zigmini 0.8.0-beta.7 → 0.9.0-beta.1

package/src/store.ts

@@ -1,10 +1,11 @@
 import { Database } from "bun:sqlite";
 import { OMO_CHECK_BASELINE, omoCheckActionable, omoCheckDaytime } from "./omo-check-policy.ts";
-import { mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import type { ConversationInfo, DecisionAnswerRequest, NotificationMode, ReplyNotification } from "./protocol.ts";
 import type { NativeTurnStats } from "./turn-stats.ts";
+import { SecurityRuntimeError, securityDecision, type AllowedValue, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
 
 export interface StoredEvent {
 	seq: number;
@@ -358,7 +359,7 @@ export interface DecisionDismissal {
 }
 
 export class DecisionStoreError extends Error {
-	constructor(readonly code: "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
+	constructor(readonly code: "security_endpoint_required" | "decision_not_found" | "decision_conflict" | "submission_conflict" | "source_conflict" | "invalid_decision" | "invalid_decision_answer" | "invalid_decision_cursor" | "invalid_decision_transition", readonly decision: Decision | null = null) {
 		super(code);
 	}
 }
@@ -461,9 +462,11 @@ function completeDecisionAnswer(method: DecisionMethod, payload: unknown, respon
 
 export class Store {
 	private readonly db: Database;
+	private readonly securityReceiptListeners = new Set<() => void>();
 
