quilltap 4.12.0-dev.9 → 4.12.0

package/README.md

@@ -65,7 +65,7 @@ quilltap --update
 
 ## How It Works
 
-The `quilltap` npm package is a lightweight CLI launcher (~10 KB). On first run, it downloads the pre-built application from [GitHub Releases](https://github.com/foundry-9/quilltap-server/releases) and caches it in a platform-specific directory. Native modules (`better-sqlite3`, `sharp`) ship as prebuilt binaries for your platform — nothing is compiled on install. On Linux, the SQLCipher driver needs glibc 2.35 or newer (Ubuntu 22.04, Debian 12, RHEL 9 or newer); older hosts should run the Docker image.
+The `quilltap` npm package is a lightweight CLI launcher (~10 KB). On first run, it downloads the pre-built application from [GitHub Releases](https://github.com/foundry-9/quilltap-server/releases) and caches it in a platform-specific directory. The SQLCipher database driver (`better-sqlite3`) and `sharp` ship as prebuilt binaries for your platform — the driver is never compiled or rebuilt. `node-pty` (terminals) uses its prebuilds where they exist and compiles on Linux; if a Node.js upgrade leaves `sharp` or `node-pty` built for the old version, the next run rebuilds them automatically. On Linux, the SQLCipher driver needs glibc 2.35 or newer (Ubuntu 22.04, Debian 12, RHEL 9 or newer); older hosts should run the Docker image.
 
 ### Cache Locations
 
@@ -112,7 +112,7 @@ Every subcommand then accepts `--instance <name>` in place of `--data-dir`. The
 
 ## Database Tool
 
-The encrypted SQLite databases (main, LLM logs, mount index) can be queried directly via `quilltap db`. They are SQLCipher-encrypted, so the stock `sqlite3` binary **cannot** open them — this is the way in. There are two modes: high-level subcommands that auto-pick the right database and resolve characters/chats/projects by name, and a low-level path for arbitrary SQL.
+The encrypted SQLite databases (main, LLM logs, mount index) can be queried directly via `quilltap db`. They are encrypted with ChaCha20-Poly1305 (SQLite3 Multiple Ciphers), so neither the stock `sqlite3` binary nor `sqlcipher` can open them — this is the way in. There are two modes: high-level subcommands that auto-pick the right database and resolve characters/chats/projects by name, and a low-level path for arbitrary SQL.
 
 ### Subcommands
 
@@ -170,7 +170,7 @@ quilltap db backup                          # online snapshot of all three DBs
 quilltap db backup main --out /tmp/snap     # one DB to a chosen directory
 quilltap db backup --json                   # parseable per-target sizes + durations
 
