plasalid 0.5.7 → 0.5.8

package/dist/ai/agent.d.ts

@@ -2,15 +2,13 @@ import type Database from "libsql";
 import { type ScanPromptOptions, type ReviewPromptOptions, type RecordPromptOptions } from "./system-prompt.js";
 import { type AgentExecutionContext } from "./tools/index.js";
 import type { NormalizedMessage } from "./provider.js";
+export { AbortedError } from "./errors.js";
 export type ProgressCallback = (event: {
     phase: "tool" | "responding";
     toolName?: string;
     toolCount: number;
     elapsedMs: number;
 }) => void;
-export declare class AbortedError extends Error {
-    constructor();
-}
 /**
  * Conversational chat used by the Ink TUI. Reuses conversation_history for context
  * continuity, redacts PII on the way out, restores it on the way in for display.

package/dist/ai/agent.js

@@ -4,14 +4,10 @@ import { getToolDefinitions, executeTool } from "./tools/index.js";
 import { getConversationHistory, saveMessage } from "./memory.js";
 import { redact, unredact } from "./redactor.js";
 import { createProvider } from "./providers/index.js";
+import { AbortedError, ApiAuthError, ApiError, RateLimitError, } from "./errors.js";
+export { AbortedError } from "./errors.js";
 const provider = createProvider();
 const MAX_TOOL_STEPS = 20;
-export class AbortedError extends Error {
-    constructor() {
-        super("aborted");
-        this.name = "AbortedError";
-    }
-}
 async function runAgent({ db, systemPrompt, tools, initialMessages, agentCtx, onProgress, signal, maxToolSteps, }) {
     const messages = [...initialMessages];
     const useThinking = config.thinkingBudget > 0 && provider.supportsThinking;
@@ -102,17 +98,21 @@ export async function handleChatMessage(db, userMessage, onProgress, signal) {
         return text || "I couldn't formulate a response. Could you rephrase?";
     }
     catch (error) {
-        if (error instanceof AbortedError || error?.name === "AbortError" || signal?.aborted) {
+        if (error instanceof AbortedError)
+            throw error;
+        if (signal?.aborted)
             throw new AbortedError();
-        }
-        if (error.status === 401 || error.status === 403) {
+        if (error instanceof ApiAuthError) {
             return "API key was rejected. Run `plasalid setup` to reconfigure your credentials.";
         }
-        if (error.status === 429) {
+        if (error instanceof RateLimitError) {
             return "Rate limited. Wait a moment and try again.";
         }
-        const safeMessage = error.status ? `API error (${error.status}): ${error.message || ""}` : error.message || "internal error";
-        console.error("AI error:", safeMessage);
+        if (error instanceof ApiError) {
+            console.error("AI error:", `API error (${error.status ?? "?"}): ${error.message}`);
+            return "Sorry, I had trouble processing that. Could you try again?";
+        }
+        console.error("AI error:", error.message || "internal error");
         return "Sorry, I had trouble processing that. Could you try again?";
     }
 }

package/dist/ai/errors.d.ts

@@ -0,0 +1,16 @@
+export declare class AbortedError extends Error {
+    constructor();
+}
+export declare class ApiAuthError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+export declare class RateLimitError extends Error {
+    readonly status = 429;
+    constructor();
+}
+export declare class ApiError extends Error {
+    readonly status: number | undefined;
+    constructor(status: number | undefined, message: string);
+}
+export declare function classifyProviderError(err: unknown, signal?: AbortSignal): never;

package/dist/ai/errors.js

@@ -0,0 +1,47 @@
+export class AbortedError extends Error {
+    constructor() {
+        super("aborted");
+        this.name = "AbortedError";
+    }
+}
+export class ApiAuthError extends Error {
+    status;
+    constructor(status) {
+        super(`auth ${status}`);
+        this.status = status;
+        this.name = "ApiAuthError";
+    }
+}
+export class RateLimitError extends Error {
+    status = 429;
+    constructor() {
+        super("rate limited");
+        this.name = "RateLimitError";
+    }
+}
+export class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "ApiError";
+    }
+}
+export function classifyProviderError(err, signal) {
+    if (err instanceof AbortedError ||
+        err instanceof ApiAuthError ||
+        err instanceof RateLimitError ||
+        err instanceof ApiError) {
+        throw err;
+    }
+    const e = (err ?? {});
+    if (signal?.aborted || e.name === "AbortError")
+        throw new AbortedError();
+    if (e.status === 401 || e.status === 403)
+        throw new ApiAuthError(e.status);
+    if (e.status === 429)
+        throw new RateLimitError();
+    if (typeof e.status === "number")
+        throw new ApiError(e.status, e.message ?? "");
+    throw new ApiError(undefined, e.message ?? "internal error");
+}

