fix: close 9 findings from Oracle audit wave 3 (dreamer/storage/rpc/system-prompt)

Three parallel read-only Oracles (dreamer subsystem; storage/migrations/sqlite
backend; RPC/TUI/system-prompt/conflict/auto-update). Cores verified safe (lease
atomicity/reclaim/renewal, circuit breaker, epoch semantics; schema fence,
fresh-DB migration, bind-style guard, transaction shim; RPC bearer auth +
session-scoped notifications, conflict canonical-name matching, auto-update
backgrounding). 9 source-confirmed fixes; design items banked (D1 reinforced, D5–D9).

P0:
- system-prompt handler fail-open (system-prompt-hash.ts). estimateTokens /
  updateSessionMeta could throw into the prompt path (the caller just awaits) —
  a busy/failing DB or pathological tokenizer would FAIL the LLM call instead of
  losing a telemetry write. Per the project's fail-open-in-per-turn-handlers rule,
  wrapped both in try/catch; the already-mutated prompt is preserved. +regression
  test (drops session_meta mid-flight, asserts handler resolves + prompt intact).

P1:
- Dreamer lease-busy dequeue (runner.ts). With a live lease held (this project or
  a sibling on the shared queue), the tick still dequeued, failed lease
  acquisition, incremented retry, and after MAX_LEASE_RETRIES DELETED the queue
  row — silently dropping a project's pending dream. Now skip the tick while a
  lease is active; the entry stays queued.
- RPC token-file perms (rpc-server.ts). mkdir/writeFile mode only applies on
  CREATE, so a pre-existing loose-perm dir or stale .tmp could leave the bearer
  token world-readable. chmod the dir 0o700, rm stale tmp, chmod the final file
  0o600 defensively.
- node:sqlite migration-conflict breadth (migrations.ts). isSiblingMigrationConflict
  hard-gated on bun:sqlite error CODES; node:sqlite (Pi/Desktop) can report a
  different/absent code for the same schema_migrations PK conflict → fail-CLOSE on
  a legit concurrent-startup race (schema-fence incident class). Switched to the
  backend-identical error MESSAGE + authoritative row-existence check.

P2:
- v35 raw ALTER → ensureColumn (migrations.ts): re-check-on-failure tolerates a
  concurrent sibling adding share_categories.
- PRAGMA ordering: busy_timeout before journal_mode=WAL on the dashboard
  read-write connection (db.rs) and the OpenCode compaction-marker direct-open
  (compaction-marker.ts) — avoids immediate SQLITE_BUSY on cold-open contention.
- Dreamer optional-phase child sessions (runner.ts smart-notes, review-user-
  memories.ts, identify-key-files.ts) now retained on FAILURE (debugging), mirroring
  the main-task rule, instead of unconditional delete.
- Dashboard enqueue_dream dedup (db.rs): mirror the plugin's "skip if already
  queued" + normalize to identity, so repeated "dream now" clicks don't pile up
  duplicate rows a host drains one at a time.
- Conflict-disabled config hook early-return (index.ts): when a conflicting plugin
  disabled the runtime, stop registering /ctx-* commands + hidden agents (pure UX
  confusion — the runtime won't service them).

Gate: plugin 2175/0 (+2), Pi 471/0, dashboard rust 93+21+10+20/0, tsc+biome clean.

