@axiom-lattice/gateway 4.0.2 → 4.1.0

package/dist/index.mjs

@@ -69,8 +69,8 @@ function resolveLocalA2AWorkingDirectory(options) {
 }
 function validateWorkingDirectory(cwd) {
   try {
-    const stat = statSync(cwd);
-    if (!stat.isDirectory()) {
+    const stat2 = statSync(cwd);
+    if (!stat2.isDirectory()) {
       return `Working directory is not a directory: ${cwd}`;
     }
     return null;
@@ -846,8 +846,8 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
   let closed = raw.destroyed || raw.writableEnded;
   let returned = false;
   let resolveClosed;
-  const closedPromise = new Promise((resolve2) => {
-    resolveClosed = resolve2;
+  const closedPromise = new Promise((resolve3) => {
+    resolveClosed = resolve3;
   });
   const returnConsumer = () => {
     if (returned) return;
@@ -897,14 +897,14 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
 async function writeSse(raw, value, closed) {
   if (raw.destroyed || raw.writableEnded) return false;
   if (raw.write(value)) return true;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let settled = false;
     const onDrain = () => finish(!raw.destroyed && !raw.writableEnded);
     const finish = (writable) => {
       if (settled) return;
       settled = true;
       raw.removeListener("drain", onDrain);
-      resolve2(writable);
+      resolve3(writable);
     };
     raw.once("drain", onDrain);
     void closed.then(() => finish(false));
@@ -3712,7 +3712,7 @@ var ExportImportService = class {
     const files = /* @__PURE__ */ new Map();
     let bundle;
     const gunzip = zlib.createGunzip();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       let settled = false;
       let entryCount = 0;
       let declaredTotalBytes = 0;
@@ -3832,7 +3832,7 @@ var ExportImportService = class {
       parser.on("end", () => {
         if (settled) return;
         settled = true;
-        resolve2();
+        resolve3();
       });
       gunzip.pipe(parser);
       gunzip.end(buffer);
@@ -4517,6 +4517,20 @@ var dataQuerySchema = {
 };
 
 // src/schemas/index.ts
+var downloadFolderSchema = {
+  description: "Download a workspace project folder as a ZIP archive",
+  tags: ["Workspace"],
+  querystring: {
+    type: "object",
+    properties: {
+      path: { type: "string", minLength: 1 },
+      assistantId: { type: "string", minLength: 1 },
+      tenantId: { type: "string", minLength: 1 }
+    },
+    required: ["path"],
+    additionalProperties: false
+  }
+};
 var getAllMemoryItemsSchema = {
   description: "Get all memory items for an assistant thread",
   tags: ["Memory"],
@@ -5114,11 +5128,89 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 import * as fs2 from "fs/promises";
 import * as path2 from "path";
+import { constants as fsConstants } from "fs";
 import * as os2 from "os";
 import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
+var MAX_ZIP_ENTRIES = 1e4;
+var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
+var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
+var FolderDownloadError = class extends Error {
+  constructor(statusCode, code, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "FolderDownloadError";
+  }
+};
+function zipCrc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = crc >>> 1 ^ 3988292384 & -(crc & 1);
+    }
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function createZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, "utf8");
+    const data = entry.data;
+    const crc = zipCrc32(data);
+    const local = Buffer.alloc(30 + name.length + data.length);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(2048, 8);
+    local.writeUInt16LE(0, 10);
+    local.writeUInt16LE(0, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(data.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+    name.copy(local, 30);
+    data.copy(local, 30 + name.length);
+    localParts.push(local);
+    const central = Buffer.alloc(46 + name.length);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(2048, 10);
+    central.writeUInt16LE(0, 12);
+    central.writeUInt16LE(0, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(data.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(entry.directory ? 16 : 0, 36);
+    central.writeUInt32LE(entry.directory ? 16 : 0, 38);
+    central.writeUInt32LE(offset, 42);
+    name.copy(central, 46);
+    centralParts.push(central);
+    offset += local.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = getStoreLattice6("default", "workspace").store;
@@ -5384,6 +5476,259 @@ var WorkspaceController = class {
       return reply.status(502).send({ success: false, error: `Download proxy error: ${message}` });
     }
   }
+  async downloadFolder(request, reply) {
+    const tenantId = this.getTenantId(request);
+    const { workspaceId, projectId } = request.params;
+    const folderPath = request.query.path;
+    const assistantId = request.query.assistantId;