package/dist/ai/providers/anthropic.js

@@ -1,4 +1,5 @@
 import Anthropic from "@anthropic-ai/sdk";
+import { classifyProviderError } from "../errors.js";
 export function createAnthropicProvider(opts) {
     const client = new Anthropic(opts.baseURL
         ? { apiKey: opts.apiKey, baseURL: opts.baseURL }
@@ -17,10 +18,15 @@ export function createAnthropicProvider(opts) {
             if (params.thinking) {
                 apiParams.thinking = params.thinking;
             }
-            const response = await client.messages.create(apiParams, {
-                signal: params.signal,
-            });
-            // Filter thinking blocks and normalize content
+            let response;
+            try {
+                response = await client.messages.create(apiParams, {
+                    signal: params.signal,
+                });
+            }
+            catch (e) {
+                classifyProviderError(e, params.signal);
+            }
             const content = [];
             for (const block of response.content) {
                 if (block.type === "thinking")

package/dist/ai/providers/openai.js

@@ -1,4 +1,30 @@
 import OpenAI from "openai";
+import { classifyProviderError } from "../errors.js";
+function isMaxTokensRejection(e) {
+    const err = e;
+    return err.status === 400 && (err.message?.includes("max_tokens") ?? false);
+}
+/**
+ * Some OpenAI-compatible endpoints (older models, Ollama, vLLM) accept `max_tokens`;
+ * newer OpenAI models require `max_completion_tokens`. Try the former, fall back on a
+ * 400 that explicitly names the parameter.
+ */
+async function createCompletionWithTokenFallback(client, body, options) {
+    const base = {
+        model: body.model,
+        messages: body.messages,
+        tools: body.tools,
+    };
+    try {
+        return await client.chat.completions.create({ ...base, max_tokens: body.maxTokens }, options);
+    }
+    catch (e) {
+        if (isMaxTokensRejection(e)) {
+            return await client.chat.completions.create({ ...base, max_completion_tokens: body.maxTokens }, options);
+        }
+        throw e;
+    }
+}
 export function createOpenAICompatibleProvider(opts) {
     const client = new OpenAI({
         apiKey: opts.apiKey,
@@ -8,63 +34,54 @@ export function createOpenAICompatibleProvider(opts) {
         name: "openai-compatible",
         supportsThinking: false,
         async sendMessage(params) {
-            const messages = convertMessages(params.system, params.messages);
             const tools = convertTools(params.tools);
-            // Try max_tokens first (broadest compat: Ollama, vLLM, older OpenAI models),
-            // fall back to max_completion_tokens if rejected (newer OpenAI models require it)
+            const body = {
+                model: params.model,
+                maxTokens: params.maxTokens,
+                messages: convertMessages(params.system, params.messages),
+                tools: tools.length > 0 ? tools : undefined,
+            };
             let response;
             try {
-                response = await client.chat.completions.create({
-                    model: params.model,
-                    max_tokens: params.maxTokens,
-                    messages,
-                    tools: tools.length > 0 ? tools : undefined,
-                }, { signal: params.signal });
+                response = await createCompletionWithTokenFallback(client, body, { signal: params.signal });
             }
             catch (e) {
-                if (e.status === 400 && e.message?.includes("max_tokens")) {
-                    response = await client.chat.completions.create({
-                        model: params.model,
-                        max_completion_tokens: params.maxTokens,
-                        messages,
-                        tools: tools.length > 0 ? tools : undefined,
-                    }, { signal: params.signal });
-                }
-                else {
-                    throw e;
-                }
-            }
-            const choice = response.choices[0];
-            if (!choice) {
-                return { content: [], stopReason: "end_turn" };
-            }
-            const content = [];
-            if (choice.message.content) {
-                content.push({ type: "text", text: choice.message.content });
+                classifyProviderError(e, params.signal);
             }
-            if (choice.message.tool_calls) {
-                for (const tc of choice.message.tool_calls) {
-                    if (tc.type !== "function")
-                        continue;
-                    content.push({
-                        type: "tool_use",
-                        id: tc.id,
-                        name: tc.function.name,
-                        input: parseArguments(tc.function.arguments),
-                    });
-                }
-            }
-            const hasToolCalls = content.some((b) => b.type === "tool_use");
-            return {
-                content,
-                stopReason: hasToolCalls ? "tool_use" : "end_turn",
-                usage: response.usage
-                    ? { input_tokens: response.usage.prompt_tokens, output_tokens: response.usage.completion_tokens }
-                    : undefined,
-            };
+            return normalizeResponse(response);
         },
     };
 }
+function normalizeResponse(response) {
+    const choice = response.choices[0];
+    if (!choice) {
+        return { content: [], stopReason: "end_turn" };
+    }
+    const content = [];
+    if (choice.message.content) {
+        content.push({ type: "text", text: choice.message.content });
+    }
+    if (choice.message.tool_calls) {
+        for (const tc of choice.message.tool_calls) {
+            if (tc.type !== "function")
+                continue;
+            content.push({
+                type: "tool_use",
+                id: tc.id,
+                name: tc.function.name,
+                input: parseArguments(tc.function.arguments),
+            });
+        }
+    }
+    const hasToolCalls = content.some((b) => b.type === "tool_use");
+    return {
+        content,
+        stopReason: hasToolCalls ? "tool_use" : "end_turn",
+        usage: response.usage
+            ? { input_tokens: response.usage.prompt_tokens, output_tokens: response.usage.completion_tokens }
+            : undefined,
+    };
+}
 function convertMessages(system, messages) {
     const result = [
         { role: "system", content: system },
@@ -104,14 +121,11 @@ function convertMessages(system, messages) {
                     .join("\n");
                 const toolCalls = blocks
                     .filter((b) => b.type === "tool_use")
-                    .map((b) => {
-                    const tu = b;
-                    return {
-                        id: tu.id,
-                        type: "function",
-                        function: { name: tu.name, arguments: JSON.stringify(tu.input) },
-                    };
-                });
+                    .map((tu) => ({
+                    id: tu.id,
+                    type: "function",
+                    function: { name: tu.name, arguments: JSON.stringify(tu.input) },
+                }));
                 result.push({
                     role: "assistant",
                     content: textParts || null,

