tide-commander 1.87.0 → 1.88.1

package/dist/assets/{web-DS0FHmg8.js → web-CN0zYUhV.js}

@@ -1 +1 @@
-import{ck as a}from"./main-BrZe9Zbd.js";import{ImpactStyle as i,NotificationType as r}from"./index-DSvJOrb7.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{ck as a}from"./main-CwfJmt2N.js";import{ImpactStyle as i,NotificationType as r}from"./index-Bm2GprIp.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/assets/{web-D3zCwsS9.js → web-Dik5OZ1r.js}

@@ -1 +1 @@
-import{ck as s}from"./main-BrZe9Zbd.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{ck as s}from"./main-CwfJmt2N.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/assets/{web-DEq3Te_H.js → web-JhU3bMzp.js}

@@ -1 +1 @@
-import{ck as t}from"./main-BrZe9Zbd.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{ck as t}from"./main-CwfJmt2N.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/index.html

@@ -22,10 +22,10 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-BrZe9Zbd.js"></script>
+    <script type="module" crossorigin src="/assets/main-CwfJmt2N.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
-    <link rel="stylesheet" crossorigin href="/assets/main-kpU9m5LW.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-Cm8LaUxX.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/src/packages/server/data/builtin-skills/explore-database.js

@@ -0,0 +1,175 @@
+const BT3 = '```';
+export const exploreDatabase = {
+    slug: 'explore-database',
+    name: 'Explore Database',
+    description: 'Inspect database buildings via the Tide Commander API: list connections, browse databases/tables, read schemas, and run SQL.',
+    allowedTools: ['Bash(curl:*)', 'Bash(jq:*)'],
+    content: `# Explore Database Skill
+
+This skill lets you inspect any **database building** in Tide Commander through the
+internal HTTP API. You can list connections, list databases/tables, read schemas,
+and execute SQL — all without leaving the curl pattern.
+
+All endpoints live under \`/api/database/\` and use the same auth header as every
+other Tide Commander skill (\`X-Auth-Token\`). Passwords are never returned by the
+API; responses include a \`hasPassword\` boolean instead.
+
+---
+
+## Endpoint Reference
+
+| Endpoint | Method | Purpose |
+|---|---|---|
+| \`/api/database/buildings\` | GET | List every database building (redacted connections) |
+| \`/api/database/buildings/{buildingId}\` | GET | One database building with all its connections |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/test\` | POST | Verify the connection works |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/databases\` | GET | List databases on the server |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/databases/{database}/tables\` | GET | List tables/views in a database |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/databases/{database}/tables/{table}/columns\` | GET | **Describe table — columns only** (lean) |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/databases/{database}/tables/{table}/schema\` | GET | Full schema: columns + indexes + foreign keys |
+| \`/api/database/buildings/{buildingId}/connections/{connectionId}/query\` | POST | Run SQL — body \`{database, query, limit?, recordHistory?}\` |
+| \`/api/database/buildings/{buildingId}/history\` | GET | Recent query history (\`?limit=N\`) |
+
+Engines supported: **mysql, postgresql, oracle, sqlite, mssql**. SSH tunnels are
+applied automatically when configured on the connection.
+
+---
+
+## Step 1: Discover database buildings
+
+${BT3}bash
+# List all DB buildings + their connections (redacted)
+curl -s http://localhost:5174/api/database/buildings | jq
+
+# Compact view: just id/name/engine of each connection
+curl -s http://localhost:5174/api/database/buildings \\
+  | jq '.buildings[] | {id, name, conns: [.connections[] | {id, engine, host, port, database}]}'
+${BT3}
+
+Pick the **buildingId** and **connectionId** you want to explore. The \`activeConnectionId\`
+field hints at the one the user typically works with.
+
+## Step 2: Verify the connection
+
+Always run a test before any heavy query — it brings up SSH tunnels and validates
+credentials cheaply.
+
+${BT3}bash
+curl -s -X POST http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/test
+# → {"success":true,"serverVersion":"8.0.36"} or {"success":false,"error":"..."}
+${BT3}
+
+## Step 3: Browse databases and tables
+
+${BT3}bash
+# List databases on the server