Author: ualtinok

packages/dashboard/src-tauri/src/db.rs

@@ -121,9 +121,12 @@ pub fn open_readonly(path: &PathBuf) -> Result<Connection, rusqlite::Error> {
 /// Opens a read-write connection for write operations (memory edits, queue entries).
 pub fn open_readwrite(path: &PathBuf) -> Result<Connection, rusqlite::Error> {
     let conn = Connection::open(path)?;
-    conn.pragma_update(None, "journal_mode", "WAL")?;
+    // busy_timeout MUST come before journal_mode=WAL: setting WAL can itself need
+    // the file lock, and with the timeout installed last a cold-open under
+    // contention fails immediately with SQLITE_BUSY instead of waiting.
     conn.pragma_update(None, "busy_timeout", 5000)?;
     conn.pragma_update(None, "foreign_keys", "ON")?;
+    conn.pragma_update(None, "journal_mode", "WAL")?;
     warn_if_dashboard_schema_requires_upgrade(&conn);
     Ok(conn)
 }
@@ -4378,10 +4381,26 @@ pub fn enqueue_dream(
     project_path: &str,
     reason: &str,
 ) -> Result<i64, rusqlite::Error> {
+    // Mirror the plugin's enqueueDream dedup: skip if this project already has ANY
+    // queue entry (queued or running). Without this, repeated dashboard "dream now"
+    // clicks pile up duplicate rows that a single identity-filtered host drains one
+    // at a time. project_path is the resolved identity (the UI passes git:/dir:),
+    // matching how hosts dequeue — a raw path would never be drained.
+    let identity = normalize_stored_project_path(project_path);
+    let existing: Option<i64> = conn
+        .query_row(
+            "SELECT id FROM dream_queue WHERE project_path = ?1 LIMIT 1",
+            rusqlite::params![identity],
+            |row| row.get(0),
+        )
+        .optional()?;
+    if let Some(id) = existing {
+        return Ok(id);
+    }
     let now = chrono::Utc::now().timestamp_millis();
     conn.execute(
         "INSERT INTO dream_queue (project_path, reason, enqueued_at) VALUES (?1, ?2, ?3)",
-        rusqlite::params![project_path, reason, now],
+        rusqlite::params![identity, reason, now],
     )?;
     Ok(conn.last_insert_rowid())
 }

packages/plugin/src/features/magic-context/compaction-marker.ts

@@ -158,9 +158,11 @@ function getWritableOpenCodeDb(): Database {
         }
     }
     const db = new Database(dbPath);
-    db.exec("PRAGMA journal_mode=WAL");
-    // Allow up to 5s wait when OpenCode holds a write lock
+    // busy_timeout BEFORE journal_mode=WAL: setting WAL can need the file lock, so
+    // with the timeout installed first a cold-open while OpenCode holds the lock
+    // waits up to 5s instead of throwing SQLITE_BUSY immediately.
     db.exec("PRAGMA busy_timeout=5000");
+    db.exec("PRAGMA journal_mode=WAL");
     cachedWriteDb = { path: dbPath, db };
     return db;
 }

packages/plugin/src/features/magic-context/dreamer/runner.ts

@@ -783,6 +783,11 @@ Only include notes whose conditions you could definitively evaluate against exte
 
     const taskStartedAt = Date.now();
     let agentSessionId: string | null = null;
+    // Retain the child session on failure so its prompt/output/error can be
+    // inspected — mirrors the main-task cleanup rule. Optional phases used to
+    // delete unconditionally, losing the evidence for exactly the runs worth
+    // debugging.
+    let phaseFailed = false;
     const startedAt = Date.now();
     let invocationRecorded = false;
     const recordInvocation = (params: {
@@ -927,6 +932,7 @@ Only include notes whose conditions you could definitively evaluate against exte
             result: `${surfaced} surfaced, ${pending} still pending`,
         });
     } catch (error) {
+        phaseFailed = true;
         const durationMs = Date.now() - taskStartedAt;
         const errorDescription = describeError(error);
         args.result.smartNotesSurfaced = 0;
@@ -943,7 +949,8 @@ Only include notes whose conditions you could definitively evaluate against exte
         });
     } finally {
         clearInterval(leaseInterval);
-        if (agentSessionId && !shouldKeepSubagents()) {
+        // Keep the child session on failure (debugging) or under keep_subagents.
+        if (agentSessionId && !phaseFailed && !shouldKeepSubagents()) {
             await args.client.session
                 .delete({
                     path: { id: agentSessionId },
@@ -999,9 +1006,16 @@ export async function processDreamQueue(args: {
     // would otherwise have its own queue row deleted mid-run. Scope to this project so the
     // cross-process shared queue doesn't reap another host's still-running rows.
     const maxRuntimeMs = args.maxRuntimeMinutes * 60 * 1000;
-    if (!hasActiveDreamLease(args.db)) {
-        clearStaleEntries(args.db, maxRuntimeMs + 30 * 60 * 1000, args.projectIdentity);
+    // A live lease means another dream (this project or a sibling on the shared
+    // queue) is actively running. Don't dequeue underneath it: runDream would just
+    // fail lease acquisition, increment this entry's retry count, and after
+    // MAX_LEASE_RETRIES DELETE the queue row — silently dropping a project's
+    // pending dream that never got a fair chance to run. Skip this tick; the entry
+    // stays queued for when the lease frees.
+    if (hasActiveDreamLease(args.db)) {
+        return null;
     }
+    clearStaleEntries(args.db, maxRuntimeMs + 30 * 60 * 1000, args.projectIdentity);
     const entry = dequeueNext(args.db, args.projectIdentity);
     if (!entry) {
         return null;