package/dist/ai/redactor.js

@@ -1,75 +1,101 @@
 import { config } from "../config.js";
 import { readContext } from "./context.js";
+const SECTION_RULES = [
+    {
+        heading: "Family",
+        token: "[PARTNER]",
+        stripParen: true,
+        skipIfUser: true,
+        patterns: [
+            /^(?:partner|spouse|wife|husband|child|kid|son|daughter|dependent)[:\s]+(.+)/i,
+            /^([\p{Lu}\p{Lo}][\p{L}\s]+)/u,
+        ],
+    },
+    {
+        heading: "Income",
+        token: "[EMPLOYER]",
+        patterns: [
+            /(?:employer|works? (?:at|for)|employed (?:at|by))[:\s]+([A-Z][\w\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/i,
+            /\bfrom ([A-Z][A-Za-z\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/,
+            /\bat ([A-Z][A-Za-z\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/,
+        ],
+    },
+];
+// Patterns for numeric / identifier PII commonly found in Thai financial data.
+const NUMERIC_PII_PATTERNS = [
+    // Thai national ID with dashes: 1-2345-67890-12-3
+    [/\b\d-\d{4}-\d{5}-\d{2}-\d\b/g, "[NATID]"],
+    // Thai national ID without dashes (13 digits) — must precede the generic ACCT pattern.
+    [/\b\d{13}\b/g, "[NATID]"],
+    // Thai mobile numbers: 0[689]xxxxxxxx (10 digits starting 06/08/09)
+    [/\b0[689]\d{8}\b/g, "[PHONE]"],
+    // 16-digit credit card (with optional separators)
+    [/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g, "[CARD]"],
+    // 10–12 digit account / routing numbers at a word boundary
+    [/\b\d{10,12}\b(?=\s|$|[,.])/g, "[ACCT]"],
+];
+function extractSectionLines(context, heading) {
+    const re = new RegExp(`## ${heading}\\n([\\s\\S]*?)(?=\\n##|$)`);
+    const match = context.match(re);
+    if (!match)
+        return [];
+    return match[1]
+        .split("\n")
+        .filter((l) => l.trim().startsWith("-"))
+        .map((l) => l.replace(/^-\s*/, "").trim())
+        .filter((text) => text.length > 0 && !text.startsWith("("));
+}
+function applyRule(rule, context, userName, push) {
+    for (const line of extractSectionLines(context, rule.heading)) {
+        if (rule.skipIfUser && line.toLowerCase() === userName.toLowerCase())
+            continue;
+        for (const pattern of rule.patterns) {
+            const match = line.match(pattern);
+            if (!match)
+                continue;
+            let name = match[1].trim();
+            if (rule.stripParen)
+                name = name.replace(/\s*\(.*\)/, "").trim();
+            if (!name)
+                break;
+            if (rule.skipIfUser && name.toLowerCase() === userName.toLowerCase())
+                break;
+            push(name, rule.token);
+            break;
+        }
+    }
+}
 function buildRedactions() {
     const entries = [];
     const seen = new Set();
-    function add(real, token) {
+    const push = (real, token) => {
         const trimmed = real.trim();
-        if (trimmed.length < 2 || seen.has(trimmed.toLowerCase()))
+        if (trimmed.length < 2)
+            return;
+        const key = trimmed.toLowerCase();
+        if (seen.has(key))
             return;
-        seen.add(trimmed.toLowerCase());
+        seen.add(key);
         entries.push({ real: trimmed, token });
-    }
+    };
     const userName = config.userName;