+curl -s http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/databases | jq
+
+# List tables/views in a specific database
+curl -s http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/databases/MY_DB/tables | jq
+
+# Compact: just names
+curl -s http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/databases/MY_DB/tables \\
+  | jq '.tables | map(.name)'
+${BT3}
+
+For Oracle, "database" means **schema/owner** (e.g. \`SCOTT\`, \`HR\`). For SQLite the
+"database" is the file path or \`main\`.
+
+## Step 4: Inspect a table's schema
+
+${BT3}bash
+curl -s http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/databases/MY_DB/tables/users/schema | jq
+${BT3}
+
+Returns \`{ database, table, columns, indexes, foreignKeys }\`. Use this to
+discover columns before writing a SELECT.
+
+## Step 5: Run SQL
+
+${BT3}bash
+# Read query — limit defaults to 1000, capped at 10000
+curl -s -X POST http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/query \\
+  -H "Content-Type: application/json" \\
+  -d '{"database":"MY_DB","query":"SELECT id, email FROM users WHERE created_at > NOW() - INTERVAL 1 DAY","limit":50}'
+
+# Persist into the building's query history (visible in the UI)
+curl -s -X POST http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/query \\
+  -H "Content-Type: application/json" \\
+  -d '{"database":"MY_DB","query":"SELECT COUNT(*) AS n FROM users","recordHistory":true}'
+
+# Mutating statements work too — affectedRows is reported instead of rows
+curl -s -X POST http://localhost:5174/api/database/buildings/BUILDING_ID/connections/CONNECTION_ID/query \\
+  -H "Content-Type: application/json" \\
+  -d '{"database":"MY_DB","query":"UPDATE users SET active = 1 WHERE id = 42"}'
+${BT3}
+
+**Response shape (success):**
+${BT3}json
+{
+  "id": "q_1700000000000_abc123",
+  "status": "success",
+  "duration": 12,
+  "rows": [{"id":1,"email":"a@b.com"}],
+  "fields": [{"name":"id","type":"INT"}, {"name":"email","type":"VARCHAR"}],
+  "rowCount": 1
+}
+${BT3}
+
+**Response shape (error):** \`{ "status": "error", "error": "...", "errorCode": "..." }\`
+The HTTP status is \`400\` for SQL errors and \`500\` only for unexpected failures.
+
+## Step 6: Review history
+
+${BT3}bash
+curl -s "http://localhost:5174/api/database/buildings/BUILDING_ID/history?limit=20" | jq '.history[] | {executedAt, status, duration, query}'
+${BT3}
+
+Only queries explicitly run with \`recordHistory:true\` (or executed via the UI)
+appear here.
+
+---
+
+## Important Rules
+
+1. **LIMIT is automatic.** SELECTs without a LIMIT/TOP/FETCH clause are wrapped
+   server-side using the \`limit\` body field (default 1000, max 10000). You don't
+   need to add it manually for safety, but you can.
+2. **One query per request.** The execute endpoint runs a single statement; do
+   not send multi-statement scripts.
+3. **Mutations are real.** \`UPDATE\`, \`DELETE\`, \`DROP\`, etc. execute against the
+   live connection — confirm the building/connection IDs before destructive ops.
+4. **Engine quirks:**
+   - Oracle: pass the **schema name** as \`{database}\`.
+   - SQLite: typically \`main\`. Pragma queries work as raw SQL.
+   - SQL Server: \`TOP n\` is auto-injected for SELECTs without it.
+5. **Never log credentials.** Connection objects from the API never include
+   passwords — \`hasPassword: true\` is the only signal.
+
+## Example Workflow
+
+${BT3}bash
+# 1) Find DB buildings and pick one
+curl -s http://localhost:5174/api/database/buildings \\
+  | jq '.buildings[] | {id, name, activeConnectionId}'
+
+# 2) Verify
+curl -s -X POST http://localhost:5174/api/database/buildings/building_xxx/connections/conn_yyy/test
+
+# 3) Pick a database, list its tables
+curl -s http://localhost:5174/api/database/buildings/building_xxx/connections/conn_yyy/databases | jq
+curl -s http://localhost:5174/api/database/buildings/building_xxx/connections/conn_yyy/databases/app_prod/tables \\
+  | jq '.tables | map(.name)'
+
+# 4) Inspect a table
+curl -s http://localhost:5174/api/database/buildings/building_xxx/connections/conn_yyy/databases/app_prod/tables/orders/schema \\
+  | jq '.columns | map({name, type, primaryKey, nullable})'
+
+# 5) Run an exploratory query
+curl -s -X POST http://localhost:5174/api/database/buildings/building_xxx/connections/conn_yyy/query \\
+  -H "Content-Type: application/json" \\
+  -d '{"database":"app_prod","query":"SELECT status, COUNT(*) c FROM orders GROUP BY status"}' \\
+  | jq '.rows'
+${BT3}
+`,
+};