 	constructor(dataDir: string) {
-		mkdirSync(dataDir, { recursive: true });
+		mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+		chmodSync(dataDir, 0o700);
 		this.db = new Database(join(dataDir, "gateway.sqlite"), { create: true });
 		this.db.exec("PRAGMA journal_mode = WAL;");
 		// Linux builds of bun:sqlite default to synchronous=FULL, which fsyncs every appended event (~80x slower,
@@ -638,6 +641,158 @@ export class Store {
 			this.db.close();
 			throw error;
 		}
+		this.db.exec(`
+			CREATE TABLE IF NOT EXISTS security_allowed_values (
+				id TEXT PRIMARY KEY, value TEXT COLLATE BINARY NOT NULL UNIQUE, data TEXT NOT NULL
+			);
+			CREATE TABLE IF NOT EXISTS security_allow_revision (
+				id INTEGER PRIMARY KEY CHECK(id = 1), revision INTEGER NOT NULL
+			);
+			INSERT OR IGNORE INTO security_allow_revision VALUES (1, 0);
+			CREATE TABLE IF NOT EXISTS security_holds (
+				id TEXT PRIMARY KEY, source_key TEXT UNIQUE, intent_submission TEXT UNIQUE, data TEXT NOT NULL
+			);
+		`);
+		for (const suffix of ["", "-wal", "-shm"]) {
+			const path = join(dataDir, `gateway.sqlite${suffix}`);
+			if (existsSync(path)) chmodSync(path, 0o600);
+		}
+	}
+
+	securityAllowedValues(): { revision: number; values: AllowedValue[] } {
+		return this.db.transaction(() => ({
+			revision: this.db.query<{ revision: number }, []>("SELECT revision FROM security_allow_revision WHERE id = 1").get()!.revision,
+			values: this.db.query<{ data: string }, []>("SELECT data FROM security_allowed_values ORDER BY json_extract(data, '$.approvedAt'), id").all()
+				.map((row): AllowedValue => JSON.parse(row.data)),
+		})).immediate();
+	}
+
+	securityHolds(): SecurityHoldRecord[] {
+		return this.db.query<{ data: string }, []>("SELECT data FROM security_holds ORDER BY rowid").all().map((row) => JSON.parse(row.data));
+	}
+
+	securityHold(id: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE id = ?").get(id);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	securityHoldByKey(key: string): SecurityHoldRecord | null {
+		const row = this.db.query<{ data: string }, [string]>("SELECT data FROM security_holds WHERE source_key = ?").get(key);
+		return row ? JSON.parse(row.data) : null;
+	}
+
+	createSecurityHold(record: SecurityHoldRecord): void {
+		this.db.transaction(() => {
+			const s = record.state;
+			this.db.query("INSERT INTO security_holds (id, source_key, data) VALUES (?, ?, ?)").run(s.id, record.key, JSON.stringify(record));
+			this.insertDecision({
+				id: s.id, revision: s.revision, ownerConv: s.conv, scope: `security:${s.conv}`, workId: null,
+				sourceSessionPath: null, sourceRequestId: s.id, sourceCommandSeq: null, legacyActionId: null,
+				method: "confirm", permission: false, required: false, payload: { kind: "security-check", heldId: s.id },
+				bindingState: "closed", deadlineAt: null, status: "pending",
+				submissionId: null, submissionRevision: null, submissionMode: null, answer: null, commandId: null,
+				answerRoute: null, supersededBy: null, reason: null, createdAt: s.createdAt, updatedAt: s.createdAt,
+			});
+		}).immediate();
+	}
+
+	private writeSecurityHold(record: SecurityHoldRecord): SecurityHoldRecord {
+		const s = record.state;
+		this.db.query("UPDATE security_holds SET data = ?, intent_submission = ? WHERE id = ?")
+			.run(JSON.stringify(record), record.intent?.submissionId ?? null, s.id);
+		const statuses = { pending: "pending", processing: "submitted", sent: "delivered", cancelled: "closed", failed: "needs_review", unconfirmed: "needs_review" } as const;
+		this.db.query("UPDATE decisions SET revision = ?, status = ?, reason = ?, updated_at = ? WHERE id = ?")
+			.run(s.revision, statuses[s.status], s.errorCode, new Date().toISOString(), s.id);
+		return record;
+	}
+
+	claimSecurityHold(id: string, intent: SecurityIntent): { record: SecurityHoldRecord; fresh: boolean } {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			if (record.intent !== null) {
+				if (!isDeepStrictEqual(record.intent, intent)) throw new SecurityRuntimeError("held_conflict", record.state);
+				return { record, fresh: false };
+			}