     if (userName && userName !== "User") {
-        add(userName, "[USER]");
+        push(userName, "[USER]");
         const parts = userName.split(/\s+/);
         if (parts.length > 1) {
-            add(parts[0], "[USER_FIRST]");
-            add(parts[parts.length - 1], "[USER_LAST]");
+            push(parts[0], "[USER_FIRST]");
+            push(parts[parts.length - 1], "[USER_LAST]");
         }
     }
     const context = readContext();
     if (context) {
-        const familyMatch = context.match(/## Family\n([\s\S]*?)(?=\n##|$)/);
-        if (familyMatch) {
-            const lines = familyMatch[1].split("\n").filter(l => l.trim().startsWith("-"));
-            for (const line of lines) {
-                const text = line.replace(/^-\s*/, "").trim();
-                if (!text || text.startsWith("(") || text.toLowerCase() === userName.toLowerCase())
-                    continue;
-                const nameMatch = text.match(/^(?:partner|spouse|wife|husband|child|kid|son|daughter|dependent)[:\s]+(.+)/i)
-                    || text.match(/^([\p{Lu}\p{Lo}][\p{L}\s]+)/u);
-                if (nameMatch) {
-                    const name = nameMatch[1].replace(/\s*\(.*\)/, "").trim();
-                    if (name && name.toLowerCase() !== userName.toLowerCase()) {
-                        add(name, "[PARTNER]");
-                    }
-                }
-            }
-        }
-        const incomeMatch = context.match(/## Income\n([\s\S]*?)(?=\n##|$)/);
-        if (incomeMatch) {
-            const lines = incomeMatch[1].split("\n").filter(l => l.trim().startsWith("-"));
-            for (const line of lines) {
-                const text = line.replace(/^-\s*/, "").trim();
-                if (!text || text.startsWith("("))
-                    continue;
-                const employerMatch = text.match(/(?:employer|works? (?:at|for)|employed (?:at|by))[:\s]+([A-Z][\w\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/i)
-                    || text.match(/\bfrom ([A-Z][A-Za-z\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/)
-                    || text.match(/\bat ([A-Z][A-Za-z\s&.,-]+?)(?:\s*[-–—|,;(\n]|$)/);
-                if (employerMatch) {
-                    add(employerMatch[1].trim(), "[EMPLOYER]");
-                }
-            }
+        for (const rule of SECTION_RULES) {
+            applyRule(rule, context, userName, push);
         }
     }
     entries.sort((a, b) => b.real.length - a.real.length);
     return entries;
 }
-// Patterns for numeric / identifier PII commonly found in Thai financial data.
-const NUMERIC_PII_PATTERNS = [
-    // Thai national ID with dashes: 1-2345-67890-12-3
-    [/\b\d-\d{4}-\d{5}-\d{2}-\d\b/g, "[NATID]"],
-    // Thai national ID without dashes (13 digits) — must precede the generic ACCT pattern.
-    [/\b\d{13}\b/g, "[NATID]"],
-    // Thai mobile numbers: 0[689]xxxxxxxx (10 digits starting 06/08/09)
-    [/\b0[689]\d{8}\b/g, "[PHONE]"],
-    // 16-digit credit card (with optional separators)
-    [/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g, "[CARD]"],
-    // 10–12 digit account / routing numbers at a word boundary
-    [/\b\d{10,12}\b(?=\s|$|[,.])/g, "[ACCT]"],
-];
 export function redact(text) {
     const redactions = buildRedactions();
     let result = text;

