talon-agent 5.2.1 → 5.3.0

package/src/plugins/playwright/index.ts

@@ -25,9 +25,9 @@
  * with "428 Precondition Required". @playwright/mcp is therefore pinned
  * exactly in package.json (0.0.56 → playwright 1.58.x, matching python
  * playwright 1.58 which hosts Camoufox — camoufox itself caps playwright at
- * <1.61, so the node client cannot chase latest). Bump BOTH sides together,
- * deliberately — do not let a routine dependency bump move one without the
- * other.
+ * <1.61, so the node client cannot chase latest). The pin is enforced, not
+ * just documented: see version-coupling.ts (unit test that fails CI on a
+ * bump, validateConfig refusal, and a live handshake probe at init).
  */
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -35,6 +35,12 @@ import { dirname, resolve } from "node:path";
 import type { TalonPlugin } from "../../core/plugin/types.js";
 import { files } from "../../util/paths.js";
 import { log } from "../../util/log.js";
+import {
+  ENDPOINT_PLAYWRIGHT_MINOR,
+  bundledPlaywrightVersion,
+  couplingError,
+  probeEndpoint,
+} from "./version-coupling.js";
 
 export function createPlaywrightPlugin(config: {
   browser?: string;
@@ -141,6 +147,13 @@ export function createPlaywrightPlugin(config: {
         );
       }
 
+      // Endpoint mode: refuse to start on a client/server minor mismatch
+      // rather than fail every tool call later (see version-coupling.ts).
+      if (endpoint) {
+        const coupling = couplingError(bundledPlaywrightVersion());
+        if (coupling) errors.push(coupling);
+      }
+
       return errors.length > 0 ? errors : undefined;
     },
 
@@ -149,6 +162,29 @@ export function createPlaywrightPlugin(config: {
         "playwright",
         `Ready (${endpoint ? `Camoufox @ ${endpoint}` : `${browser}, headless=${headless}`})`,
       );
+      if (!endpoint) return;
+      // Live handshake with the bundled client version: catches a drifted
+      // server (the static check only knows the expected minor).
+      const client =
+        bundledPlaywrightVersion() ?? `${ENDPOINT_PLAYWRIGHT_MINOR}.0`;
+      const probe = await probeEndpoint(endpoint, client);
+      switch (probe.state) {
+        case "match":
+          log("playwright", `Endpoint handshake OK (Playwright ${client})`);
+          break;
+        case "mismatch":
+          log(
+            "playwright",
+            `ERROR: endpoint ${endpoint} is on Playwright ${probe.server} but the bundled client is ${probe.client} — every browser tool call will fail with 428. Align the python playwright hosting Camoufox with ENDPOINT_PLAYWRIGHT_MINOR (${ENDPOINT_PLAYWRIGHT_MINOR}) or re-pin @playwright/mcp.`,
+          );
+          break;
+        case "unreachable":
+          log(
+            "playwright",
+            `Warning: endpoint ${endpoint} did not answer the handshake probe (${probe.reason}); browser tools will fail until it is up.`,
+          );
+          break;
+      }
     },
   };
 }

package/src/plugins/playwright/provision.ts

@@ -28,6 +28,11 @@ import {
   type ProvisionOutcome,
 } from "../../core/plugin/provision.js";
 import { dirs } from "../../util/paths.js";
+import {
+  ENDPOINT_PLAYWRIGHT_MINOR,
+  bundledPlaywrightVersion,
+  couplingError,
+} from "./version-coupling.js";
 
 /** Engines whose builds Playwright manages (vs system channels). */
 const MANAGED_ENGINES = new Set(["chromium", "firefox", "webkit"]);
@@ -54,6 +59,8 @@ export interface PlaywrightProvisionDeps {
   listDir?: (p: string) => string[];
   /** playwright-core's browser registry (default: browsers.json beside the CLI). */
   registry?: BrowserDescriptor[];
+  /** Bundled playwright-core version (default: read from node_modules). */
+  bundledPlaywrightVersion?: string;
 }
 