+    if (!folderPath || folderPath.includes("\\") || folderPath.split("/").includes("..")) {
+      return reply.status(400).send({
+        success: false,
+        error: "Invalid folder path",
+        code: "INVALID_PATH"
+      });
+    }
+    try {
+      const storedWorkspace = await this.workspaceStore.getWorkspaceById(tenantId, workspaceId);
+      if (!storedWorkspace) {
+        throw new FolderDownloadError(404, "WORKSPACE_NOT_FOUND", "Workspace not found");
+      }
+      const project = await this.projectStore.getProjectById(tenantId, projectId);
+      if (!project || project.workspaceId !== workspaceId) {
+        throw new FolderDownloadError(404, "PROJECT_NOT_FOUND", "Project not found");
+      }
+      const { backend, workspace } = await this.getBackend(
+        tenantId,
+        workspaceId,
+        projectId,
+        assistantId,
+        folderPath
+      );
+      if (!backend.lsInfo || workspace.storageType === "sandbox" && !backend.readBinary) {
+        throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not support folder downloads");
+      }
+      let listEntries2;
+      if (workspace.storageType !== "sandbox") {
+        const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+        const target = path2.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        const contained = await resolvePathWithinRoot(root, target).catch((error) => {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        });
+        let stat2;
+        try {
+          stat2 = await fs2.stat(contained.targetPath);
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        if (!stat2.isDirectory()) {
+          throw new FolderDownloadError(400, "NOT_A_FOLDER", "Path is not a folder");
+        }
+      } else if (folderPath) {
+        const sandboxManager = getSandBoxManager3();
+        const volumeConfig = {
+          assistant_id: assistantId || "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        };
+        const volume = await sandboxManager.getVolumeBackendForPath(volumeConfig, folderPath);
+        if (!volume) {
+          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
+          try {
+            await sandbox.file.listPath(folderPath, { recursive: false });
+          } catch (error) {
+            const code = error instanceof Error ? error.code : void 0;
+            const message = error instanceof Error ? error.message : String(error);
+            if (code === "ENOENT" || /not found|no such file|enoent/i.test(message)) {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          listEntries2 = async (directoryPath) => {
+            const result = await sandbox.file.listPath(directoryPath, { recursive: false });
+            return result.files;
+          };
+        } else {
+          listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+        }
+      }
+      if (!listEntries2) {
+        listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+      }
+      const folderName = path2.basename(folderPath.replace(/\/$/, "")) || "folder";
+      const prefix = `${folderName}/`;
+      const entries = [{ name: prefix, data: Buffer.alloc(0), directory: true }];
+      let totalSize = 0;
+      const filesystemRoot = workspace.storageType === "sandbox" ? void 0 : filesystemRootDirectory(tenantId, workspaceId, projectId);
+      const addFile = (archivePath, data) => {
+        if (data.length > MAX_ZIP_FILE_SIZE || totalSize + data.length > MAX_ZIP_TOTAL_SIZE) {
+          throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+        }
+        totalSize += data.length;
+        entries.push({ name: archivePath, data, directory: false });
+      };
+      const collectFilesystem = async (directoryPath, archivePath) => {
+        let children;
+        try {
+          children = await fs2.readdir(directoryPath, { withFileTypes: true });
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = path2.join(directoryPath, child.name);
+          const archiveChildPath = `${archivePath}${child.name}`;
+          let resolvedChild;
+          try {
+            resolvedChild = await resolvePathWithinRoot(filesystemRoot, childPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+          }
+          let childStat;
+          try {
+            childStat = await fs2.lstat(resolvedChild.targetPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          if (childStat.isSymbolicLink() || child.isSymbolicLink()) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+          }
+          if (child.isDirectory()) {
+            entries.push({ name: `${archiveChildPath}/`, data: Buffer.alloc(0), directory: true });
+            await collectFilesystem(resolvedChild.targetPath, `${archiveChildPath}/`);
+          } else if (child.isFile()) {