packages/plugin/src/features/magic-context/key-files/identify-key-files.ts

@@ -477,6 +477,7 @@ async function runKeyFilesLlm(args: {
     });
     const agentSessionId = typeof created?.id === "string" ? created.id : null;
     if (!agentSessionId) throw new Error("Could not create key-file identification session.");
+    let succeeded = false;
     try {
         await shared.promptSyncWithModelSuggestionRetry(
             args.client,
@@ -504,9 +505,13 @@ async function runKeyFilesLlm(args: {
         });
         const text = extractLatestAssistantText(messages);
         if (!text) throw new Error("Dreamer returned no key-files output.");
+        succeeded = true;
         return { text, messages };
     } finally {
-        if (!shouldKeepSubagents()) {
+        // Keep the child session on failure (debugging) — mirrors the main-task
+        // cleanup rule; this try/finally has no catch, so a throw leaves
+        // succeeded=false and the session is retained.
+        if (succeeded && !shouldKeepSubagents()) {
             await args.client.session
                 .delete({ path: { id: agentSessionId } })
                 .catch(() => undefined);

packages/plugin/src/features/magic-context/migrations.ts

@@ -1363,11 +1363,16 @@ const MIGRATIONS: Migration[] = [
                     share_categories TEXT NOT NULL DEFAULT '["CONSTRAINTS"]'
                 );
             `);
-            if (!columnExists(db, "workspaces", "share_categories")) {
-                db.exec(
-                    `ALTER TABLE workspaces ADD COLUMN share_categories TEXT NOT NULL DEFAULT '["CONSTRAINTS"]'`,
-                );
-            }
+            // ensureColumn (not a guarded raw ALTER): its re-check-on-failure
+            // tolerates a concurrent sibling process adding the same column between
+            // our existence check and the ALTER (duplicate-column error → re-verify
+            // → return). The raw guarded form could throw on that race.
+            ensureColumn(
+                db,
+                "workspaces",
+                "share_categories",
+                `TEXT NOT NULL DEFAULT '["CONSTRAINTS"]'`,
+            );
             db.prepare(
                 `UPDATE workspaces
                     SET share_categories = '["CONSTRAINTS"]'
@@ -1541,14 +1546,17 @@ function getCurrentVersion(db: Database): number {
  */
 export function isSiblingMigrationConflict(db: Database, error: unknown, version: number): boolean {
     if (!(error instanceof Error)) return false;
-    const code = (error as { code?: unknown }).code;
-    if (code !== "SQLITE_CONSTRAINT_PRIMARYKEY" && code !== "SQLITE_CONSTRAINT_UNIQUE") {
-        return false;
-    }
-    // Distinguish "PRIMARY KEY conflict on schema_migrations(version)"
-    // from any other UNIQUE/PK collision the migration body could surface.
-    // SQLite's better-sqlite3 binding includes the constraint in the
-    // message, e.g. "UNIQUE constraint failed: schema_migrations.version".
+    // Identify "PRIMARY KEY conflict on schema_migrations(version)" by the SQLite
+    // ERROR MESSAGE — which originates from the C library (sqlite3_errmsg) and is
+    // identical across bun:sqlite and node:sqlite, e.g.
+    // "UNIQUE constraint failed: schema_migrations.version". We deliberately do NOT
+    // hard-gate on `error.code`: bun:sqlite reports SQLITE_CONSTRAINT_PRIMARYKEY/
+    // _UNIQUE, but node:sqlite (Pi / Desktop) can report a different or absent code
+    // for the SAME conflict, and a strict code-only gate would fail-CLOSE a
+    // legitimate concurrent-startup race there (the schema-fence incident class).
+    // The message guard below already excludes a PK/UNIQUE collision the migration
+    // BODY could raise on some other table, and the row-existence check is the
+    // authoritative confirmation that a sibling actually applied this version.
     const msg = error.message;
     if (!msg.includes("schema_migrations")) return false;
     if (!msg.toLowerCase().includes("version")) return false;

