The Club adoption inventory still includes a global application-state database selector beyond project SQLite previews. A direct port of the generic table browser would expose prompts, messages and credential-bearing payloads, so I propose a separate bounded operational preview.
The incremental draft would use only Cafe's configured state.sqlite path, with no project/cwd/path input, and an explicit table/column/value allowlist for counters and timestamps. It would exclude auth/session/daemon payloads, events, messages, plans, raw JSON and workspace paths. Every RPC would require the owner role, observed loopback transport and a fresh active-session check before and after reading. A separate fixed read-only child would retain hard time/output limits and keep native SQLite work out of the server event loop; normal WAL/SHM reader effects would be documented. The UI would make its global scope explicit and perform no reads automatically.
This is an operational preview, not full raw-state parity or a forensic dump. Project file/copy limits and existing previews remain separate. Validation will use generated SQLite state and synthetic authenticated/browser fixtures only, with independent review, required full gates and inspected UI media. The implementation will be offered as a focused fork draft indexed from #69, without assuming upstream acceptance.
日本語：プロジェクトの SQLite 表示とは別に、アプリ全体の状態から許可した運用カウンターと時刻だけを明示的に読みます。プロンプト・認証情報・メッセージ・生の JSON・作業パスは公開しません。所有者権限、観測したループバック接続、有効なセッションを読み取り前後に確認します。これは状態全体の生データ表示やフォレンジック取得ではありません。合成データのみで検査し、独立レビューと画面資料を付けた差分案を用意します。
The Club adoption inventory still includes a global application-state database selector beyond project SQLite previews. A direct port of the generic table browser would expose prompts, messages and credential-bearing payloads, so I propose a separate bounded operational preview.
The incremental draft would use only Cafe's configured state.sqlite path, with no project/cwd/path input, and an explicit table/column/value allowlist for counters and timestamps. It would exclude auth/session/daemon payloads, events, messages, plans, raw JSON and workspace paths. Every RPC would require the owner role, observed loopback transport and a fresh active-session check before and after reading. A separate fixed read-only child would retain hard time/output limits and keep native SQLite work out of the server event loop; normal WAL/SHM reader effects would be documented. The UI would make its global scope explicit and perform no reads automatically.
This is an operational preview, not full raw-state parity or a forensic dump. Project file/copy limits and existing previews remain separate. Validation will use generated SQLite state and synthetic authenticated/browser fixtures only, with independent review, required full gates and inspected UI media. The implementation will be offered as a focused fork draft indexed from #69, without assuming upstream acceptance.
日本語：プロジェクトの SQLite 表示とは別に、アプリ全体の状態から許可した運用カウンターと時刻だけを明示的に読みます。プロンプト・認証情報・メッセージ・生の JSON・作業パスは公開しません。所有者権限、観測したループバック接続、有効なセッションを読み取り前後に確認します。これは状態全体の生データ表示やフォレンジック取得ではありません。合成データのみで検査し、独立レビューと画面資料を付けた差分案を用意します。