package/dist/cli/ink/hooks/useTextInput.js

@@ -58,6 +58,22 @@ function insertText(buf, text) {
         col: last.length,
     };
 }
+function moveToBol(buf) {
+    return { ...buf, col: 0 };
+}
+function moveToEol(buf) {
+    return { ...buf, col: buf.lines[buf.row].length };
+}
+function killToEol(buf) {
+    const lines = [...buf.lines];
+    lines[buf.row] = lines[buf.row].slice(0, buf.col);
+    return { lines, row: buf.row, col: buf.col };
+}
+function killToBol(buf) {
+    const lines = [...buf.lines];
+    lines[buf.row] = lines[buf.row].slice(buf.col);
+    return { lines, row: buf.row, col: 0 };
+}
 function backspace(buf) {
     if (buf.col > 0) {
         const lines = [...buf.lines];
@@ -128,6 +144,43 @@ function moveWordRight(buf) {
 function toString(buf) {
     return buf.lines.join("\n");
 }
+/** Pure mutators dispatched by single keycode. Side-effecting keys (Ctrl+C, Ctrl+D,
+ *  Enter, ESC) stay inline in handleChunk because they call host callbacks or open
+ *  a sub-state-machine for escape sequences. */
+const CTRL_HANDLERS = {
+    [CTRL_A]: moveToBol,
+    [CTRL_E]: moveToEol,
+    [CTRL_K]: killToEol,
+    [CTRL_U]: killToBol,
+    [CTRL_W]: deleteWordLeft,
+    [BACKSPACE]: backspace,
+    [BACKSPACE_ALT]: backspace,
+};
+/** CSI sequences: ESC [ ... <final>. `wordMod` runs when the parameter is one of
+ *  the word-step modifiers (Option/Ctrl/Cmd) — `1;3`, `1;5`, `1;9`. */
+const CSI_HANDLERS = {
+    D: { plain: moveLeft, wordMod: moveWordLeft },
+    C: { plain: moveRight, wordMod: moveWordRight },
+    A: { plain: moveUp, wordMod: moveUp },
+    B: { plain: moveDown, wordMod: moveDown },
+    H: { plain: moveToBol, wordMod: moveToBol },
+    F: { plain: moveToEol, wordMod: moveToEol },
+};
+/** Kitty keyboard protocol: ESC [ codepoint ; modifier u */
+function handleKittyKey(seq, apply) {
+    const parts = seq.split(";");
+    const codepoint = parseInt(parts[0], 10);
+    const mod = parts.length > 1 ? parseInt(parts[1], 10) : 1;
+    const hasShift = ((mod - 1) & 1) !== 0;
+    const hasCtrl = ((mod - 1) & 4) !== 0;
+    const hasCmd = ((mod - 1) & 8) !== 0;
+    if (codepoint === 13 && hasShift) {
+        apply((b) => insertText(b, "\n"));
+    }
+    else if (codepoint === 127 && (hasCmd || hasCtrl)) {
+        apply(killToBol);
+    }
+}
 /**
  * Raw-stdin driven keystroke state machine that owns a multiline buffer and
  * exposes its current state plus reset/insert helpers. Purely stateful — Ink
@@ -221,42 +274,15 @@ export function useTextInput(opts) {
                     }
                     continue;
                 }
-                if (code === CTRL_A) {
-                    apply(b => ({ ...b, col: 0 }));
-                    continue;
-                }
-                if (code === CTRL_E) {
-                    apply(b => ({ ...b, col: b.lines[b.row].length }));
-                    continue;
-                }
-                if (code === CTRL_K) {
-                    apply(b => {
-                        const lines = [...b.lines];
-                        lines[b.row] = lines[b.row].slice(0, b.col);
-                        return { lines, row: b.row, col: b.col };
-                    });
-                    continue;
-                }
-                if (code === CTRL_U) {
-                    apply(b => {
-                        const lines = [...b.lines];
-                        lines[b.row] = lines[b.row].slice(b.col);
-                        return { lines, row: b.row, col: 0 };
-                    });
-                    continue;
-                }
