refactor(miner): centralize database initialization with openLocalStoreDb (#8319)

This update refactors the database initialization across multiple modules to utilize the new openLocalStoreDb function. This change centralizes the creation of directories, file permissions, and busy timeout settings, enhancing code maintainability and ensuring crash-safe cleanup registration. The affected files include deny-hook-synthesis.ts, laptop-init.ts, and orb-export.ts, with corresponding tests updated to verify the new behavior.

Closes #8319

Author: milosde111

packages/loopover-miner/lib/deny-hook-synthesis.ts

@@ -3,10 +3,9 @@
 // this module is now a thin wrapper that re-exports those pure helpers and keeps the local SQLite store for
 // refresh + maintainer review before any synthesized rule takes effect. Approved rules merge with
 // {@link DEFAULT_DENY_RULES}; unapproved proposals never block tool calls. No behavior change.
-import { chmodSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { join } from "node:path";
+import type { DatabaseSync } from "node:sqlite";
 import {
   aggregateBlockerHistory,
   canonicalizeChangedPath,
@@ -25,6 +24,7 @@ import type { DenyRuleProposal, SynthesisConfig } from "@loopover/engine";
 import { DEFAULT_FORGE_CONFIG } from "./forge-config.js";
 import type { DenyRule } from "./deny-hooks.js";
 import { DENY_HOOK_SYNTHESIS_PURGE_SPEC, purgeStoreByRepo } from "./store-maintenance.js";
+import { openLocalStoreDb } from "./local-store.js";
 
 // Re-export the pure synthesis helpers from the engine so this module's public API is unchanged after #5667
 // moved derivation/audit into @loopover/engine. Only the SQLite store below (and its forge/db-path helpers) is
@@ -162,10 +162,9 @@ function ensureDenyRuleProposalsForgeScope(db: DatabaseSync): void {
  */
 export function initDenyHookSynthesisStore(dbPath: string = resolveDenyHookSynthesisDbPath()): DenyHookSynthesisStore {
   const resolvedPath = normalizeDbPath(dbPath);
-  mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
-  const db = new DatabaseSync(resolvedPath);
-  chmodSync(resolvedPath, 0o600);
-  db.exec("PRAGMA busy_timeout = 5000");
+  // openLocalStoreDb centralizes the mkdir(0o700)/chmod(0o600)/busy_timeout + crash-safe cleanup registration and
+  // treats ':memory:' as a no-file special case, so this store no longer hand-rolls that boilerplate (#8319).
+  const db = openLocalStoreDb(resolvedPath);
   db.exec(`
     CREATE TABLE IF NOT EXISTS deny_rule_proposals (
       repo_full_name TEXT NOT NULL,

packages/loopover-miner/lib/laptop-init.ts

@@ -1,10 +1,11 @@
-import { accessSync, chmodSync, constants, existsSync, mkdirSync } from "node:fs";
+import { accessSync, constants, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { applySchemaMigrations } from "./schema-version.js";
 import { reportCliFailure } from "./cli-error.js";
 import { resolveGitHubToken } from "./github-token-resolution.js";
+import { openLocalStoreDb } from "./local-store.js";
 
 const githubApiBaseUrl = "https://api.github.com";
 const githubApiVersion = "2022-11-28";
@@ -52,9 +53,11 @@ export function resolveLaptopStateDbPath(env: Record<string, string | undefined>
 export function initLaptopState(env: Record<string, string | undefined> = process.env): LaptopInitResult {
   const stateDir = resolveMinerStateDir(env);
   const dbPath = resolveLaptopStateDbPath(env);
-  mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  // Sample before openLocalStoreDb: the helper creates the parent dir + file, so `created` must be read first.
   const created = !existsSync(dbPath);
-  const db = new DatabaseSync(dbPath);
+  // openLocalStoreDb centralizes the mkdir(0o700)/chmod(0o600)/busy_timeout + crash-safe cleanup registration
+  // (#8319) -- this was previously the one store with no busy-timeout and no crash-safety registration at all.
+  const db = openLocalStoreDb(dbPath);
   db.exec(`
     CREATE TABLE IF NOT EXISTS laptop_meta (
       key TEXT PRIMARY KEY,
@@ -67,7 +70,6 @@ export function initLaptopState(env: Record<string, string | undefined> = proces
     db.prepare("INSERT INTO laptop_meta (key, value) VALUES ('initialized_at', ?)")
       .run(new Date().toISOString());
   }
-  chmodSync(dbPath, 0o600);
   db.close();
   return { stateDir, dbPath, created };
 }

packages/loopover-miner/lib/orb-export.ts

@@ -1,13 +1,12 @@
-import { chmodSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { join } from "node:path";
 import { createHash, createHmac } from "node:crypto";
 import { generateAnonSecret, hmacAnonymize as engineHmacAnonymize } from "@loopover/engine";
 import { readPrOutcomes } from "./pr-outcome.js";
 import type { NormalizedPrOutcomePayload, PrOutcomeLedgerReader } from "./pr-outcome.js";
 import { initEventLedger } from "./event-ledger.js";
 import { argsWantJson, describeCliError, reportCliFailure } from "./cli-error.js";
+import { openLocalStoreDb } from "./local-store.js";
 