+            if (childStat.size > MAX_ZIP_FILE_SIZE || totalSize + childStat.size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const flags = fsConstants.O_NOFOLLOW === void 0 ? fsConstants.O_RDONLY : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
+            let handle3;
+            try {
+              handle3 = await fs2.open(resolvedChild.targetPath, flags);
+            } catch (error) {
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw error;
+            }
+            try {
+              const openedStat = await handle3.stat();
+              if (!openedStat.isFile() || openedStat.size > MAX_ZIP_FILE_SIZE || totalSize + openedStat.size > MAX_ZIP_TOTAL_SIZE) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              const readLimit = MAX_ZIP_FILE_SIZE + 1;
+              const dataBuffer = Buffer.alloc(Math.min(openedStat.size + 1, readLimit));
+              let bytesRead = 0;
+              while (bytesRead < dataBuffer.length) {
+                const result = await handle3.read(
+                  dataBuffer,
+                  bytesRead,
+                  dataBuffer.length - bytesRead,
+                  bytesRead
+                );
+                if (result.bytesRead === 0) break;
+                bytesRead += result.bytesRead;
+              }
+              const data = dataBuffer.subarray(0, bytesRead);
+              const finalStat = await handle3.stat();
+              if (finalStat.size > MAX_ZIP_FILE_SIZE || totalSize + finalStat.size > MAX_ZIP_TOTAL_SIZE || finalStat.size > data.length) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              addFile(archiveChildPath, data);
+            } finally {
+              await handle3.close();
+            }
+          }
+        }
+      };
+      const collect = async (currentPath, archivePath) => {
+        let children;
+        try {
+          children = await listEntries2(currentPath);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          if (/not found|enoent|no such file/i.test(message)) {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = child.path;
+          if (childPath.includes("\\") || childPath.split("/").includes("..") || !childPath.startsWith(folderPath.endsWith("/") ? folderPath : `${folderPath}/`)) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains an unsafe child path");
+          }
+          if (workspace.storageType !== "sandbox") {
+            const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+            const virtualChildPath = childPath.startsWith("/") ? childPath : `/${childPath}`;
+            const target = path2.resolve(root, `.${virtualChildPath}`);
+            try {
+              await resolvePathWithinRoot(root, target);
+              const childStat = await fs2.lstat(target);
+              if (childStat.isSymbolicLink()) {
+                throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+              }
+            } catch (error) {
+              if (error instanceof FolderDownloadError) throw error;
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+            }
+          }
+          const childName = path2.basename(childPath.replace(/\/$/, ""));
+          const childArchivePath = `${archivePath}${childName}`;
+          if (child.is_dir) {
+            entries.push({ name: `${childArchivePath}/`, data: Buffer.alloc(0), directory: true });
+            await collect(childPath, `${childArchivePath}/`);
+          } else {
+            const size = child.size ?? 0;
+            if (size > MAX_ZIP_FILE_SIZE || totalSize + size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const data = await backend.readBinary(childPath);
+            addFile(childArchivePath, data);
+          }
+        }
+      };
+      if (workspace.storageType === "sandbox") {
+        await collect(folderPath, prefix);
+      } else {
+        const root = filesystemRoot;
+        const target = path2.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        await collectFilesystem(target, prefix);
+      }
+      const zip = createZip(entries);
+      const downloadName = `${folderName}.zip`;
+      return reply.status(200).type("application/zip").header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(downloadName)}`).send(zip);
+    } catch (error) {
+      const folderError = error instanceof FolderDownloadError ? error : error instanceof PathOutsideRootError || error instanceof Error && ["ELOOP", "ENOTDIR", "EACCES"].includes(error.code || "") ? new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project") : new FolderDownloadError(502, "DOWNLOAD_FAILED", error instanceof Error ? error.message : String(error));
+      return reply.status(folderError.statusCode).send({
+        success: false,
+        error: folderError.message,
+        code: folderError.code
+      });
+    }
+  }
   /**
    * View a file inline in the browser (not download).
    * Returns file content with inline Content-Disposition for preview.