-                if (code === CTRL_W) {
-                    apply(deleteWordLeft);
-                    continue;
-                }
                 if (code === ENTER) {
                     optsRef.current.onSubmit(toString(bufferRef.current));
                     setBuffer(EMPTY_BUFFER);
                     optsRef.current.onChange?.(EMPTY_BUFFER);
                     continue;
                 }
-                if (code === BACKSPACE || code === BACKSPACE_ALT) {
-                    apply(backspace);
+                const ctrlHandler = CTRL_HANDLERS[code];
+                if (ctrlHandler) {
+                    apply(ctrlHandler);
                     continue;
                 }
                 if (code === ESC) {
@@ -288,44 +314,12 @@ export function useTextInput(opts) {
                         if (i < chunk.length) {
                             const final = chunk[i];
                             const isWordMod = seq === "1;3" || seq === "1;5" || seq === "1;9";
-                            if (final === "D") {
-                                apply(isWordMod ? moveWordLeft : moveLeft);
-                            }
-                            else if (final === "C") {
-                                apply(isWordMod ? moveWordRight : moveRight);
-                            }
-                            else if (final === "A") {
-                                apply(moveUp);
-                            }
-                            else if (final === "B") {
-                                apply(moveDown);
-                            }
-                            else if (final === "H") {
-                                apply(b => ({ ...b, col: 0 }));
-                            }
-                            else if (final === "F") {
-                                apply(b => ({ ...b, col: b.lines[b.row].length }));
+                            const csi = CSI_HANDLERS[final];
+                            if (csi) {
+                                apply(isWordMod ? csi.wordMod : csi.plain);
                             }
                             else if (final === "u") {
-                                // Kitty keyboard protocol: ESC [ codepoint ; modifier u
-                                const parts = seq.split(";");
-                                const codepoint = parseInt(parts[0], 10);
-                                const mod = parts.length > 1 ? parseInt(parts[1], 10) : 1;
-                                const hasShift = ((mod - 1) & 1) !== 0;
-                                const hasCtrl = ((mod - 1) & 4) !== 0;
-                                const hasCmd = ((mod - 1) & 8) !== 0;
-                                if (codepoint === 13 && hasShift) {
-                                    // Shift+Enter → insert newline
-                                    apply(b => insertText(b, "\n"));
-                                }
-                                else if (codepoint === 127 && (hasCmd || hasCtrl)) {
-                                    // Cmd/Ctrl+Backspace → delete to line start
-                                    apply(b => {
-                                        const lines = [...b.lines];
-                                        lines[b.row] = lines[b.row].slice(b.col);
-                                        return { lines, row: b.row, col: 0 };
-                                    });
-                                }
+                                handleKittyKey(seq, apply);
                             }
                         }
                         continue;

