactory {
+	const o = ownerWords(owner);
+	return (pi) => {
+		pi.registerTool({
+			name: ASK_USER_TOOL,
+			label: `Ask ${o.name}`,
+			description: `Ask ${o.name} a question on a card with buttons in this channel and wait for ${o.his} answer, within this turn. Use it when you need ${o.his} decision to continue, instead of ending your turn with a question. Offer options when the choices are known; set multi when several may apply and allow_other to let ${o.him} write ${o.his} own answer. ${o.He} has 30 minutes; after that the result says there was no answer.`,
+			parameters: Type.Object(
+				{
+					question: Type.String({ minLength: 1, maxLength: 1500 }),
+					options: Type.Optional(
+						Type.Array(
+							Type.Object(
+								{
+									label: Type.String({ minLength: 1, maxLength: 100 }),
+									description: Type.Optional(Type.String({ maxLength: 100 })),
+								},
+								{ additionalProperties: false },
+							),
+							{ maxItems: 25 },
+						),
+					),
+					multi: Type.Optional(
+						Type.Boolean({ description: "Several options may be chosen." }),
+					),
+					allow_other: Type.Optional(
+						Type.Boolean({
+							description: `${o.He} may write an answer besides the options.`,
+						}),
+					),
+				},
+				{ additionalProperties: false },
+			),
+			execute: async (_toolCallId, params, signal) => {
+				const prompts = slot.prompts;
+				if (!prompts)
+					return toolText(
+						`${o.name} cannot answer buttons in this turn, such as a schedule's. Ask ${o.him} in your reply instead.`,
+					);
+				const p = params as {
+					question: string;
+					options?: { label: string; description?: string }[];
+					multi?: boolean;
+					allow_other?: boolean;
+				};
+				const question: OwnerQuestion = {
+					question: p.question,
+					options: p.options ?? [],
+					multi: p.multi === true,
+					allowOther: p.allow_other === true,
+				};
+				return toolText(
+					answerText(
+						await prompts.ask(
+							messages().askTitle(slot.asker),
+							question,
+							signal,
+						),
+						addressee?.() ?? owner,
+					),
+				);
+			},
+		});
+	};
+}