package/dist/src/packages/server/data/builtin-skills/index.js

@@ -13,6 +13,7 @@ import { streamingExec } from './streaming-exec.js';
 import { bitbucketPR } from './bitbucket-pr.js';
 import { pm2Logs } from './pm2-logs.js';
 import { createBuilding } from './create-building.js';
+import { exploreDatabase } from './explore-database.js';
 import { releasePipeline } from './release-pipeline.js';
 import { taskLabel } from './task-label.js';
 import { agentTracking } from './agent-tracking.js';
@@ -34,6 +35,7 @@ export const BUILTIN_SKILLS = [
     bitbucketPR,
     pm2Logs,
     createBuilding,
+    exploreDatabase,
     releasePipeline,
     taskLabel,
     agentTracking,

package/dist/src/packages/server/data/index.js

@@ -323,6 +323,58 @@ export function getClaudeProjectDir(cwd) {
 // Buildings cache to avoid reading from disk on every call
 let buildingsCache = null;
 let buildingsCacheMtime = 0;
+// Sensitive fields on a DatabaseConnection that should be encrypted at rest.
+// Kept as a typed list so adding a new sensitive field surfaces a compile error
+// instead of silently leaking plaintext.
+const DB_CONNECTION_SECRET_KEYS = ['password'];
+const SSH_TUNNEL_SECRET_KEYS = ['password', 'privateKey', 'passphrase'];
+function encryptIfPresent(value) {
+    if (!value)
+        return value;
+    if (isEncrypted(value))
+        return value;
+    try {
+        return encryptValue(value);
+    }
+    catch {
+        return value;
+    }
+}
+function decryptIfEncrypted(value) {
+    if (!value)
+        return value;
+    if (!isEncrypted(value))
+        return value;
+    try {
+        return decryptValue(value);
+    }
+    catch (err) {
+        log.error(' Failed to decrypt building credential:', err);
+        return '';
+    }
+}
+function transformBuildingCredentials(buildings, mode) {
+    const transform = mode === 'encrypt' ? encryptIfPresent : decryptIfEncrypted;
+    return buildings.map(b => {
+        if (b.type !== 'database' || !b.database?.connections?.length)
+            return b;
+        const connections = b.database.connections.map(conn => {
+            const next = { ...conn };
+            for (const key of DB_CONNECTION_SECRET_KEYS) {
+                next[key] = transform(next[key]);
+            }
+            if (next.ssh) {
+                const ssh = { ...next.ssh };
+                for (const key of SSH_TUNNEL_SECRET_KEYS) {
+                    ssh[key] = transform(ssh[key]);
+                }
+                next.ssh = ssh;
+            }
+            return next;
+        });
+        return { ...b, database: { ...b.database, connections } };
+    });
+}
 /**
  * Load buildings from disk (cached, invalidated by file mtime)
  */
@@ -340,7 +392,7 @@ export function loadBuildings() {
     catch { /* proceed to read */ }
     const data = safeReadJsonSync(BUILDINGS_FILE, 'Buildings');
     if (data?.buildings) {
-        buildingsCache = data.buildings;
+        buildingsCache = transformBuildingCredentials(data.buildings, 'decrypt');
         try {
             buildingsCacheMtime = fs.statSync(BUILDINGS_FILE).mtimeMs;
         }
@@ -358,7 +410,9 @@ export function loadBuildings() {
 export function saveBuildings(buildings) {
     ensureDataDir();
     try {
-        atomicWriteJsonSync(BUILDINGS_FILE, { buildings, savedAt: Date.now(), version: '1.0.0' });
+        const persisted = transformBuildingCredentials(buildings, 'encrypt');
+        atomicWriteJsonSync(BUILDINGS_FILE, { buildings: persisted, savedAt: Date.now(), version: '1.0.0' });
+        // Cache the in-memory (decrypted) view so callers keep working with plaintext
         buildingsCache = buildings;
         buildingsCacheMtime = fs.statSync(BUILDINGS_FILE).mtimeMs;
     }