package/dist/scanner/concurrency.d.ts

@@ -1,14 +1,17 @@
 /**
  * Run an array of async task factories with a fixed concurrency bound. Resolves
- * to an array of results in the same order as the input tasks (regardless of
- * completion order). Any rejection settles that slot with `undefined` and the
- * caller is responsible for tracking failures — but since each task is wrapped
- * in `Promise.resolve()` and pushed through `try/catch`, one task throwing
- * never aborts the rest of the run.
+ * to a `Settled<T>[]` in the same order as the input tasks. One task throwing
+ * never aborts the rest — its slot settles as `{ ok: false, error }` and the
+ * caller decides what to do.
  *
  * No new dependency. Simple worker-pool: kicks off up to `n` tasks, then each
  * worker pulls the next index from a shared cursor until the queue is drained.
  */
-export declare function runWithConcurrency<T>(tasks: Array<() => Promise<T>>, n: number): Promise<Array<T | {
+export type Settled<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
     error: unknown;
-}>>;
+};
+export declare function runWithConcurrency<T>(tasks: Array<() => Promise<T>>, n: number): Promise<Settled<T>[]>;

package/dist/scanner/concurrency.js

@@ -1,28 +1,15 @@
-/**
- * Run an array of async task factories with a fixed concurrency bound. Resolves
- * to an array of results in the same order as the input tasks (regardless of
- * completion order). Any rejection settles that slot with `undefined` and the
- * caller is responsible for tracking failures — but since each task is wrapped
- * in `Promise.resolve()` and pushed through `try/catch`, one task throwing
- * never aborts the rest of the run.
- *
- * No new dependency. Simple worker-pool: kicks off up to `n` tasks, then each
- * worker pulls the next index from a shared cursor until the queue is drained.
- */
 export async function runWithConcurrency(tasks, n) {
     const results = new Array(tasks.length);
     const workerCount = Math.max(1, Math.min(n, tasks.length));
     let cursor = 0;
     async function worker() {
-        while (true) {
+        while (cursor < tasks.length) {
             const index = cursor++;
-            if (index >= tasks.length)
-                return;
             try {
-                results[index] = await tasks[index]();
+                results[index] = { ok: true, value: await tasks[index]() };
             }
             catch (err) {
-                results[index] = { error: err };
+                results[index] = { ok: false, error: err };
             }
         }
     }

package/dist/scanner/decrypt_queue.js

@@ -2,6 +2,46 @@ import chalk from "chalk";
 import inquirer from "inquirer";
 import { readPdf } from "./pdf.js";
 import { unlockIfNeeded, persistUnlockOutcome } from "./unlock.js";
+async function decryptOne(db, file, opts) {
+    let pdf;
+    try {
+        pdf = readPdf(file.path);
+    }
+    catch (err) {
+        return { kind: "failed", error: `read failed: ${errorMessage(err)}` };
+    }
+    const existing = findScannedByHash(db, pdf.hash);
+    if (existing && !opts.force) {
+        return { kind: "skipped", existingScannedFileId: existing.id };
+    }
+    try {
+        const unlocked = await unlockIfNeeded({
+            db,
+            filePath: file.path,
+            bytes: pdf.bytes,
+            interactive: opts.interactive,
+        });
+        persistUnlockOutcome(db, file.path, unlocked.outcome);
+        return {
+            kind: "decrypted",
+            file: {
+                path: file.path,
+                fileName: file.name,
+                relPath: file.relPath,
+                hash: pdf.hash,
+                mime: pdf.mime,
+                decryptedBytes: unlocked.decrypted,
+                replacesPriorScannedFileId: existing?.id,
+            },
+        };
+    }
+    catch (err) {
+        return { kind: "failed", error: errorMessage(err) || "unlock failed" };
+    }
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 /**
  * Phase 1 of scan: walk every file in the queue, decrypt any that need it,
  * and return a partition (decrypted / skipped / failed). The actual agent
@@ -15,44 +55,22 @@ export async function decryptQueue(db, files, opts) {
     const skipped = [];
     const failed = [];
     for (let i = 0; i < files.length; i++) {
-        const f = files[i];
-        let pdf;
-        try {
-            pdf = readPdf(f.path);
-        }
-        catch (err) {
-            failed.push({ file: f, error: `read failed: ${err.message}` });
-            opts.onProgress?.({ index: i, total: files.length, fileName: f.name, outcome: "failed" });
-            continue;
-        }
-        const existing = findScannedByHash(db, pdf.hash);
-        if (existing && !opts.force) {
-            skipped.push({ file: f, existingScannedFileId: existing.id });
-            opts.onProgress?.({ index: i, total: files.length, fileName: f.name, outcome: "skipped" });
-            continue;
-        }
-        try {
-            const unlocked = await unlockIfNeeded({
-                db,
-                filePath: f.path,
-                bytes: pdf.bytes,
-                interactive: opts.interactive,
-            });
-            persistUnlockOutcome(db, f.path, unlocked.outcome);
-            decrypted.push({
-                path: f.path,
-                fileName: f.name,
-                relPath: f.relPath,
-                hash: pdf.hash,
-                mime: pdf.mime,
-                decryptedBytes: unlocked.decrypted,
-                replacesPriorScannedFileId: existing?.id,
-            });
-            opts.onProgress?.({ index: i, total: files.length, fileName: f.name, outcome: "decrypted" });
-        }
-        catch (err) {
-            failed.push({ file: f, error: err.message ?? "unlock failed" });
-            opts.onProgress?.({ index: i, total: files.length, fileName: f.name, outcome: "failed" });
+        const file = files[i];
+        const outcome = await decryptOne(db, file, opts);
+        const progress = (kind) => opts.onProgress?.({ index: i, total: files.length, fileName: file.name, outcome: kind });
+        switch (outcome.kind) {
+            case "decrypted":
+                decrypted.push(outcome.file);
+                progress("decrypted");
+                break;
+            case "skipped":
+                skipped.push({ file, existingScannedFileId: outcome.existingScannedFileId });
+                progress("skipped");
+                break;
+            case "failed":
+                failed.push({ file, error: outcome.error });
+                progress("failed");
+                break;
         }
     }
     return { decrypted, skipped, failed };