 /** One entry of playwright-core's browsers.json. */
@@ -287,12 +294,26 @@ export function inspectPlaywright(
   deps: PlaywrightProvisionDeps = {},
 ): DoctorCheck[] {
   if (section.endpoint ?? section.endpointFile) {
+    const bundled = deps.bundledPlaywrightVersion ?? bundledPlaywrightVersion();
+    const coupling = couplingError(bundled);
     return [
       {
         label: "Playwright: remote endpoint mode",
         status: "info",
         detail: "browser lives on the remote end",
       },
+      coupling
+        ? {
+            label: "Playwright: client/endpoint version mismatch",
+            status: "fail",
+            detail: coupling,
+            issue: true,
+          }
+        : {
+            label: `Playwright: client on endpoint minor ${ENDPOINT_PLAYWRIGHT_MINOR}`,
+            status: "ok",
+            detail: bundled ? `playwright-core ${bundled}` : undefined,
+          },
     ];
   }
   const browser = section.browser ?? "chromium";

package/src/plugins/playwright/version-coupling.ts

@@ -0,0 +1,195 @@
+/**
+ * Endpoint-mode version coupling — the machinery behind the pin.
+ *
+ * In endpoint mode the MCP child connects to a remote Playwright server
+ * (the python-playwright process hosting Camoufox). Playwright's server
+ * refuses the WebSocket upgrade with "428 Precondition Required" when the
+ * client's playwright MINOR (sent in the User-Agent, `Playwright/x.y.z`)
+ * differs from its own — so a client bump that nobody noticed turns every
+ * browser tool call into an opaque error at the worst possible moment.
+ *
+ * Three guards, all keyed on ENDPOINT_PLAYWRIGHT_MINOR:
+ *  - a unit test asserts the playwright-core that @playwright/mcp bundles is
+ *    on that minor, so a dependency bump goes red in CI instead of green;
+ *  - `validateConfig` refuses to start the plugin on a mismatch, with a
+ *    message that names both versions and the fix;
+ *  - `probeEndpoint` performs the real handshake at init and reports the
+ *    server's verdict, so a drifted *server* is caught too.
+ *
+ * Bumping: change ENDPOINT_PLAYWRIGHT_MINOR and `@playwright/mcp` in
+ * package.json in the same commit, after upgrading the python side
+ * (camoufox caps python-playwright, so the node side cannot chase latest).
+ */
+
+import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { resolve } from "node:path";
+
+/**
+ * Playwright minor of the remote endpoint (python playwright behind
+ * Camoufox). Must equal the minor of the playwright-core bundled by the
+ * pinned @playwright/mcp — see the header comment before changing it.
+ */
+export const ENDPOINT_PLAYWRIGHT_MINOR = "1.58";
+
+/** "1.58.0-alpha-2026-01-16" → "1.58". */
+export function minorOf(version: string): string {
+  const m = version.match(/^(\d+)\.(\d+)/);
+  return m ? `${m[1]}.${m[2]}` : version;
+}
+
+function defaultModulesRoot(): string {
+  return resolve(import.meta.dirname ?? ".", "../../../node_modules");
+}
+
+/** Version of the playwright-core the MCP child will run with. */
+export function bundledPlaywrightVersion(
+  modulesRoot: string = defaultModulesRoot(),
+): string | undefined {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(
+        resolve(modulesRoot, "playwright-core/package.json"),
+        "utf-8",
+      ),
+    ) as { version?: string };
+    return pkg.version;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Static check: does the bundled client sit on the endpoint's minor?
+ * Returns an error message, or undefined when coupled (or when the bundle
+ * cannot be read — that is reported separately as a missing install).
+ */
+export function couplingError(
+  bundled: string | undefined,
+  expectedMinor: string = ENDPOINT_PLAYWRIGHT_MINOR,
+): string | undefined {
+  if (!bundled) return undefined;
+  const got = minorOf(bundled);
+  if (got === expectedMinor) return undefined;