-quilltap db integrity                       # cipher_integrity_check + integrity_check
+quilltap db integrity                       # integrity_check (decrypts + verifies every page it reads)
 quilltap db integrity llm-logs              # one DB; exit 0 ok, 1 issues, 2 open failure
 ```
 

package/bin/quilltap.js

@@ -803,9 +803,10 @@ Subcommands (high-level shortcuts; auto-pick the right database):
                               Default destination: <dataDir>/backups/<timestamp>/.
                               Each snapshot is re-opened with the same key and
                               verified with PRAGMA quick_check.
-  integrity [target...]       Run PRAGMA cipher_integrity_check and
-                              PRAGMA integrity_check on the encrypted
-                              databases. Read-only; safe alongside a live
+  integrity [target...]       Run PRAGMA integrity_check on the encrypted
+                              databases; every page read is decrypted and
+                              its Poly1305 tag verified, so tampered pages
+                              count as issues. Read-only; safe alongside a live
                               instance. Exit code: 0 ok, 1 issues, 2 open
                               failure.
   Most subcommands also accept --json and --limit N.
@@ -851,7 +852,7 @@ Examples:
   quilltap db optimize llm-logs                        # only the LLM logs DB
   quilltap db backup                                   # snapshot all DBs to <dataDir>/backups/<ts>/
   quilltap db backup main --out /tmp/qtap-snap         # snapshot only the main DB
-  quilltap db integrity                                # cipher_integrity_check + integrity_check
+  quilltap db integrity                                # integrity_check on every DB
   quilltap db --tables
   quilltap db "SELECT count(*) FROM characters"
   quilltap db --count messages

package/lib/db-commands.js

@@ -1604,7 +1604,7 @@ async function backupOneDb(key, sourcePath, destDir, ctx) {
     return { target: target.label, source: sourcePath, sourceSize, dest: destPath, ok: false, error: err.message };
   }
 
-  // The SQLCipher build in this driver does not expose `sqlcipher_export`
+  // The SQLite3 Multiple Ciphers build in this driver does not expose `sqlcipher_export`
   // and the SQLite online-backup API refuses cross-cipher copies. We
   // instead take a brief exclusive lock, force a WAL checkpoint, and copy
   // the encrypted .db file at the byte level — the pages are already
@@ -1742,44 +1742,30 @@ function integrityOneDb(key, dbPath, ctx) {
     return { target: target.label, ok: false, openable: false, issues: [], reason: err.message };
   }
 
+  // SQLite3 Multiple Ciphers (ChaCha20-Poly1305) has no SQLCipher-style
+  // `cipher_integrity_check` pragma — an unknown pragma returns no rows, so
+  // asking for it reported "ok" without checking anything. The page-level
+  // check is integrity_check itself: every page it reads must decrypt and
+  // pass its Poly1305 tag, and a page that fails throws (SQLITE_CORRUPT /
+  // SQLITE_NOTADB) rather than returning a row, so that is caught as an issue.
   const issues = [];
-  let cipherCheck = null;
   let integrityCheck = null;
   const t0 = Date.now();
   try {
+    let lines;
     try {
-      const rows = db.pragma('cipher_integrity_check');
-      if (rows && rows.length === 0) {
-        cipherCheck = 'ok';
-        console.log('  cipher_integrity_check: ok');
-      } else {
-        const lines = rows.map(r => (r.cipher_integrity_check || Object.values(r)[0] || '')).filter(Boolean);
-        if (lines.length === 1 && lines[0] === 'ok') {
-          cipherCheck = 'ok';
-          console.log('  cipher_integrity_check: ok');
-        } else {
-          cipherCheck = lines.join('; ');
-          for (const line of lines) {
-            console.log(`  cipher_integrity_check: ${line}`);
-            issues.push({ pragma: 'cipher_integrity_check', message: line });
-          }
-        }
-      }
+      const integRows = db.pragma('integrity_check');
+      lines = integRows.map(r => (r.integrity_check || Object.values(r)[0] || '')).filter(Boolean);
     } catch (err) {
-      // Plain SQLite has no cipher_integrity_check; treat as N/A and continue.
-      cipherCheck = `n/a (${err.message})`;
-      console.log(`  cipher_integrity_check: n/a (${err.message})`);
+      lines = [`page read failed (${err.code || 'error'}): ${err.message}`];
     }
-
-    const integRows = db.pragma('integrity_check');
-    const lines = integRows.map(r => (r.integrity_check || Object.values(r)[0] || '')).filter(Boolean);
     if (lines.length === 1 && lines[0] === 'ok') {
       integrityCheck = 'ok';
-      console.log('  integrity_check:        ok');
+      console.log('  integrity_check: ok');
     } else {
       integrityCheck = lines.join('; ');
       for (const line of lines) {
-        console.log(`  integrity_check:        ${line}`);
+        console.log(`  integrity_check: ${line}`);
         issues.push({ pragma: 'integrity_check', message: line });
       }
     }
@@ -1789,13 +1775,10 @@ function integrityOneDb(key, dbPath, ctx) {
   const durationMs = Date.now() - t0;
   console.log(`  duration: ${formatDuration(durationMs)}`);
 
-  const ok = (cipherCheck === 'ok' || cipherCheck === null || (typeof cipherCheck === 'string' && cipherCheck.startsWith('n/a')))
-    && integrityCheck === 'ok';
   return {
     target: target.label,
-    ok,
+    ok: integrityCheck === 'ok',
     openable: true,
-    cipherIntegrityCheck: cipherCheck,
     integrityCheck,
     issues,
     durationMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quilltap",
-  "version": "4.12.0-dev.9",
+  "version": "4.12.0",
   "description": "Self-hosted AI workspace for writers, worldbuilders, and roleplayers. Run with npx quilltap.",
   "author": {
     "name": "Charles Sebold",
@@ -36,7 +36,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@napi-rs/canvas": "^1.0.13",
+    "@napi-rs/canvas": "^1.1.0",
     "better-sqlite3-multiple-ciphers": "^13.0.3",
     "node-pty": "^1.1.0",
     "sharp": "^0.35.5",