package/dist/src/packages/server/index.js

@@ -7,7 +7,7 @@ import { createServer } from 'http';
 import { createServer as createHttpsServer } from 'https';
 import fs from 'node:fs';
 import { createApp } from './app.js';
-import { agentService, runtimeService, bossService, skillService, customClassService, secretsService, buildingService, eventRetentionService, triggerService, workflowService } from './services/index.js';
+import { agentService, runtimeService, bossService, skillService, customClassService, secretsService, buildingService, eventRetentionService, triggerService, workflowService, databaseService } from './services/index.js';
 import * as websocket from './websocket/handler.js';
 import { getDataDir } from './data/index.js';
 import { initEventDb, closeEventDb } from './data/event-db.js';
@@ -212,6 +212,7 @@ async function main() {
             buildingService.stopDockerStatusPolling();
             buildingService.stopTerminalStatusPolling();
             buildingService.cleanupAllTerminals();
+            await databaseService.closeAllConnections();
             await runtimeService.shutdown();
             agentService.shutdownSessionHistory();
             agentService.flushPersistAgents();

package/dist/src/packages/server/integrations/gmail/gmail-trigger-handler.js

@@ -47,6 +47,10 @@ export const gmailTriggerHandler = {
     extractVariables(trigger, event) {
         const msg = event.data;
         void trigger;
+        const labels = msg.labels ?? [];
+        // Gmail tags sent messages with the SENT label. Anything else is treated
+        // as inbound (covers INBOX, drafts, all-mail, etc.).
+        const direction = labels.includes('SENT') ? 'outbound' : 'inbound';
         return {
             'email.from': msg.from,
             'email.to': msg.to.join(', '),
@@ -57,10 +61,14 @@ export const gmailTriggerHandler = {
             'email.date': new Date(msg.date).toISOString(),
             'email.hasAttachments': String(msg.hasAttachments),
             'email.attachments': msg.attachmentNames?.join(', ') || '',
+            'email.direction': direction,
+            'email.labels': labels.join(', '),
         };
     },
     formatEventForLLM(event) {
         const msg = event.data;
-        return `Email from ${msg.from}\nSubject: ${msg.subject}\nDate: ${new Date(msg.date).toISOString()}\n\n${msg.body}`;
+        const labels = msg.labels ?? [];
+        const direction = labels.includes('SENT') ? 'outbound' : 'inbound';
+        return `Email (${direction}) from ${msg.from}\nTo: ${msg.to.join(', ')}\nSubject: ${msg.subject}\nDate: ${new Date(msg.date).toISOString()}\n\n${msg.body}`;
     },
 };