+  return (
+    `@playwright/mcp bundles playwright-core ${bundled} (minor ${got}) but the ` +
+    `remote endpoint is on Playwright ${expectedMinor} — every browser tool call ` +
+    `would fail with "428 Precondition Required". Pin @playwright/mcp to the ` +
+    `release that bundles playwright-core ${expectedMinor}.x, or bump ` +
+    `ENDPOINT_PLAYWRIGHT_MINOR together with the python side ` +
+    `(src/plugins/playwright/version-coupling.ts).`
+  );
+}
+
+export type EndpointProbe =
+  | { state: "match"; client: string }
+  | { state: "mismatch"; client: string; server: string }
+  | { state: "unreachable"; client: string; reason: string };
+
+/** Parse the body Playwright's server sends with its 428. */
+export function parseMismatch(
+  body: string,
+): { server: string; client: string } | undefined {
+  const server = body.match(/server version:\s*v?([\d.]+)/);
+  const client = body.match(/client version:\s*v?([\d.]+)/);
+  return server && client
+    ? { server: server[1], client: client[1] }
+    : undefined;
+}
+
+/**
+ * Perform the WebSocket upgrade the MCP child performs, advertising
+ * `clientVersion`, and read the server's verdict. Never throws; never
+ * leaves a connection open (a completed upgrade is torn down at once, and
+ * Playwright's server treats that as an ordinary client disconnect).
+ */
+export function probeEndpoint(
+  endpoint: string,
+  clientVersion: string,
+  timeoutMs = 3000,
+): Promise<EndpointProbe> {
+  return new Promise((settle) => {
+    let url: URL;
+    try {
+      url = new URL(endpoint);
+    } catch {
+      settle({
+        state: "unreachable",
+        client: clientVersion,
+        reason: `invalid endpoint URL: ${endpoint}`,
+      });
+      return;
+    }
+    const secure = url.protocol === "wss:" || url.protocol === "https:";
+    const request = secure ? httpsRequest : httpRequest;
+    const req = request({
+      host: url.hostname,
+      port: url.port || (secure ? 443 : 80),
+      path: `${url.pathname}${url.search}`,
+      method: "GET",
+      headers: {
+        Connection: "Upgrade",
+        Upgrade: "websocket",
+        "Sec-WebSocket-Version": "13",
+        "Sec-WebSocket-Key": randomBytes(16).toString("base64"),
+        "User-Agent": `Playwright/${clientVersion} (talon endpoint probe)`,
+      },
+      timeout: timeoutMs,
+    });
+    let settled = false;
+    const done = (result: EndpointProbe) => {
+      if (settled) return;
+      settled = true;
+      req.destroy();
+      settle(result);
+    };
+    req.on("upgrade", (_res, socket) => {
+      socket.destroy();
+      done({ state: "match", client: clientVersion });
+    });
+    req.on("response", (res) => {
+      let body = "";
+      res.setEncoding("utf-8");
+      res.on("data", (chunk: string) => {
+        body += chunk;
+      });
+      res.on("end", () => {
+        if (res.statusCode === 428) {
+          const parsed = parseMismatch(body);
+          done(
+            parsed
+              ? {
+                  state: "mismatch",
+                  client: clientVersion,
+                  server: parsed.server,
+                }
+              : {
+                  state: "unreachable",
+                  client: clientVersion,
+                  reason: "428 without a version box in the body",
+                },
+          );
+          return;
+        }
+        done({
+          state: "unreachable",
+          client: clientVersion,
+          reason: `HTTP ${res.statusCode ?? "?"} instead of an upgrade`,
+        });
+      });
+    });
+    req.on("timeout", () =>
+      done({ state: "unreachable", client: clientVersion, reason: "timeout" }),
+    );
+    req.on("error", (err: Error) =>
+      done({
+        state: "unreachable",
+        client: clientVersion,
+        reason: err.message,
+      }),
+    );
+    req.end();
+  });
+}