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -0,0 +1,247 @@
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import type {
+	HeldCall,
+	PendingConfirmation,
+} from "../../domain/conversation.ts";
+import type { OwnerPrompts } from "../../domain/owner-prompts.ts";
+import type { ProfileId } from "../../domain/profile.ts";
+import type { HoldCheck } from "../../holds.ts";
+import { messages } from "../../i18n/index.ts";
+import { type OwnerIdentity, ownerWords } from "../../identity.ts";
+import type { ToolTiers } from "../../tool-tiers.ts";
+import type { PromptSlot } from "../prompt-slot.ts";
+
+/** How much of a held call's input its approval card shows. */
+const CARD_INPUT_CHARS = 1_500;
+
+/** Held actions older than this cannot be approved any more. */
+export const CONFIRMATION_TTL_MS = 24 * 3_600_000;
+
+/** JSON with object keys sorted at every level, so equal inputs compare equal. */
+// pi-lens-ignore: no-unknown-parameters — tool input is untyped model JSON; this is where it is read
+export function canonicalJson(value: unknown): string {
+	// pi-lens-ignore: no-unknown-parameters — tool input is untyped model JSON; this is where it is read
+	return JSON.stringify(value, (_key, v: unknown) =>
+		isPlainObject(v) ? withSortedKeys(v) : v,
+	);
+}
+
+// pi-lens-ignore: no-unknown-parameters — tool input is untyped model JSON; this is where it is read
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+/** The same object with its keys in code-unit order. */
+function withSortedKeys(
+	value: Record<string, unknown>,
+): Record<string, unknown> {
+	return Object.fromEntries(
+		Object.entries(value).sort(([a], [b]) => byCodeUnit(a, b)),
+	);
+}
+
+function byCodeUnit(a: string, b: string): number {
+	if (a < b) return -1;
+	return a > b ? 1 : 0;
+}
+
+/**
+ * Per-channel state of held actions. With the owner's prompts bound, a call that needs his
+ * confirmation waits for his answer on a card and runs or is refused in the same turn. Otherwise,
+ * or when the card expires, the call is held: it records its tool and exact input, and the
+ * owner's next message either confirms them, which lets each identical call run once in that
+ * turn, or drops them.
+ */
+// pi-lens-ignore: large-class — one gate per conversation; its state is the held calls and their approvals
+export class ConfirmationGate {
+	#profile: ProfileId = "general";
+	#pending: PendingConfirmation | undefined;
+	#approved: HeldCall[] = [];
+	readonly #holds: HoldCheck;
+	readonly #owner: OwnerIdentity;
+	/** Whom the running turn's held actions and refusals speak of: the turn's speaker. */
+	#addressee: OwnerIdentity;
+	readonly #workspace: string | undefined;
+	readonly #tiers: ToolTiers | undefined;
+
+	/**
+	 * `holds` decides which calls wait for the owner. With a workspace, the session has a shell,
+	 * and its writes outside the workspace are held too.
+	 */
+	constructor(
+		holds: HoldCheck,
+		owner: OwnerIdentity,
+		pending?: PendingConfirmation,
+		workspace?: string,
+		tiers?: ToolTiers,
+	) {
+		this.#tiers = tiers;
+		this.#holds = holds;
+		this.#owner = owner;
+		this.#addressee = owner;
+		this.#pending = pending;
+		this.#workspace = workspace;
+	}
+
+	/** Held actions awaiting the owner's answer; expired ones count as none. */
+	pending(now = new Date()): PendingConfirmation | undefined {
+		const pending = this.#pending;
+		if (!pending) return undefined;
+		return now.getTime() - pending.heldAt.getTime() > CONFIRMATION_TTL_MS
+			? undefined
+			: pending;
+	}
+
+	/** `addressee` is who the turn is for; without one, the owner. */
+	beginTurn(
+		profile: ProfileId,
+		confirmed: boolean,
+		addressee?: OwnerIdentity,
+	): void {
+		this.#profile = profile;
+		this.#addressee = addressee ?? this.#owner;
+		this.#approved = confirmed ? [...(this.pending()?.calls ?? [])] : [];
+		this.#pending = undefined;
+	}
+
+	endTurn(): void {
+		this.#approved = [];
+	}
+
+	/** Returns the reason a call is held, or undefined to let it run. */
+	hold(tool: string, input: Record<string, unknown>): string | undefined {
+		const call = this.#needing(tool, input);
+		return call ? this.#record(call) : undefined;
+	}
+
+	/**
+	 * Like `hold`, but asks the owner on a card first when `prompts` is given: his approval runs
+	 * the call, his refusal blocks it, and only an expired card holds it.
+	 */
+	async review(
+		tool: string,
+		input: Record<string, unknown>,
+		ask?: { prompts: OwnerPrompts; asker: string; signal?: AbortSignal },
+	): Promise<string | undefined> {
+		return (await this.decide(tool, input, ask)).reason;
+	}
+
+	/**
+	 * `review`, plus whether a card's approval released the call, so its result can say so:
+	 * the card's own message is shown to the person, never to the model.
+	 */
+	async decide(
+		tool: string,
+		input: Record<string, unknown>,
+		ask?: { prompts: OwnerPrompts; asker: string; signal?: AbortSignal },
+	): Promise<{ reason?: string; approvedOnCard?: true }> {
+		const call = this.#needing(tool, input);
+		if (!call) return {};
+		if (!ask) return { reason: this.#record(call) };
+		const answer = await ask.prompts.confirm(
+			messages().confirmTitle(ask.asker),
+			approvalCard(call),
+			ask.signal,
+			this.#tiers?.minTier(call.tool),
+		);
+		if (answer === "approved") return { approvedOnCard: true };
+		if (answer === "declined") {
+			const o = ownerWords(this.#addressee);
+			return {
+				reason: `${o.name} declined this on its approval card: it would ${call.action}. Do not retry it; go on without it, or ask ${o.him} what ${o.he} wants instead.`,
+			};
+		}
+		if (answer === "cancelled") return { reason: "The turn was stopped." };
+		return { reason: this.#record(call) };
+	}
+
+	/** The call when it needs the owner's confirmation and no approval releases it. */
+	#needing(tool: string, input: Record<string, unknown>): HeldCall | undefined {
+		const action = this.#holds(
+			tool,
+			input,
+			this.#workspace === undefined ? {} : { workspace: this.#workspace },
+		);
+		if (!action) return undefined;
+		const call: HeldCall = { tool, input: canonicalJson(input), action };
+		const approved = this.#approved.findIndex(
+			(c) => c.tool === call.tool && c.input === call.input,
+		);
+		if (approved !== -1) {
+			this.#approved.splice(approved, 1);
+			return undefined;
+		}
+		return call;
+	}
+
+	#record(call: HeldCall): string {
+		const pending = this.#pending ?? {
+			profile: this.#profile,
+			heldAt: new Date(),
+			calls: [],
+		};
+		if (
+			!pending.calls.some((c) => c.tool === call.tool && c.input === call.input)
+		)
+			pending.calls.push(call);
+		this.#pending = pending;
+		const o = ownerWords(this.#addressee);
+		return `Held for ${o.name}'s confirmation: this would ${call.action}. Do not retry it in this turn. Tell ${o.him} exactly what will happen and ask ${o.him} to confirm; once ${o.he} agrees in ${o.his} next message, make the same call with the same input and it runs.`;
+	}
+}
+
+/** The owner's approving message, preceded by the held calls it releases, so the model makes them again. */
+export function confirmedTurnText(
+	pending: PendingConfirmation,
+	text: string,
+	owner: OwnerIdentity,
+): string {
+	const calls = pending.calls
+		.map((call) => `- ${call.action}: ${call.tool} ${call.input}`)
+		.join("\n");
+	return `(${owner.name} approved the held actions below with this message. Make each call now with exactly this input.)\n${calls}\n\n${text}`;
+}
+
+/** What an approval card says: the held action's words, then the exact call. */
+export function approvalCard(call: HeldCall): string {
+	const input =
+		call.input.length > CARD_INPUT_CHARS
+			? `${call.input.slice(0, CARD_INPUT_CHARS)}…`
+			: call.input;
+	return `**${call.action}**\n-# \`${call.tool}\`\n\`\`\`json\n${input.replaceAll("```", "`\u200b``")}\n\`\`\``;
+}
+
+/** Without a slot, or with an empty one, every call that needs confirmation is held. */
+export function confirmationGateExtension(
+	gate: ConfirmationGate,
+	slot?: PromptSlot,
+): ExtensionFactory {
+	return (pi) => {
+		/** Calls a card's approval released, until their results are back. */
+		const approved = new Set<string>();
+		pi.on("tool_result", (event) => {
+			if (!approved.delete(event.toolCallId)) return undefined;
+			const outcome = event.isError
+				? "It was approved on its card and ran, but it failed:"
+				: "It was approved on its card and ran; its result follows.";
+			return {
+				content: [{ type: "text", text: outcome }, ...event.content],
+			};
+		});
+		pi.on("tool_call", async (event, ctx) => {
+			const prompts = slot?.prompts;
+			let ask: Parameters<ConfirmationGate["review"]>[2];
+			if (prompts && slot) {
+				ask = { prompts, asker: slot.asker };
+				if (ctx.signal) ask.signal = ctx.signal;
+			}
+			const { reason, approvedOnCard } = await gate.decide(
+				event.toolName,
+				event.input as Record<string, unknown>,
+				ask,
+			);
+			if (approvedOnCard) approved.add(event.toolCallId);
+			return reason ? { block: true, reason } : undefined;
+		});
+	};
+}