 // Optional anonymized Orb telemetry export (#4277, network send wired in #5681). The self-host Orb collector
 // (src/selfhost/orb-collector.ts, #1255) is ALWAYS-ON for a maintainer's own instance; a miner runs on a
@@ -125,10 +124,9 @@ export function buildAnonymizedOrbBatch(
  */
 export function openOrbExportStore(dbPath: string = resolveOrbExportDbPath()): OrbExportStore {
   const resolvedPath = normalizeDbPath(dbPath);
-  mkdirSync(dirname(resolvedPath), { recursive: true, mode: 0o700 });
-  const db = new DatabaseSync(resolvedPath);
-  chmodSync(resolvedPath, 0o600);
-  db.exec("PRAGMA busy_timeout = 5000");
+  // openLocalStoreDb centralizes the mkdir(0o700)/chmod(0o600)/busy_timeout + crash-safe cleanup registration and
+  // treats ':memory:' as a no-file special case, so this store no longer hand-rolls that boilerplate (#8319).
+  const db = openLocalStoreDb(resolvedPath);
   db.exec(`CREATE TABLE IF NOT EXISTS orb_export_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);
 
   const getStatement = db.prepare("SELECT value FROM orb_export_meta WHERE key = ?");

test/unit/miner-deny-hook-synthesis.test.ts

@@ -7,7 +7,17 @@ import {
   DEFAULT_DENY_RULES,
   evaluateDenyHooks,
 } from "../../packages/loopover-miner/lib/deny-hooks.js";
-import {
+import type { DenyRuleProposal } from "../../packages/loopover-engine/src/miner/deny-hook-synthesis";
+// #7525: normalizeRepoFullName is defined in the engine and re-exported unchanged by the miner-lib module
+// above; import it from the engine source directly so the guard's src branches are the ones exercised.
+import { normalizeRepoFullName } from "../../packages/loopover-engine/src/miner/deny-hook-synthesis";
+import { cleanupResourceCount, resetProcessLifecycleForTesting } from "../../packages/loopover-miner/lib/process-lifecycle.js";
+
+// Import the .ts SOURCE (not the build-time .js) via a non-literal specifier. Once `build:miner` has produced
+// the artifact, a plain `.js` import loads that .js and leaves coverage.include's `.ts` entry at 0% — the
+// .js-vs-.ts mismatch that closed #8500/#8516 on codecov/patch. Same pattern as miner-replay-snapshot.test.ts (#7796).
+const DENY_HOOK_SYNTHESIS_MODULE = "../../packages/loopover-miner/lib/deny-hook-synthesis.ts";
+const {
   aggregateBlockerHistory,
   changedPathToDenyGlob,
   initDenyHookSynthesisStore,
@@ -16,11 +26,7 @@ import {
   resolveEffectiveDenyRules,
   setProposalStatuses,
   synthesizeDenyRuleProposals,
-} from "../../packages/loopover-miner/lib/deny-hook-synthesis.js";
-import type { DenyRuleProposal } from "../../packages/loopover-engine/src/miner/deny-hook-synthesis";
-// #7525: normalizeRepoFullName is defined in the engine and re-exported unchanged by the miner-lib module
-// above; import it from the engine source directly so the guard's src branches are the ones exercised.
-import { normalizeRepoFullName } from "../../packages/loopover-engine/src/miner/deny-hook-synthesis";
+} = (await import(DENY_HOOK_SYNTHESIS_MODULE)) as typeof import("../../packages/loopover-miner/lib/deny-hook-synthesis.js");
 
 const tempDirs: string[] = [];
 const stores: Array<{ close(): void }> = [];
@@ -163,6 +169,16 @@ describe("initDenyHookSynthesisStore() (#4522)", () => {
     expect(() => initDenyHookSynthesisStore("   ")).toThrow("invalid_deny_hook_synthesis_db_path");
   });
 