packages/plugin/src/features/magic-context/user-memory/review-user-memories.ts

@@ -108,6 +108,8 @@ Return valid JSON (no markdown fencing):
 If no promotions are warranted, return empty arrays. Always consume reviewed candidates so they don't accumulate indefinitely.`;
 
     let agentSessionId: string | null = null;
+    // Keep the child session on failure (debugging), mirroring the main-task rule.
+    let phaseFailed = false;
     const startedAt = Date.now();
     let invocationRecorded = false;
     const recordInvocation = (params: {
@@ -289,6 +291,7 @@ If no promotions are warranted, return empty arrays. Always consume reviewed can
 
         return result;
     } catch (error) {
+        phaseFailed = true;
         const errorDescription = describeError(error);
         log(
             `[dreamer] user-memories: review failed: ${errorDescription.brief}`,
@@ -297,7 +300,7 @@ If no promotions are warranted, return empty arrays. Always consume reviewed can
         return result;
     } finally {
         clearInterval(leaseInterval);
-        if (agentSessionId && !shouldKeepSubagents()) {
+        if (agentSessionId && !phaseFailed && !shouldKeepSubagents()) {
             await args.client.session
                 .delete({
                     path: { id: agentSessionId },

packages/plugin/src/hooks/magic-context/system-prompt-hash.test.ts

@@ -224,6 +224,32 @@ describe("system-prompt-hash token estimation (council audit bg_51106601 #2)", (
     });
 });
 
+describe("system-prompt-hash fail-open (per-turn handler must never throw)", () => {
+    it("resolves and preserves the mutated prompt when the meta write fails", async () => {
+        useTempDataHome("sph-fail-open-");
+        const sessionId = "ses-fail-open";
+        const { handler } = buildHandler();
+        const db = openDatabase();
+
+        // Pass 1 primes session_meta (hash + tokens) cleanly.
+        await handler({ sessionID: sessionId }, { system: ["You are a helpful agent."] });
+
+        // Now sabotage the persistence layer so the hash-change branch's
+        // updateSessionMeta throws on pass 2. Dropping the table makes any write
+        // raise — simulating a busy/failing DB. The handler must NOT propagate it.
+        db.exec("DROP TABLE session_meta");
+
+        const system = ["You are a helpful agent.", "DIFFERENT content forces a hash change"];
+        // Must not throw — a throw here would fail the LLM call instead of just
+        // losing a telemetry write.
+        await handler({ sessionID: sessionId }, { system });
+
+        // The prompt was still mutated/injected (guidance present) — failing open
+        // means we keep what we did, not crash.
+        expect(system.join("\n")).toContain("## Magic Context");
+    });
+});
+
 describe("system-prompt-hash v2 system prompt contents", () => {
     it("keeps project docs, user profile, and key files out of the system prompt", async () => {
         useTempDataHome("sph-v2-adjuncts-out-");