package/src/core/runtime/extensions/self-compact-guard.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, test } from "bun:test";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import {
+	COMPACT_TOOL,
+	selfCompactGuardExtension,
+} from "./self-compact-guard.ts";
+
+type Handler = (event: {
+	toolName: string;
+	input: unknown;
+}) => { block: true; reason: string } | undefined;
+
+function handler(): Handler {
+	let registered: Handler | undefined;
+	selfCompactGuardExtension()({
+		on: (event: string, h: Handler) => {
+			if (event === "tool_call") registered = h;
+		},
+	} as unknown as ExtensionAPI);
+	if (!registered) throw new Error("no tool_call handler");
+	return registered;
+}
+
+describe("selfCompactGuardExtension", () => {
+	test("refuses compact_session with resume, with the reason", () => {
+		const result = handler()({
+			toolName: COMPACT_TOOL,
+			input: { resume: "continue the report" },
+		});
+		expect(result?.block).toBe(true);
+		expect(result?.reason).toContain("without resume");
+	});
+
+	test("lets compact_session without resume, or with a blank one, run", () => {
+		const h = handler();
+		expect(h({ toolName: COMPACT_TOOL, input: {} })).toBeUndefined();
+		expect(
+			h({ toolName: COMPACT_TOOL, input: { instructions: "keep paths" } }),
+		).toBeUndefined();
+		expect(
+			h({ toolName: COMPACT_TOOL, input: { resume: "  " } }),
+		).toBeUndefined();
+	});
+
+	test("ignores other tools", () => {
+		expect(
+			handler()({ toolName: "bash", input: { resume: "x" } }),
+		).toBeUndefined();
+	});
+});