+			const reused = intent.submissionId === null ? null : this.db.query<{ id: string }, [string]>("SELECT id FROM security_holds WHERE intent_submission = ?").get(intent.submissionId);
+			if (reused || record.state.status !== "pending" ||
+				(intent.expectedRevision !== null && record.state.revision !== intent.expectedRevision)) throw new SecurityRuntimeError("held_conflict", record.state);
+			const claimed = this.writeSecurityHold({ ...record, intent, state: {
+				...record.state, revision: record.state.revision + 1,
+				status: intent.send ? "processing" : "cancelled",
+			} });
+			return { record: claimed, fresh: true };
+		}).immediate();
+	}
+
+	reserveSecurityDispatch(id: string, occurrences: readonly { canonicalValue?: string; value: string; kind: string; label: string }[], approver: SecurityApprover): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record || record.state.status !== "processing" || record.dispatchReserved) throw new SecurityRuntimeError("held_conflict", record?.state);
+			const remember = record.intent?.remember === true;
+			let revision = this.securityAllowedValues().revision;
+			if (remember) {
+				let added = 0;
+				for (const occurrence of occurrences) {
+					const value = occurrence.canonicalValue ?? occurrence.value;
+					const entry: AllowedValue = { id: crypto.randomUUID(), value, kind: occurrence.kind, label: occurrence.label,
+						approvedAt: new Date().toISOString(), approvedBy: approver, heldId: id };
+					added += this.db.query("INSERT OR IGNORE INTO security_allowed_values VALUES (?, ?, ?)").run(entry.id, value, JSON.stringify(entry)).changes;
+				}
+				if (added > 0) {
+					this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+					revision++;
+				}
+			}
+			return this.writeSecurityHold({ ...record, dispatchReserved: true, state: {
+				...record.state, revision: record.state.revision + 1, remembered: remember, allowlistRevision: revision,
+			} });
+		}).immediate();
+	}
+
+	updateSecurityHold(id: string, change: Partial<Pick<HeldState, "status" | "errorCode">>, receipt?: SecurityReceipt, intent?: SecurityIntent): SecurityHoldRecord {
+		return this.db.transaction(() => {
+			const record = this.securityHold(id);
+			if (!record) throw new SecurityRuntimeError("held_conflict");
+			return this.writeSecurityHold({ ...record, intent: record.intent ?? intent ?? null, ...(receipt ? { receipt } : {}),
+				state: { ...record.state, ...change, revision: record.state.revision + 1 } });
+		}).immediate();
+	}
+
+	deleteSecurityAllowedValues(expectedRevision: number, id?: string): { revision: number; removed: number } {
+		return this.db.transaction(() => {
+			let revision = this.securityAllowedValues().revision;
+			if (revision !== expectedRevision) throw new SecurityRuntimeError("allowlist_conflict", undefined, revision);
+			const removed = id === undefined ? this.db.query("DELETE FROM security_allowed_values").run().changes
+				: this.db.query("DELETE FROM security_allowed_values WHERE id = ?").run(id).changes;
+			if (removed > 0) {
+				this.db.query("UPDATE security_allow_revision SET revision = revision + 1 WHERE id = 1").run();
+				revision++;
+			}
+			return { revision, removed };
+		}).immediate();
+	}
+
+	securityReceipt(ref: SecurityReceipt): "sent" | "unconfirmed" | null {
+		if (ref.kind === "answer") {
+			const decision = this.getDecision(ref.decisionId);
+			if (decision?.submissionId !== ref.submissionId) return null;
+			return decision?.status === "delivered" ? "sent" : decision?.reason === "receipt_unknown" ? "unconfirmed" : null;
+		}
+		const after = this.eventsAfter(ref.conv, ref.messageSeq);
+		const inputs = after.filter((event) => event.type === "main.input" && object(event.data) && object(event.data.input_ref) &&
+			event.data.input_ref.message_seq === ref.messageSeq);
+		return inputs.some((input) => after.some((event) => event.type === "main.input.ack" && object(event.data) &&
+			event.data.input_seq === input.seq)) ? "sent" : null;
+	}
+
+	onSecurityReceipt(listener: () => void): () => void {
+		this.securityReceiptListeners.add(listener);
+		return () => this.securityReceiptListeners.delete(listener);
+	}
+
+	notifySecurityReceipts(): void {
+		for (const listener of this.securityReceiptListeners) listener();
 	}
 