packages/plugin/src/hooks/magic-context/system-prompt-hash.ts

@@ -417,12 +417,33 @@ export function createSystemPromptHashHandler(deps: {
 
         // Estimate system prompt tokens for dashboard visibility only when
         // the prompt hash changed; unchanged prompts keep the stored count.
+        //
+        // FAIL-OPEN (per-turn handler rule): the prompt has ALREADY been mutated
+        // in place above (guidance + sticky date). estimateTokens can throw on a
+        // pathological tokenizer input and updateSessionMeta can throw on a busy/
+        // failing DB — neither must propagate into the prompt path (a throw here
+        // would fail the LLM call instead of just losing a telemetry write). Persist
+        // the hash even if token estimation fails, so the next pass doesn't re-detect
+        // a phantom hash change and re-flush.
         if (currentHash !== previousHash) {
-            const systemPromptTokens = estimateTokens(systemContent);
-            updateSessionMeta(deps.db, sessionId, {
-                systemPromptHash: currentHash,
-                systemPromptTokens,
-            });
+            let systemPromptTokens = sessionMeta.systemPromptTokens;
+            try {
+                systemPromptTokens = estimateTokens(systemContent);
+            } catch (error) {
+                sessionLog(
+                    sessionId,
+                    "system prompt token estimate failed (using prior count):",
+                    error,
+                );
+            }
+            try {
+                updateSessionMeta(deps.db, sessionId, {
+                    systemPromptHash: currentHash,
+                    systemPromptTokens,
+                });
+            } catch (error) {
+                sessionLog(sessionId, "system prompt meta persist failed (fail-open):", error);
+            }
         }
 
         // ── Step 4: Drain systemPromptRefreshSessions (one-shot semantics) ──

packages/plugin/src/index.ts

@@ -466,6 +466,14 @@ const plugin: Plugin = async (ctx) => {
             await hooks.magicContext?.["experimental.text.complete"]?.(input, output);
         },
         config: async (config) => {
+            // If the runtime is disabled (a conflicting plugin — DCP / OMO /
+            // OpenCode auto-compaction — was detected and we fail-safed at boot),
+            // do NOT register the /ctx-* commands or hidden agents. The transform/
+            // tools/RPC are already no-op'd, so surfacing command entries + hidden
+            // agents the runtime won't service is pure UX confusion.
+            if (pluginConfig.enabled !== true) {
+                return;
+            }
             /**
              * Build a hidden-agent config with a deny-everything-by-default
              * permission baseline plus an explicit allow-list of tool ids the

packages/plugin/src/shared/rpc-server.ts

@@ -1,9 +1,11 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import {
+    chmodSync,
     mkdirSync,
     readdirSync,
     readFileSync,
     renameSync,
+    rmSync,
     unlinkSync,
     writeFileSync,
 } from "node:fs";
@@ -85,7 +87,22 @@ export class MagicContextRpcServer {
                     // file 0o600. renameSync preserves the tmp file's mode, so
                     // the 0o600 on the write covers the final file.
                     mkdirSync(dir, { recursive: true, mode: 0o700 });
+                    // mkdirSync's mode only applies on CREATION — a dir left by an
+                    // older build (or default 0o755 umask) keeps its loose perms, so
+                    // chmod it defensively so the bearer token isn't world-readable.
+                    try {
+                        chmodSync(dir, 0o700);
+                    } catch {
+                        // best-effort
+                    }
                     const tmpPath = `${this.portFilePath}.tmp`;
+                    // A stale tmp from a crashed write could exist with loose perms;
+                    // writeFileSync's mode only applies on create, so remove it first.
+                    try {
+                        rmSync(tmpPath, { force: true });
+                    } catch {
+                        // best-effort
+                    }
                     writeFileSync(
                         tmpPath,
                         JSON.stringify({
@@ -97,6 +114,13 @@ export class MagicContextRpcServer {
                         { encoding: "utf-8", mode: 0o600 },
                     );
                     renameSync(tmpPath, this.portFilePath);
+                    // renameSync preserves the tmp's mode, but chmod the final path
+                    // defensively in case the token file pre-existed with loose perms.
+                    try {
+                        chmodSync(this.portFilePath, 0o600);
+                    } catch {
+                        // best-effort
+                    }
                     log(`[rpc] server listening on 127.0.0.1:${this.port}`);
                 } catch (err) {
                     log(`[rpc] failed to write port file: ${err}`);