package/src/storage/backup/index.ts

@@ -0,0 +1,82 @@
+/**
+ * Snapshot index store — the listing/status view over the backups on
+ * disk and on remote targets.
+ *
+ * Zero SQL by contract (see repo.ts). The domain rule this layer adds is
+ * atomicity: a snapshot and its per-target rows move together, so a
+ * pruned snapshot never leaves orphan remote rows behind to be counted
+ * by the next retention pass.
+ *
+ * It lives in its own directory rather than as `storage/backups.ts`
+ * because the flat `storage/` surface is at its documented ceiling
+ * (docs/structure.md, tree baseline) — the store and its repository are
+ * one concern with one entry, which is what the contract asks for.
+ */
+
+import { inTransaction } from "../db.js";
+import * as repo from "./repo.js";
+
+/**
+ * Re-exported so the backup subsystem can ask SQLite for a consistent
+ * copy of itself without importing the connection module: the database
+ * handle stays inside storage/ (`db-handle-stays-in-storage`), and a
+ * snapshot of the database is a storage concern with a storage API.
+ */
+export { snapshotDatabase } from "../db.js";
+
+export type { BackupRecord, BackupRemoteRecord } from "./repo.js";
+import type { BackupRecord, BackupRemoteRecord } from "./repo.js";
+
+/** Insert or replace one snapshot row. */
+export function recordBackup(record: BackupRecord): void {
+  repo.upsert(record);
+}
+
+export function getBackup(id: string): BackupRecord | undefined {
+  return repo.get(id);
+}
+
+/** Every indexed snapshot, newest first. */
+export function listBackups(): BackupRecord[] {
+  return repo.all();
+}
+
+/** Ids only — for reconciling the index against the directories on disk. */
+export function backupIds(): Set<string> {
+  return new Set(repo.ids());
+}
+
+/** Returns false when no such snapshot is indexed. */
+export function pinBackup(id: string, pinned: boolean): boolean {
+  return repo.setPinned(id, pinned);
+}
+
+/** Replace the stored manifest (after an upload, a pin, a remote prune). */
+export function updateBackupManifest(
+  id: string,
+  manifestJson: string,
+  pinned: boolean,
+  sizeBytes: number,
+): void {
+  repo.setManifest(id, manifestJson, pinned, sizeBytes);
+}
+
+/** Drop a snapshot and every remote row that referenced it. */
+export function deleteBackup(id: string): void {
+  inTransaction(() => {
+    repo.removeRemotes(id);
+    repo.remove(id);
+  });
+}
+
+export function recordBackupRemote(record: BackupRemoteRecord): void {
+  repo.upsertRemote(record);
+}
+
+export function listBackupRemotes(backupId?: string): BackupRemoteRecord[] {
+  return backupId === undefined ? repo.remotesAll() : repo.remotesFor(backupId);
+}
+
+export function deleteBackupRemote(backupId: string, targetId: string): void {
+  repo.removeRemote(backupId, targetId);
+}