 	/**
@@ -939,6 +1094,7 @@ export class Store {
 					.run(input.conv, data.session_path, data.handoff);
 			}
 		}).immediate();
+		this.notifySecurityReceipts();
 	}
 
 	eventsAfter(conv: string, seq: number, limit = -1): StoredEvent[] {
@@ -1015,11 +1171,12 @@ export class Store {
 		}).immediate();
 	}
 
-	/** Acceptance and definitely-unsent intent precede every session-admission await. */
-	acceptMainUser(conv: string, data: unknown): StoredEvent {
+	/** Acceptance, unsent intent and the optional receipt link commit together before session admission. */
+	acceptMainUser(conv: string, data: unknown, receipt?: (ref: SecurityReceipt) => void): StoredEvent {
 		return this.db.transaction(() => {
 			const message = this.appendEvent(conv, "message.user", data);
 			this.appendEvent(conv, "main.user.pending", { message_seq: message.seq });
+			receipt?.({ kind: "message", conv, messageSeq: message.seq });
 			return message;
 		}).immediate();
 	}
@@ -1593,6 +1750,7 @@ export class Store {
 	 * for sibling A cannot invalidate sibling B's options.
 	 */
 	decisionContextReason(decision: Decision): string | null {
+		if (securityDecision(decision)) return null;
 		if (decision.workId !== null) {
 			const work = this.getWork(decision.workId);
 			if (!work) return "owner_unknown";
@@ -1625,6 +1783,7 @@ export class Store {
 		const result = this.db.transaction((): DecisionClaim | DecisionStoreError => {
 			let decision = this.getDecision(id);
 			if (!decision) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(decision)) throw new DecisionStoreError("security_endpoint_required");
 			if (!Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 1 ||
 				!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(request.submissionId)) {
 				throw new DecisionStoreError("invalid_decision_answer", decision);
@@ -2275,6 +2434,7 @@ export class Store {
 		return this.db.transaction((): DecisionDismissal => {
 			const d = this.getDecision(id);
 			if (!d) throw new DecisionStoreError("decision_not_found");
+			if (securityDecision(d)) throw new DecisionStoreError("security_endpoint_required");
 			if (d.revision !== expectedRevision || d.status === "delivered" || d.status === "closed" || d.status === "submitted") {
 				throw new DecisionStoreError("decision_conflict", d);
 			}

package/src/work.ts

@@ -4,6 +4,7 @@ import { isDeepStrictEqual } from "node:util";
 import { OmoCommandError, type OmoClient, type OmoEvent, type OmoStatus } from "./omo/client.ts";
 import { DecisionStoreError, Store, WorkStoreError, type LedgerState, type MainInput, type StoredEvent, type WorkCommand, type WorkItem, type WorkReport, type WorkUpdateKind } from "./store.ts";
 import { nativeReplyEntry, type NativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
+import { notificationHistory } from "./notification-history.ts";
 
 const ACK_TIMEOUT_MS = 30_000;
 const PREFIX = "ZGW_WORK_COMMAND ";
@@ -126,11 +127,15 @@ export class WorkRouter {
 	/** Includes finished, normally lazy sources so enabling never backfills their old replies. */
 	async notificationBaseline(): Promise<void> {
 		for (const work of this.allWorks()) {
-			const binding = await this.ensure(work);
+			const generation = this.generation;
 			const revision = this.options.replies?.revision();
-			const entries = await this.wholeSession(binding.sessionId, () => this.current(work.id, binding));
-			if (!entries || !this.current(work.id, binding)) throw new Error("reply_baseline_discarded");
-			if (revision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, entries, revision);
+			const current = () => !this.stopped && generation === this.generation &&
+				this.store.getWork(work.id)?.sessionPath === work.sessionPath;
+			await notificationHistory(work.sessionPath, (entry) => {
+				if (!current()) throw new Error("reply_baseline_discarded");
+				if (revision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+			}, true);
+			if (!current()) throw new Error("reply_baseline_discarded");
 		}
 	}
 	private allWorks(): WorkItem[] { return this.store.listConversations().flatMap((conv) => this.store.listWorks(conv.id)); }
@@ -750,10 +755,19 @@ export class WorkRouter {
 			if (!this.ready || generation !== this.generation) return;
 			// A completed report may precede the final assistant reply. Enabled notifications
 			// must recover that tail even when command delivery already reached its terminal state.
-			if (["completed", "failed", "cancelled"].includes(work.status) &&
-				this.options.replies?.settings().mode !== "all-replies" &&
-				!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) continue;
 			try {
+				if (["completed", "failed", "cancelled"].includes(work.status) &&
+					!this.store.listWorkCommands(work.id).some((command) => ["pending", "sending", "unknown"].includes(command.delivery))) {
+					if (this.options.replies?.settings().mode === "all-replies") {
+						const revision = this.options.replies.revision();
+						await notificationHistory(work.sessionPath, (entry) => {
+							if (!this.ready || generation !== this.generation ||
+								this.store.getWork(work.id)?.sessionPath !== work.sessionPath) throw new Error("reply_history_discarded");
+							this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId: work.id, title: work.title }, [entry], revision);
+						});
+					}
+					continue;
+				}
 				await this.reconcile(work.id);
 				this.schedule(work.id);
 			} catch (error) { this.fail(error); }