package/dist/src/packages/server/integrations/whatsapp/index.js

@@ -10,7 +10,7 @@
  */
 import { createWhatsAppRoutes } from './whatsapp-routes.js';
 import { whatsappConfigSchema, getConfigValues, setConfigValues, loadConfig, WHATSAPP_API_KEY_SECRET, } from './whatsapp-config.js';
-import { createWhatsAppTriggerHandler, } from './whatsapp-trigger-handler.js';
+import { createWhatsAppTriggerHandler, whatsappTriggerHandler, } from './whatsapp-trigger-handler.js';
 import { whatsappSkill } from './whatsapp-skill.js';
 let integrationCtx = null;
 let lastChecked = 0;
@@ -99,9 +99,10 @@ export const whatsappPlugin = {
         return [whatsappSkill];
     },
     getTriggerHandler() {
-        // The TriggerHandler interface here is the trigger-service one.
-        // Our incoming-message bridge is in-process and not surfaced through it.
-        return null;
+        // Real trigger-service handler. Subscribes to the in-process bridge's
+        // notifyTriggerSubscribers stream so events flow into trigger evaluation
+        // even across bridge restarts.
+        return whatsappTriggerHandler;
     },
     getStatus() {
         const config = loadConfig();

package/dist/src/packages/server/integrations/whatsapp/whatsapp-client.js

@@ -39,6 +39,16 @@ export class WhatsAppClient {
         const data = await this.request('GET', `/api/sessions/${encodeURIComponent(sessionId)}/contacts`);
         return Array.isArray(data) ? data : [];
     }
+    async syncChatMessages(sessionId, chatId, count = 50) {
+        return this.request('POST', `/api/sessions/${encodeURIComponent(sessionId)}/chats/${encodeURIComponent(chatId)}/sync-messages?count=${encodeURIComponent(String(count))}`, {});
+    }
+    async syncContacts(sessionId) {
+        return this.request('POST', `/api/sessions/${encodeURIComponent(sessionId)}/sync-contacts`, {});
+    }
+    async getChatMessages(sessionId, chatId, limit = 50) {
+        const data = await this.request('GET', `/api/sessions/${encodeURIComponent(sessionId)}/chats/${encodeURIComponent(chatId)}/messages?limit=${encodeURIComponent(String(limit))}`);
+        return Array.isArray(data) ? data : [];
+    }
     async sendMediaUrl(sessionId, to, mediaUrl, caption, options) {
         // Upstream body shape: { to, url, caption?, filename? } (type is auto-detected
         // from the fetched URL's Content-Type header). `type` is forwarded for