package/src/storage/backup/repo.ts

@@ -0,0 +1,164 @@
+/**
+ * Snapshot-index repository — executes the statements in
+ * sql/backups.sql against the `backups` and `backup_remotes` tables.
+ * No SQL text lives here and none lives above: `storage/backup/index.ts`
+ * holds the domain API, this module owns statement execution and the
+ * row↔domain mapping.
+ *
+ * The manifest travels as an opaque JSON string. Storage sits below the
+ * engine, so it must not know the shape core/backup gives it — it stores
+ * the bytes and the few columns the listing surfaces sort and filter on.
+ */
+
+import { getDatabase } from "../db.js";
+import { backupsSql } from "../sql/statements.generated.js";
+
+/** One snapshot as the index holds it. */
+export type BackupRecord = {
+  id: string;
+  kind: string;
+  label?: string;
+  pinned: boolean;
+  /** Epoch ms. */
+  createdAt: number;
+  sizeBytes: number;
+  /** The manifest.json body, verbatim. */
+  manifestJson: string;
+};
+
+/** One target's state for one snapshot. */
+export type BackupRemoteRecord = {
+  backupId: string;
+  targetId: string;
+  status: string;
+  remoteId?: string;
+  uploadedAt?: number;
+  error?: string;
+};
+
+type Row = {
+  id: string;
+  kind: string;
+  label: string | null;
+  pinned: number;
+  created_at: number;
+  size_bytes: number;
+  manifest_json: string;
+};
+
+type RemoteRow = {
+  backup_id: string;
+  target_id: string;
+  status: string;
+  remote_id: string | null;
+  uploaded_at: number | null;
+  error: string | null;
+};
+
+function toRecord(row: Row): BackupRecord {
+  return {
+    id: row.id,
+    kind: row.kind,
+    label: row.label ?? undefined,
+    pinned: row.pinned === 1,
+    createdAt: row.created_at,
+    sizeBytes: row.size_bytes,
+    manifestJson: row.manifest_json,
+  };
+}
+
+function toRemote(row: RemoteRow): BackupRemoteRecord {
+  return {
+    backupId: row.backup_id,
+    targetId: row.target_id,
+    status: row.status,
+    remoteId: row.remote_id ?? undefined,
+    uploadedAt: row.uploaded_at ?? undefined,
+    error: row.error ?? undefined,
+  };
+}
+
+export function upsert(record: BackupRecord): void {
+  getDatabase()
+    .prepare(backupsSql.upsert)
+    .run(
+      record.id,
+      record.kind,
+      record.label ?? null,
+      record.pinned ? 1 : 0,
+      record.createdAt,
+      record.sizeBytes,
+      record.manifestJson,
+    );
+}
+
+export function get(id: string): BackupRecord | undefined {
+  const row = getDatabase().prepare(backupsSql.get).get(id) as Row | undefined;
+  return row ? toRecord(row) : undefined;
+}
+
+/** Newest first. */
+export function all(): BackupRecord[] {
+  return (getDatabase().prepare(backupsSql.all).all() as Row[]).map(toRecord);
+}
+
+export function ids(): string[] {
+  return (getDatabase().prepare(backupsSql.ids).all() as { id: string }[]).map(
+    (row) => row.id,
+  );
+}
+
+export function setPinned(id: string, pinned: boolean): boolean {
+  const result = getDatabase()
+    .prepare(backupsSql.setPinned)
+    .run(pinned ? 1 : 0, id) as { changes?: number };
+  return (result.changes ?? 0) > 0;
+}
+
+export function setManifest(
+  id: string,
+  manifestJson: string,
+  pinned: boolean,
+  sizeBytes: number,
+): void {
+  getDatabase()
+    .prepare(backupsSql.setManifest)
+    .run(manifestJson, pinned ? 1 : 0, sizeBytes, id);
+}
+
+export function remove(id: string): void {
+  getDatabase().prepare(backupsSql.remove).run(id);
+}
+
+export function upsertRemote(record: BackupRemoteRecord): void {
+  getDatabase()
+    .prepare(backupsSql.upsertRemote)
+    .run(
+      record.backupId,
+      record.targetId,
+      record.status,
+      record.remoteId ?? null,
+      record.uploadedAt ?? null,
+      record.error ?? null,
+    );
+}
+
+export function remotesAll(): BackupRemoteRecord[] {
+  return (
+    getDatabase().prepare(backupsSql.remotesAll).all() as RemoteRow[]
+  ).map(toRemote);
+}
+
+export function remotesFor(backupId: string): BackupRemoteRecord[] {
+  return (
+    getDatabase().prepare(backupsSql.remotesFor).all(backupId) as RemoteRow[]
+  ).map(toRemote);
+}
+
+export function removeRemotes(backupId: string): void {
+  getDatabase().prepare(backupsSql.removeRemotes).run(backupId);
+}
+
+export function removeRemote(backupId: string, targetId: string): void {
+  getDatabase().prepare(backupsSql.removeRemote).run(backupId, targetId);
+}

package/src/storage/db.ts

@@ -216,6 +216,26 @@ export function flushDatabase(): void {
   }
 }
 
+/**
+ * Write a transactionally consistent copy of the database to `destPath`.
+ *
+ * The backup subsystem's only way in: a snapshot may not copy
+ * `data/talon.db` from disk, because in WAL mode the committed pages
+ * live partly in the sidecar and a byte-wise copy of the main file is a
+ * corrupt (or silently stale) database. `VACUUM INTO` asks SQLite for
+ * the copy instead — one file, no WAL, checkpointed and compacted,
+ * consistent as of the moment it runs, with concurrent readers and
+ * writers untouched.
+ *
+ * `destPath` must not exist (SQLite refuses to overwrite); its parent
+ * directory is created if needed.
+ */
+export function snapshotDatabase(destPath: string): void {
+  const database = getDatabase();
+  mkdirSync(dirname(destPath), { recursive: true });
+  database.prepare(dbSql.vacuumInto).run(destPath);
+}
+
 export function closeDatabase(): void {
   if (!db) return;
   try {