package/src/core/runtime/extensions/self-compact-guard.ts

@@ -0,0 +1,23 @@
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+
+/** pi-self-compact's tool, active in every session. */
+export const COMPACT_TOOL = "compact_session";
+
+const RESUME_REFUSED =
+	"compact_session cannot take resume here: a resumed run would start outside this conversation and its reply would reach no one. Finish this turn's work, then call compact_session again without resume; the next message starts from the compacted context.";
+
+/**
+ * Refuses `compact_session` with `resume`. A turn starts only from the owner, a schedule, or
+ * another agent, so a run pi-self-compact starts on its own would answer no one.
+ */
+export function selfCompactGuardExtension(): ExtensionFactory {
+	return (pi) => {
+		pi.on("tool_call", (event) => {
+			if (event.toolName !== COMPACT_TOOL) return undefined;
+			const { resume } = event.input as { resume?: unknown };
+			// pi-self-compact ignores a blank resume, so only a real one is refused.
+			if (typeof resume !== "string" || !resume.trim()) return undefined;
+			return { block: true, reason: RESUME_REFUSED };
+		});
+	};
+}

package/src/core/runtime/mcp.ts

@@ -0,0 +1,23 @@
+import type { ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import { mcpAdapterExtension } from "../shared/mcp-adapter.ts";
+
+/** An MCP server a session connects to, with the tools it offers. */
+export interface VirtualServer {
+	name: string;
+	url: string;
+	tools: string[];
+}
+
+/** The owner's MCP gateway virtual servers, reached with the process's admin token. */
+export function mcpExtension(
+	servers: readonly VirtualServer[],
+	token: string,
+): ExtensionFactory {
+	return mcpAdapterExtension(
+		servers.map((server) => ({
+			name: server.name,
+			url: server.url,
+			bearerToken: token,
+		})),
+	);
+}