package/dist/src/packages/server/integrations/whatsapp/whatsapp-routes.js

@@ -198,6 +198,74 @@ export function createWhatsAppRoutes(ctx) {
             res.status(502).json({ error: err instanceof Error ? err.message : String(err) });
         }
     });
+    // ─── POST /sessions/:sessionId/chats/:chatId/sync-messages — Force on-demand history sync for a chat ───
+    router.post('/sessions/:sessionId/chats/:chatId/sync-messages', async (req, res) => {
+        const built = getClient();
+        if ('error' in built) {
+            res.status(built.status).json({ error: built.error });
+            return;
+        }
+        const rawCount = typeof req.query.count === 'string' ? Number(req.query.count) : NaN;
+        const count = Number.isFinite(rawCount) && rawCount > 0 ? Math.floor(rawCount) : 50;
+        try {
+            const result = await built.client.syncChatMessages(req.params.sessionId, req.params.chatId, count);
+            res.json({ success: true, data: result });
+        }
+        catch (err) {
+            log.error(`WhatsApp syncChatMessages error: ${err}`);
+            res.status(502).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    // ─── POST /sessions/:sessionId/sync-contacts — Force address-book resync via Baileys app-state ───
+    router.post('/sessions/:sessionId/sync-contacts', async (req, res) => {
+        const built = getClient();
+        if ('error' in built) {
+            res.status(built.status).json({ error: built.error });
+            return;
+        }
+        try {
+            const result = await built.client.syncContacts(req.params.sessionId);
+            res.json({ success: true, data: result });
+        }
+        catch (err) {
+            log.error(`WhatsApp syncContacts error: ${err}`);
+            res.status(502).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    // ─── GET /sessions/:sessionId/contacts — List contacts for a session ───
+    router.get('/sessions/:sessionId/contacts', async (req, res) => {
+        const built = getClient();
+        if ('error' in built) {
+            res.status(built.status).json({ error: built.error });
+            return;
+        }
+        try {
+            const result = await built.client.getContacts(req.params.sessionId);
+            res.json({ success: true, data: result });
+        }
+        catch (err) {
+            log.error(`WhatsApp getContacts error: ${err}`);
+            res.status(502).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    // ─── GET /sessions/:sessionId/chats/:chatId/messages — Fetch recent messages for a chat ───
+    router.get('/sessions/:sessionId/chats/:chatId/messages', async (req, res) => {
+        const built = getClient();
+        if ('error' in built) {
+            res.status(built.status).json({ error: built.error });
+            return;
+        }
+        const rawLimit = typeof req.query.limit === 'string' ? Number(req.query.limit) : NaN;
+        const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 50;
+        try {
+            const result = await built.client.getChatMessages(req.params.sessionId, req.params.chatId, limit);
+            res.json({ success: true, data: result });
+        }
+        catch (err) {
+            log.error(`WhatsApp getChatMessages error: ${err}`);
+            res.status(502).json({ error: err instanceof Error ? err.message : String(err) });
+        }
+    });
     // ─── POST /send-message — Send a text message via Baileys ───
     router.post('/send-message', async (req, res) => {
         const body = (req.body ?? {});

package/dist/src/packages/server/integrations/whatsapp/whatsapp-trigger-handler.js