@@ -5676,6 +6021,11 @@ function registerWorkspaceRoutes(app2) {
     "/api/workspaces/:workspaceId/projects/:projectId/downloadfile",
     controller.downloadFile.bind(controller)
   );
+  app2.get(
+    "/api/workspaces/:workspaceId/projects/:projectId/downloadfolder",
+    { schema: downloadFolderSchema },
+    controller.downloadFolder.bind(controller)
+  );
   app2.get(
     "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
     controller.viewFile.bind(controller)
@@ -5903,7 +6253,7 @@ async function testDatabaseConnection(request, reply) {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
-      await new Promise((resolve2) => setTimeout(resolve2, 100));
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
       await db.disconnect();
       await sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
@@ -6725,6 +7075,7 @@ import {
   LatticeEvalProject
 } from "@axiom-lattice/core";
 import { v4 as uuidv43 } from "uuid";
+var TERMINAL_PERSIST_ATTEMPTS = 2;
 function mapLogs(logs) {
   return logs.map((l) => ({
     timestamp: l.ts,
@@ -6736,18 +7087,42 @@ function mapLogs(logs) {
 var EvalRunner = class {
   constructor() {
     this.runs = /* @__PURE__ */ new Map();
+    this.projectLeases = /* @__PURE__ */ new Map();
     this.eventEmitter = new EventEmitter();
     this.processStartedAt = /* @__PURE__ */ new Date();
   }
   getEventEmitter() {
     return this.eventEmitter;
   }
+  reserveProjectDeletion(tenantId, projectId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey) || [...this.runs.values()].some(
+      (ctx) => ctx.tenantId === tenantId && ctx.projectId === projectId && !ctx.terminal.workerSettled
+    )) return null;
+    const leaseToken = Symbol(`delete:${leaseKey}`);
+    this.projectLeases.set(leaseKey, leaseToken);
+    return () => this.releaseProjectLease(leaseKey, leaseToken);
+  }
   async startRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey)) {
+      throw new Error("A run is already in progress for this project");
+    }
+    const leaseToken = Symbol(leaseKey);
+    this.projectLeases.set(leaseKey, leaseToken);
+    try {
+      return await this.startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken);
+    } catch (error) {
+      this.releaseProjectLease(leaseKey, leaseToken);
+      throw error;
+    }
+  }
+  async startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken) {
     const store = this.getEvalStore();
     const project = await store.getProjectById(tenantId, projectId);
     if (!project) throw new Error("Project not found");
     for (const ctx of this.runs.values()) {
-      if (ctx.projectId === projectId) {
+      if (ctx.projectId === projectId && !ctx.terminal.persisted) {
         throw new Error("A run is already in progress for this project");
       }
     }
@@ -6851,14 +7226,35 @@ var EvalRunner = class {
     };
     const abortController = new AbortController();
     const stats = { passed: 0, failed: 0, interrupted: 0, totalScore: 0 };
+    const terminal = { claiming: false, persisted: false, workerSettled: false };
+    const terminalUnavailable = () => terminal.claiming || terminal.persisted;
+    const persistTerminal = async (update, event) => {
+      if (terminalUnavailable()) return false;
+      terminal.claiming = true;
+      try {
+        let lastError;
+        for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+          try {
+            const persistedRun = await store.updateRunStatus(tenantId, runId, update);
+            if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+            lastError = void 0;
+            break;
+          } catch (error) {
+            lastError = error;
+          }
+        }
+        if (lastError) throw lastError;
+        terminal.persisted = true;
+        this.eventEmitter.emit(`run:${runId}`, event);
+        return true;
+      } finally {
+        terminal.claiming = false;
+      }
+    };
     const onCaseComplete = async (result, suiteName) => {
+      if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      if (passed) stats.passed++;
-      else stats.failed++;
-      stats.totalScore += score;
-      if (result.interrupted) stats.interrupted++;
-      const completedCount = stats.passed + stats.failed;
       await store.createRunResult(tenantId, runId, uuidv43(), {
         suiteName,
         caseId: result.caseId,
@@ -6876,13 +7272,22 @@ var EvalRunner = class {
         error: result.error,
         interrupted: result.interrupted
       });
+      if (terminalUnavailable()) return;
+      if (passed) stats.passed++;
+      else stats.failed++;
+      stats.totalScore += score;
+      if (result.interrupted) stats.interrupted++;
+      const completedCount = stats.passed + stats.failed;
+      if (terminalUnavailable()) return;
       const avgScore = completedCount > 0 ? stats.totalScore / completedCount : 0;
-      await store.updateRunStatus(tenantId, runId, {
+      const persistedRun = await store.updateRunStatus(tenantId, runId, {
         passedCases: stats.passed,