package/src/storage/sql/backups.sql

@@ -0,0 +1,46 @@
+-- Statements for the snapshot index (see repositories in
+-- storage/backup/repo.ts for parameter order and row↔domain mapping).
+
+-- name: upsert
+INSERT OR REPLACE INTO backups
+  (id, kind, label, pinned, created_at, size_bytes, manifest_json)
+VALUES (?, ?, ?, ?, ?, ?, ?)
+
+-- name: get
+SELECT id, kind, label, pinned, created_at, size_bytes, manifest_json
+FROM backups WHERE id = ?
+
+-- name: all
+SELECT id, kind, label, pinned, created_at, size_bytes, manifest_json
+FROM backups ORDER BY created_at DESC
+
+-- name: ids
+SELECT id FROM backups
+
+-- name: setPinned
+UPDATE backups SET pinned = ? WHERE id = ?
+
+-- name: setManifest
+UPDATE backups SET manifest_json = ?, pinned = ?, size_bytes = ? WHERE id = ?
+
+-- name: remove
+DELETE FROM backups WHERE id = ?
+
+-- name: upsertRemote
+INSERT OR REPLACE INTO backup_remotes
+  (backup_id, target_id, status, remote_id, uploaded_at, error)
+VALUES (?, ?, ?, ?, ?, ?)
+
+-- name: remotesAll
+SELECT backup_id, target_id, status, remote_id, uploaded_at, error
+FROM backup_remotes
+
+-- name: remotesFor
+SELECT backup_id, target_id, status, remote_id, uploaded_at, error
+FROM backup_remotes WHERE backup_id = ?
+
+-- name: removeRemotes
+DELETE FROM backup_remotes WHERE backup_id = ?
+
+-- name: removeRemote
+DELETE FROM backup_remotes WHERE backup_id = ? AND target_id = ?

package/src/storage/sql/db.sql

@@ -30,3 +30,11 @@ ALTER TABLE history_messages ADD COLUMN attachments TEXT
 -- Column reconciliation for databases that shipped before the cache-age
 -- signal existed. Fresh databases get the column via schema.sql.
 ALTER TABLE sessions ADD COLUMN last_turn_ended_at INTEGER
+
+-- name: vacuumInto
+-- Transactionally consistent copy of the whole database into a new file,
+-- produced by SQLite itself (storage/db.ts snapshotDatabase). A backup
+-- must never copy a live .db byte-wise: the WAL holds committed pages the
+-- main file does not, so the copy would be a corrupt database or an old
+-- one. Verified to accept a bound path on node:sqlite and bun:sqlite.
+VACUUM INTO ?

package/src/storage/sql/schema.sql

@@ -362,3 +362,33 @@ CREATE TABLE IF NOT EXISTS whatsapp_messages (
 CREATE INDEX IF NOT EXISTS idx_whatsapp_messages_msg ON whatsapp_messages(msg_id);
 CREATE INDEX IF NOT EXISTS idx_whatsapp_messages_wa_id ON whatsapp_messages(wa_id);
 CREATE INDEX IF NOT EXISTS idx_whatsapp_messages_time ON whatsapp_messages(timestamp);
+
+-- Snapshot index: the listing/status view over ~/.talon/backups/. The
+-- manifest.json next to the parts on disk stays the source of truth for
+-- a restore (a database that needs restoring cannot also be the record
+-- of how), so these rows are a cache — dropped rows are re-derived from
+-- the directories on the next boot, and a row whose directory is gone is
+-- kept because the snapshot may still exist on a remote target.
+CREATE TABLE IF NOT EXISTS backups (
+  id            TEXT PRIMARY KEY,
+  kind          TEXT    NOT NULL,
+  label         TEXT,
+  pinned        INTEGER NOT NULL DEFAULT 0,
+  created_at    INTEGER NOT NULL,
+  size_bytes    INTEGER NOT NULL DEFAULT 0,
+  manifest_json TEXT    NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_backups_created ON backups(created_at DESC);
+
+-- Per-target upload state for one snapshot. Separate from the manifest
+-- copy so retention can ask "what is on Drive?" without opening a file
+-- per snapshot, and so a failed upload's error survives a restart.
+CREATE TABLE IF NOT EXISTS backup_remotes (
+  backup_id   TEXT    NOT NULL,
+  target_id   TEXT    NOT NULL,
+  status      TEXT    NOT NULL,
+  remote_id   TEXT,
+  uploaded_at INTEGER,
+  error       TEXT,
+  PRIMARY KEY (backup_id, target_id)
+);