package/src/core/runtime/pending-confirmation-store.test.ts

@@ -0,0 +1,52 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { SQL } from "bun";
+import type { PendingConfirmation } from "../domain/conversation.ts";
+import {
+	describeDb,
+	openTestStore,
+	type TestStore,
+	testDatabaseUrl,
+} from "../testing/database.ts";
+import { PendingConfirmationStore } from "./pending-confirmation-store.ts";
+
+const held: PendingConfirmation = {
+	profile: "workspace",
+	heldAt: new Date("2026-09-27T01:00:00Z"),
+	calls: [
+		{
+			tool: "google-send-gmail-message",
+			input: '{"subject":"hi","to":"a@b.c"}',
+			action: "send an email to a@b.c",
+		},
+	],
+};
+
+// Runs against a real PostgreSQL, only when ROUNDTABLE_TEST_DATABASE_URL is set.
+describeDb("PendingConfirmationStore", () => {
+	let store: TestStore<PendingConfirmationStore>;
+
+	beforeAll(async () => {
+		const admin = new SQL(testDatabaseUrl);
+		await admin`DROP TABLE IF EXISTS pending_confirmations`;
+		await admin.close();
+		store = await openTestStore(PendingConfirmationStore);
+	});
+
+	afterAll(async () => {
+		await store.close();
+	});
+
+	test("held actions survive a restart, are replaced, and are cleared", async () => {
+		expect(await store.load("discord:1")).toBeUndefined();
+		await store.save("discord:1", held);
+		expect(await store.load("discord:1")).toEqual(held);
+
+		const other = { ...held, calls: [] };
+		await store.save("discord:1", other);
+		expect(await store.load("discord:1")).toEqual(other);
+		expect(await store.load("discord:2")).toBeUndefined();
+
+		await store.save("discord:1", undefined);
+		expect(await store.load("discord:1")).toBeUndefined();
+	});
+});

package/src/core/runtime/pending-confirmation-store.ts

@@ -0,0 +1,75 @@
+import type { SQL } from "bun";
+import type { Migration } from "../db/migrations.ts";
+import type {
+	ChannelKey,
+	HeldCall,
+	PendingConfirmation,
+} from "../domain/conversation.ts";
+import type { ProfileId } from "../domain/profile.ts";
+
+interface Row {
+	profile: ProfileId;
+	held_at: Date;
+	calls: string;
+}
+
+/** Each owner channel's held actions, in the database, so a restart keeps them. */
+export class PendingConfirmationStore {
+	readonly #sql: SQL;
+
+	private constructor(sql: SQL) {
+		this.#sql = sql;
+	}
+
+	/** The store's tables; the host runs this before any store attaches. */
+	static readonly migration: Migration = {
+		name: "pending-confirmations",
+		up: async (sql) => {
+			await sql`
+				CREATE TABLE IF NOT EXISTS pending_confirmations (
+					channel_key text PRIMARY KEY,
+					profile text NOT NULL,
+					held_at timestamptz NOT NULL,
+					calls text NOT NULL
+				)`;
+		},
+	};
+
+	/** The store over the host's migrated pool. */
+	static async attach(sql: SQL): Promise<PendingConfirmationStore> {
+		return new PendingConfirmationStore(sql);
+	}
+
+	async load(channel: ChannelKey): Promise<PendingConfirmation | undefined> {
+		const rows: Row[] = await this.#sql`
+			SELECT profile, held_at, calls FROM pending_confirmations
+			WHERE channel_key = ${channel}`;
+		const row = rows[0];
+		return row
+			? {
+					profile: row.profile,
+					heldAt: row.held_at,
+					// pi-lens-ignore: unchecked-throwing-call — this store wrote the JSON; a corrupt row should fail loudly
+					calls: JSON.parse(row.calls) as HeldCall[],
+				}
+			: undefined;
+	}
+
+	/** Replaces the channel's held actions; none deletes the row. */
+	async save(
+		channel: ChannelKey,
+		pending: PendingConfirmation | undefined,
+	): Promise<void> {
+		if (!pending) {
+			await this
+				.#sql`DELETE FROM pending_confirmations WHERE channel_key = ${channel}`;
+			return;
+		}
+		await this.#sql`
+			INSERT INTO pending_confirmations (channel_key, profile, held_at, calls)
+			VALUES (${channel}, ${pending.profile}, ${pending.heldAt},
+				${JSON.stringify(pending.calls)})
+			ON CONFLICT (channel_key) DO UPDATE SET profile = EXCLUDED.profile,
+				held_at = EXCLUDED.held_at, calls = EXCLUDED.calls`;
+	}
+}