         failedCases: stats.failed,
         interruptedCases: stats.interrupted,
         avgScore
       });
+      if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+      if (terminalUnavailable()) return;
       this.eventEmitter.emit(`run:${runId}`, {
         type: "progress",
         runId,
@@ -6894,65 +7299,86 @@ var EvalRunner = class {
         const evalProject = new LatticeEvalProject(projectConfig, onCaseComplete);
         const calibration = await evalProject.calibrateJudge();
         if (!calibration.ok && !calibration.bypassed) {
-          await store.updateRunStatus(tenantId, runId, {
-            status: "failed",
-            error: `Judge calibration failed: ${calibration.reason}`,
-            completedAt: /* @__PURE__ */ new Date()
-          });
           throw new Error(`Judge calibration failed: ${calibration.reason}`);
         }
         if (calibration.bypassed) {
           console.warn(`[eval-runner] Judge calibration bypassed \u2014 judge may be unreliable: ${calibration.reason}`);
         }
         const { report } = await evalProject.runAllSuitesBatch(concurrency, abortController.signal);
-        if (!abortController.signal.aborted) {
-          const completedCount = stats.passed + stats.failed;
-          await store.updateRunStatus(tenantId, runId, {
-            status: "completed",
-            completedAt: /* @__PURE__ */ new Date(),
-            passedCases: stats.passed,
-            failedCases: stats.failed,
-            interruptedCases: stats.interrupted,
-            avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
-            type: "completed",
-            runId,
-            data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
-          });
-        }
+        const completedCount = stats.passed + stats.failed;
+        await persistTerminal({
+          status: "completed",
+          completedAt: /* @__PURE__ */ new Date(),
+          passedCases: stats.passed,
+          failedCases: stats.failed,
+          interruptedCases: stats.interrupted,
+          avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
+        }, {
+          type: "completed",
+          runId,
+          data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
+        });
         return { report };
       } catch (err) {
         const errorMsg = err.message;
-        if (!abortController.signal.aborted) {
-          await store.updateRunStatus(tenantId, runId, {
+        try {
+          await persistTerminal({
             status: "failed",
             error: errorMsg,
             completedAt: /* @__PURE__ */ new Date()
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
+          }, {
             type: "error",
             runId,
             data: { message: errorMsg }
           });
+        } catch {
         }
         throw err;
       } finally {
-        this.runs.delete(runId);
+        terminal.workerSettled = true;
+        if (terminal.persisted) {
+          this.runs.delete(runId);
+          this.releaseProjectLease(leaseKey, leaseToken);
+        }
       }
     })();
-    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, taskId });
+    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, terminal, leaseKey, leaseToken, taskId });
     runPromise.catch(() => {
     });
     return runId;
   }
-  async abortRun(runId) {
+  async abortRun(runId, tenantId) {
     const ctx = this.runs.get(runId);
-    if (!ctx) return false;
+    if (!ctx || tenantId !== void 0 && ctx.tenantId !== tenantId) return false;
+    if (ctx.terminal.claiming || ctx.terminal.persisted) return false;
     ctx.abortController.abort();
     const store = this.getEvalStore();
-    await store.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
-    return true;
+    ctx.terminal.claiming = true;
+    try {
+      let lastError;
+      for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+        try {
+          const persistedRun = await store.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
+          if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+          lastError = void 0;
+          break;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      if (lastError) throw lastError;
+      ctx.terminal.persisted = true;
+      this.eventEmitter.emit(`run:${runId}`, {
+        type: "error",
+        runId,
+        data: { message: "Run aborted" }
+      });
+      this.releaseProjectLease(ctx.leaseKey, ctx.leaseToken);
+      if (ctx.terminal.workerSettled) this.runs.delete(runId);
+      return true;
+    } finally {
+      ctx.terminal.claiming = false;
+    }
   }
   async waitForRun(runId) {
     const ctx = this.runs.get(runId);
@@ -6960,12 +7386,25 @@ var EvalRunner = class {
     const { report } = await ctx.promise;
     return report;
   }
-  isRunning(runId) {
-    return this.runs.has(runId);
+  /**
+   * Whether the run can still be controlled or observed as a non-terminal run.
+   * Acknowledged aborts return false even while their worker is unwinding.