+  it("registers the store for crash-safe cleanup via openLocalStoreDb, and unregisters it on close (#8319)", () => {
+    resetProcessLifecycleForTesting();
+    expect(cleanupResourceCount()).toBe(0);
+    const store = tempStore();
+    expect(cleanupResourceCount()).toBe(1);
+    stores.splice(stores.indexOf(store), 1);
+    store.close();
+    expect(cleanupResourceCount()).toBe(0);
+  });
+
   it("skips the forge-scope migration on a second open of an already-migrated file", () => {
     const dir = mkdtempSync(join(tmpdir(), "miner-deny-hook-synthesis-remigrate-"));
     tempDirs.push(dir);

test/unit/miner-laptop-init.test.ts

@@ -29,13 +29,19 @@ vi.mock("node:sqlite", async (importOriginal) => {
   }
   return { ...actual, DatabaseSync: RecordingDatabaseSync };
 });
-import {
+import { cleanupResourceCount, resetProcessLifecycleForTesting } from "../../packages/loopover-miner/lib/process-lifecycle.js";
+
+// Import the .ts SOURCE (not the build-time .js) via a non-literal specifier. Once `build:miner` has produced
+// the artifact, a plain `.js` import loads that .js and leaves coverage.include's `.ts` entry at 0% — the
+// .js-vs-.ts mismatch that closed #8500/#8516 on codecov/patch. Same pattern as miner-replay-snapshot.test.ts (#7796).
+const LAPTOP_INIT_MODULE = "../../packages/loopover-miner/lib/laptop-init.ts";
+const {
   checkDockerPresent,
   checkLaptopStateSqlite,
   initLaptopState,
   resolveLaptopStateDbPath,
   runInit,
-} from "../../packages/loopover-miner/lib/laptop-init.js";
+} = (await import(LAPTOP_INIT_MODULE)) as typeof import("../../packages/loopover-miner/lib/laptop-init.js");
 
 const roots: string[] = [];
 
@@ -83,6 +89,16 @@ describe("loopover-miner laptop init (#2329)", () => {
     expect(readFileSync(join(first.stateDir, "marker.txt"), "utf8")).toBe("keep-me");
   });
 
+  it("opens its store via openLocalStoreDb, registering and unregistering it for crash-safe cleanup within the call (#8319)", () => {
+    resetProcessLifecycleForTesting();
+    expect(cleanupResourceCount()).toBe(0);
+    const root = tempRoot();
+    initLaptopState({ LOOPOVER_MINER_CONFIG_DIR: join(root, "state") });
+    // initLaptopState closes its own handle internally before returning (it exposes no db handle), so a
+    // leftover registration here would mean the register→unregister cycle didn't complete cleanly.
+    expect(cleanupResourceCount()).toBe(0);
+  });
+
   it("runInit prints human text (0) and machine JSON with --json", async () => {
     const root = tempRoot();
     const env = { LOOPOVER_MINER_CONFIG_DIR: join(root, "state") };

test/unit/miner-orb-export.test.ts

@@ -2,8 +2,14 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { OrbExportOutcome, OrbExportRow } from "../../packages/loopover-miner/lib/orb-export.js";
+import { cleanupResourceCount, resetProcessLifecycleForTesting } from "../../packages/loopover-miner/lib/process-lifecycle.js";
 
-import {
+// Import the .ts SOURCE (not the build-time .js) via a non-literal specifier. Once `build:miner` has produced
+// the artifact, a plain `.js` import loads that .js and leaves coverage.include's `.ts` entry at 0% — the
+// .js-vs-.ts mismatch that closed #8500/#8516 on codecov/patch. Same pattern as miner-replay-snapshot.test.ts (#7796).
+const ORB_EXPORT_MODULE = "../../packages/loopover-miner/lib/orb-export.ts";
+const {
   ORB_EXPORT_ENABLED_BY_DEFAULT,
   DEFAULT_AMS_COLLECTOR_URL,
   DEFAULT_ORB_EXPORT_TIMEOUT_MS,
@@ -17,8 +23,7 @@ import {
   resolveAmsCollectorUrl,
   resolveOrbExportDbPath,
   sendAmsExportBatch,
-} from "../../packages/loopover-miner/lib/orb-export.js";
-import type { OrbExportOutcome, OrbExportRow } from "../../packages/loopover-miner/lib/orb-export.js";
+} = (await import(ORB_EXPORT_MODULE)) as typeof import("../../packages/loopover-miner/lib/orb-export.js");
 
 let dir: string;
 function storePath() {
@@ -68,6 +73,15 @@ describe("orb-export store (#4277)", () => {
     expect(store.getCursor()).toBe("2026-01-02T00:00:00Z");
     store.close();
   });
+
+  it("registers the store for crash-safe cleanup via openLocalStoreDb, and unregisters it on close (#8319)", () => {
+    resetProcessLifecycleForTesting();
+    expect(cleanupResourceCount()).toBe(0);
+    const store = openOrbExportStore(storePath());
+    expect(cleanupResourceCount()).toBe(1);
+    store.close();
+    expect(cleanupResourceCount()).toBe(0);
+  });
 });
 
 describe("hmacAnonymize", () => {