@@ -13,6 +13,21 @@ import { WhatsAppWsClient } from './whatsapp-ws-client.js';
 import { MessageDedupeCache } from './message-dedupe.js';
 import { ContactNameCache } from './contact-name-cache.js';
 import { WhatsAppClient } from './whatsapp-client.js';
+// Module-level subscriber set fed by the in-process bridge whenever a normalized
+// WhatsApp message is broadcast. The trigger-service-facing handler below
+// registers its callback here, so subscribers stay attached even when the bridge
+// restarts (e.g. on config change).
+const triggerSubscribers = new Set();
+function notifyTriggerSubscribers(payload) {
+    for (const cb of triggerSubscribers) {
+        try {
+            cb(payload);
+        }
+        catch {
+            // Subscriber errors must not break the bridge — swallow.
+        }
+    }
+}
 // Dedupe cache config. The upstream whatsapp-api fires BOTH `message` and
 // `message_create` for the same Baileys event on inbound DMs (see
 // providers/baileysSessionManager.js around the `messages.upsert` handler — it
@@ -105,6 +120,7 @@ export function createWhatsAppTriggerHandler(ctx) {
                 !!payload.from;
             if (!needsEnrichment) {
                 ctx.broadcast({ type: 'whatsapp_message', payload });
+                notifyTriggerSubscribers(payload);
                 return;
             }
             void contactNames.lookup(msg.sessionId, payload.from).then((name) => {
@@ -112,9 +128,11 @@ export function createWhatsAppTriggerHandler(ctx) {
                 if (sanitized)
                     payload.fromName = sanitized;
                 ctx.broadcast({ type: 'whatsapp_message', payload });
+                notifyTriggerSubscribers(payload);
             }, (err) => {
                 ctx.log.warn(`WhatsApp contact lookup failed: ${err}`);
                 ctx.broadcast({ type: 'whatsapp_message', payload });
+                notifyTriggerSubscribers(payload);
             });
         }
         // Other event types (message_ack, group_join, group_leave, hello, error) are
@@ -216,6 +234,7 @@ function normalizeBaileysMessage(sessionId, eventName, data, ts, baseUrl) {
         mediaType,
         mediaUrl,
         direction,
+        chatId: remoteJid ?? from,
     };
 }
 function extractContent(envelope, message) {
@@ -355,3 +374,97 @@ export function sanitizeFromName(name, fromJid) {
     }
     return trimmed;
 }
+// Chat IDs that represent non-message channels (status updates, broadcast
+// lists). The bridge surfaces them as messages because Baileys delivers
+// status posts via `messages.upsert`, but they're not 1:1 / group chats and
+// most triggers shouldn't fire on them.
+function isStatusOrBroadcastChat(chatId) {
+    if (!chatId)
+        return false;
+    if (chatId === 'status@broadcast')
+        return true;
+    if (chatId.endsWith('@broadcast'))
+        return true;
+    return false;
+}
+let triggerUnsubscribe = null;
+export const whatsappTriggerHandler = {
+    triggerType: 'whatsapp',
+    async startListening(onEvent) {
+        const cb = (msg) => {
+            onEvent({
+                source: 'whatsapp',
+                type: 'message',
+                data: msg,
+                timestamp: msg.timestamp,
+            });
+        };
+        triggerSubscribers.add(cb);
+        triggerUnsubscribe = () => triggerSubscribers.delete(cb);
+    },
+    async stopListening() {
+        if (triggerUnsubscribe) {
+            triggerUnsubscribe();
+            triggerUnsubscribe = null;
+        }
+    },
+    structuralMatch(trigger, event) {
+        const msg = event.data;
+        const cfg = trigger.config;
+        // Drop status updates and broadcast-list messages by default — they're
+        // surfaced through the same bridge as real messages but represent stories /
+        // broadcasts, not conversations. Opt-in via includeStatuses.
+        if (!cfg.includeStatuses && isStatusOrBroadcastChat(msg.chatId))
+            return false;
+        if (cfg.direction && cfg.direction !== 'any' && msg.direction !== cfg.direction)
+            return false;
+        if (cfg.groupOnly && !msg.isGroup)
+            return false;
+        if (cfg.dmOnly && msg.isGroup)
+            return false;
+        if (cfg.sessionId && msg.sessionId !== cfg.sessionId)
+            return false;
+        if (cfg.fromFilter?.length) {
+            const fromLower = msg.from.toLowerCase();
+            if (!cfg.fromFilter.some(f => fromLower.includes(f.toLowerCase())))
+                return false;
+        }
+        if (cfg.bodyPattern) {
+            try {
+                if (!new RegExp(cfg.bodyPattern, 'i').test(msg.body))
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    },
+    extractVariables(trigger, event) {
+        const msg = event.data;
+        void trigger;
+        return {
+            'whatsapp.from': msg.from,
+            'whatsapp.fromName': msg.fromName ?? '',
+            'whatsapp.body': msg.body,
+            'whatsapp.sessionId': msg.sessionId,
+            'whatsapp.chatId': msg.chatId,
+            'whatsapp.isGroup': String(msg.isGroup),
+            'whatsapp.groupName': msg.groupName ?? '',
+            'whatsapp.direction': msg.direction,
+            'whatsapp.mediaType': msg.mediaType ?? '',
+            'whatsapp.mediaUrl': msg.mediaUrl ?? '',
+            'whatsapp.timestamp': new Date(msg.timestamp).toISOString(),
+        };
+    },
+    formatEventForLLM(event) {
+        const msg = event.data;
+        const sender = msg.fromName ? `${msg.fromName} (${msg.from})` : msg.from;
+        const channel = msg.isGroup ? `group "${msg.groupName ?? msg.from}"` : 'DM';
+        const verb = msg.direction === 'outbound' ? 'sent' : 'received';
+        const media = msg.mediaType
+            ? `\n[${msg.mediaType} attachment${msg.mediaUrl ? ` ${msg.mediaUrl}` : ''}]`
+            : '';
+        return `WhatsApp message ${verb} in ${channel}\nFrom: ${sender}\nSession: ${msg.sessionId}\nTime: ${new Date(msg.timestamp).toISOString()}${media}\n\n${msg.body}`;
+    },
+};