+   */
+  isRunning(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.persisted && (tenantId === void 0 || ctx.tenantId === tenantId);
+  }
+  /** Whether the run's worker promise has not yet reached its finally block. */
+  hasActiveExecution(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.workerSettled && (tenantId === void 0 || ctx.tenantId === tenantId);
   }
   getEvalStore() {
     return getStoreLattice9("default", "eval").store;
   }
+  releaseProjectLease(leaseKey, leaseToken) {
+    if (this.projectLeases.get(leaseKey) === leaseToken) this.projectLeases.delete(leaseKey);
+  }
 };
 var evalRunner = new EvalRunner();
 
@@ -6980,6 +7419,18 @@ function getTenantId11(request) {
 function getEvalStore() {
   return getStoreLattice10("default", "eval").store;
 }
+async function getOwnedSuite(store, tenantId, projectId, suiteId) {
+  const project = await store.getProjectById(tenantId, projectId);
+  if (!project) return null;
+  const suite = await store.getSuiteById(tenantId, suiteId);
+  return suite?.projectId === projectId ? suite : null;
+}
+async function getOwnedCase(store, tenantId, projectId, suiteId, caseId) {
+  const suite = await getOwnedSuite(store, tenantId, projectId, suiteId);
+  if (!suite) return null;
+  const evalCase = await store.getCaseById(tenantId, caseId);
+  return evalCase?.suiteId === suiteId ? evalCase : null;
+}
 async function createProject(request, reply) {
   try {
     const tenantId = getTenantId11(request);
@@ -7135,6 +7586,7 @@ async function updateProject(request, reply) {
   }
 }
 async function deleteProject(request, reply) {
+  let releaseDeletion;
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
@@ -7143,6 +7595,23 @@ async function deleteProject(request, reply) {
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
+    releaseDeletion = evalRunner.reserveProjectDeletion(tenantId, pid) ?? void 0;
+    if (!releaseDeletion) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
+    const runs = await store.getRunsByTenant(tenantId, { projectId: pid });
+    const hasActiveRun = runs.some(
+      (run) => run.status === "running" || evalRunner.hasActiveExecution(run.id, tenantId)
+    );
+    if (hasActiveRun) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
     const deleted = await store.deleteProject(tenantId, pid);
     if (!deleted) {
       return reply.status(500).send({ success: false, message: "Failed to delete project" });
@@ -7151,6 +7620,8 @@ async function deleteProject(request, reply) {
   } catch (err) {
     const message = err instanceof Error ? err.message : "Failed to delete project";
     return reply.status(500).send({ success: false, message });
+  } finally {
+    releaseDeletion?.();
   }
 }
 async function createSuite(request, reply) {
@@ -7179,8 +7650,8 @@ async function updateSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7199,8 +7670,8 @@ async function deleteSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7218,8 +7689,8 @@ async function createCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const suite = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7248,7 +7719,11 @@ async function listCasesForSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store, tenantId, pid, sid);
+    if (!suite) {
+      return reply.status(404).send({ success: false, message: "Suite not found" });
+    }
     const cases = await store.getCasesBySuite(tenantId, sid);
     return {
       success: true,
@@ -7264,8 +7739,8 @@ async function updateCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -7284,8 +7759,8 @@ async function deleteCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -7354,6 +7829,11 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
+    const tenantId = getTenantId11(request);
+    const { rid } = request.params;
+    const store = getEvalStore();
+    const ownedRun = await store.getRunById(tenantId, rid);
+    if (!ownedRun) return reply.status(404).send({ success: false, message: "Run not found" });
     reply.hijack();
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -7361,41 +7841,75 @@ function registerEvalRoutes(app2) {
       Connection: "keep-alive",
       "Access-Control-Allow-Origin": "*"
     });
-    const { rid } = request.params;
     const emitter = evalRunner.getEventEmitter();
     const eventKey = `run:${rid}`;
-    if (!evalRunner.isRunning(rid)) {
-      const tenantId = getTenantId11(request);
-      const run = await getEvalStore().getRunById(tenantId, rid);
-      if (run) {
-        const eventType = run.status === "completed" ? "completed" : "error";
-        reply.raw.write(`event: ${eventType}