package/dist/scanner/pdf-unlock.js

@@ -3,6 +3,8 @@
  * the WASM module isn't loaded for data dirs that contain only plaintext PDFs.
  */
 let mupdfPromise = null;
+/** mupdf's authenticatePassword returns 0 on a wrong password, non-zero on success. */
+const MUPDF_AUTH_FAILED = 0;
 function getMupdf() {
     if (!mupdfPromise) {
         mupdfPromise = import("mupdf");
@@ -36,7 +38,7 @@ export async function unlock(bytes, password) {
             return { ok: true, decrypted: bytes };
         }
         const result = doc.authenticatePassword(password);
-        if (result === 0) {
+        if (result === MUPDF_AUTH_FAILED) {
             return { ok: false };
         }
         const out = doc.saveToBuffer("decrypt");

package/dist/scanner/pipeline.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "crypto";
 import { getDb } from "../db/connection.js";
-import { countOpenConcerns, } from "../db/queries/concerns.js";
+import { countOpenConcerns } from "../db/queries/concerns.js";
 import { correlatePairs } from "../db/queries/transactions.js";
 import { runScanAgent } from "../ai/agent.js";
 import { buildDocumentBlock } from "./pdf.js";
@@ -44,24 +44,22 @@ export async function runScan(opts = {}) {
     // Phase 4 — per-file commit
     events?.committing?.();
     const fileResults = commitAll(db, decryptResult, scanResults);
-    return buildSummary(allFiles.length, fileResults, decryptResult);
+    return buildSummary(allFiles.length, fileResults);
 }
 async function scanInParallel(db, files, opts) {
     const tasks = files.map(f => () => scanOneFile(db, f, opts.events));
     const settled = await runWithConcurrency(tasks, opts.concurrency);
-    // Worker errors are captured per-slot by runWithConcurrency. scanOneFile
-    // itself catches LLM errors and returns a ScanWorkResult with `error` set,
-    // so the `{error}` branch only fires for truly unexpected throws.
+    // scanOneFile catches LLM errors and returns ScanWorkResult with `error` set,
+    // so a !r.ok slot here only fires for truly unexpected throws.
     return settled.map((r, i) => {
-        if (r && typeof r === "object" && "error" in r && !("buffer" in r)) {
-            return {
-                decryptedFile: files[i],
-                buffer: new BufferedWriteContext(files[i].fileName),
-                error: String(r.error),
-                agentText: "",
-            };
-        }
-        return r;
+        if (r.ok)
+            return r.value;
+        return {
+            decryptedFile: files[i],
+            buffer: new BufferedWriteContext(files[i].fileName),
+            error: String(r.error),
+            agentText: "",
+        };
     });
 }
 async function scanOneFile(db, file, events) {
@@ -243,7 +241,7 @@ function commitAll(db, decryptResult, scanResults) {
     return out;
 }
 /** Summary assembly */
-function buildSummary(total, details, _decrypt) {
+function buildSummary(total, details) {
     const summary = {
         total,
         scanned: 0,
@@ -268,7 +266,7 @@ function buildAbortedSummary(total, decrypt) {
             name: f.file.name, relPath: f.file.relPath, status: "failed", transactions: 0, concerns: 0, error: f.error,
         })),
     ];
-    return buildSummary(total, details, decrypt);
+    return buildSummary(total, details);
 }
 /** Low-level DB helpers */
 function deleteScannedFile(db, id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plasalid",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Plasalid — AI Harness for Personal Finance",
   "keywords": [
     "finance",