package/web/DESIGN.md

@@ -14,6 +14,10 @@ The chat retains its bounded scroll area. The memo remains an anchored,
 resizable panel inside `messages-wrap`, constrained to the available width
 and height. Text owns the remaining panel height; image controls do not
 overlap the composer or resize handle.
+The message viewport reserves a 64px right gutter outside its scroll area.
+The existing 34px navigation buttons and their 20px right offset occupy this
+gutter, with 10px clearance. All message kinds share this boundary, including
+system notices. The message list remains the only vertical scroll owner.
 
 ## 4. Typography and spacing
 Keep existing 12px panel labels, 14px memo text, 8/12px control spacing,
@@ -105,6 +109,16 @@ image-specific remove labels. Keyboard focus remains visible. Closing or
 reopening the memo must not lose saved text or image references.
 
 ## 8. Verification and retained debt
+Security confirmation reuses the same inbox item, text buttons and inline delete
+confirmation. Chat and inbox share the held identity. Pending, processing, sent,
+cancelled, failed and unconfirmed states have text labels; only confirmed sent
+uses `--ok`. Canonical values preserve whitespace and wrap at narrow widths.
+Allowed values remain inside the existing security settings section. The list
+uses 12px metadata, 8px spacing, 4px radii and existing border/muted tokens.
+Loading, offline, empty, error, retry and busy states use live status regions.
+Delete confirmation focuses the keep action and explains future-check effects.
+Real desktop/mobile and light/dark QA is assigned to the integration lead.
+
 Exercise empty/one/two/full/uploading/error/remove/reopen/remote-update states
 at narrow and wide sizes. Preserve the existing theme and unrelated controls.
 Existing broad application-script size is outside this feature; extract only
@@ -139,3 +153,28 @@ A sent message shows the references it carried above its text as quotes: the 1px
 as the title; reference text is set as DOM text only, never HTML. No new tokens or motion; autocomplete, IME, autocopy,
 마지막 보냄 includes the reference count, including a reference-only send. ArrowUp still recalls typed text only,
 as it already does for image-only messages.
+
+## 10. Inline chat diagrams (180)
+Only complete top-level, unindented triple-backtick `zigmini-diagram` fences
+become diagrams. Invalid and unfinished fences retain the existing source view.
+The figure uses `--bg-card`, `--bg-input`, `--border`, `--text` and `--muted`.
+Native node text inherits the message font and stays selectable. Nodes use
+8px/12px padding, a 4px radius and a 1px border; the figure uses an 8px radius.
+Top-to-bottom levels use intrinsic max-content columns, 24px column gaps and
+48px row gaps. A 24px right gutter carries edges that skip a level; their
+horizontal segments stay in the row gaps, never through intermediate labels.
+Labels never scale down or truncate, including at enlarged text.
+The diagram viewport alone owns horizontal and vertical diagram scrolling,
+bounded to the message width and 24rem height. The transcript retains normal
+scroll chaining. At phone widths up to 640px, the figure leaves 48px on its right
+for the existing transcript navigation buttons, keeping its source and scroll
+controls clear without changing those buttons or other message layouts.
+The viewport is a named keyboard-focusable region with a visible
+text-colour focus outline. A native details/summary source foldout follows it,
+with a 44px minimum summary target and selectable complete fence source.
+The title and a native text list describe every directed edge for assistive
+technology; SVG connectors are inert and hidden from it. Disconnected nodes
+remain visible. No animation, network, remote fonts, new settings or exports.
+Source foldouts retain their local open state across streaming updates.
+Desktop/phone light/dark, enlarged text, source/copy and reference QA belong
+to the parent integration lane; local unit checks do not claim visual approval.