-data: ${JSON.stringify({ passed: run.passedCases, failed: run.failedCases, avgScore: run.avgScore })}
+    let settled = false;
+    const cleanup = () => {
+      emitter.off(eventKey, handler);
+      request.raw.off("close", disconnect);
+    };
+    const disconnect = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+    };
+    const finish = (type, data) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reply.raw.write(`event: ${type}
+data: ${JSON.stringify(data)}
 
 `);
-      }
       reply.raw.end();
-      return;
-    }
+    };
     const handler = (event) => {
-      reply.raw.write(`event: ${event.type}
+      if (event.type === "completed" || event.type === "error") {
+        finish(event.type, event.data);
+        return;
+      }
+      if (!settled) reply.raw.write(`event: ${event.type}
 data: ${JSON.stringify(event.data)}
 
 `);
-      if (event.type === "completed" || event.type === "error") {
-        emitter.off(eventKey, handler);
-        reply.raw.end();
-      }
     };
     emitter.on(eventKey, handler);
-    request.raw.on("close", () => {
-      emitter.off(eventKey, handler);
-    });
+    request.raw.on("close", disconnect);
+    let reconciledRun;
+    try {
+      reconciledRun = await store.getRunById(tenantId, rid);
+    } catch (error) {
+      finish("error", { message: error.message });
+      return;
+    }
+    if (settled) return;
+    if (!reconciledRun) {
+      cleanup();
+      reply.raw.end();
+      return;
+    }
+    if (reconciledRun.status === "completed") {
+      finish("completed", {
+        passed: reconciledRun.passedCases,
+        failed: reconciledRun.failedCases,
+        avgScore: reconciledRun.avgScore
+      });
+    } else if (reconciledRun.status === "failed") {
+      finish("error", { message: reconciledRun.error ?? "Evaluation failed" });
+    } else if (reconciledRun.status === "aborted") {
+      finish("error", { message: "Run aborted" });
+    } else if (!evalRunner.isRunning(rid, tenantId)) {
+      cleanup();
+      reply.raw.end();
+    }
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
-      const aborted = await evalRunner.abortRun(rid);
+      const run = await getEvalStore().getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      const aborted = await evalRunner.abortRun(rid, tenantId);
       if (!aborted) return reply.status(404).send({ success: false, message: "Run not found or not running" });
       reply.send({ success: true, message: "Run aborted" });
     } catch (err) {
@@ -7406,7 +7920,13 @@ data: ${JSON.stringify(event.data)}
     try {
       const tenantId = getTenantId11(request);
       const { rid } = request.params;
-      const deleted = await getEvalStore().deleteRun(tenantId, rid);
+      const store = getEvalStore();
+      const run = await store.getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      if (run.status === "running" || evalRunner.hasActiveExecution(rid, tenantId)) {
+        return reply.status(409).send({ success: false, message: "Cannot delete an active evaluation run" });
+      }
+      const deleted = await store.deleteRun(tenantId, rid);
       if (!deleted) return reply.status(404).send({ success: false, message: "Run not found" });
       reply.send({ success: true, message: "Run deleted" });
     } catch (err) {
@@ -8002,7 +8522,7 @@ function registerConsoleAuthHook(app2, options) {
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
     const path4 = request.url.split("?")[0];
-    if (path4.includes("/viewfile") || path4.includes("/downloadfile") || path4.includes("/uploadfile") || path4.startsWith("/f/") || path4 === "/f") {
+    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path4) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path4) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path4) || path4.startsWith("/f/") || path4 === "/f") {
       return;
     }
     await reply.status(401).send({
@@ -9002,12 +9522,12 @@ async function handleBridgeProxy(request, reply) {
   };
   const timeout = 3e5;
   try {
-    const response = await new Promise((resolve2, reject) => {
+    const response = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`Bridge request timeout after ${timeout}ms`));
       }, timeout);
-      pending.set(requestId, { resolve: resolve2, reject, timer, agentId });
+      pending.set(requestId, { resolve: resolve3, reject, timer, agentId });
       try {
         if (conn.ws.readyState !== conn.ws.OPEN) {
           pending.delete(requestId);
@@ -12794,7 +13314,7 @@ ${summary}`
       console.log(
         `\u5C06\u5728 ${delayMs}ms \u540E\u91CD\u8BD5\u4EFB\u52A1 (${nextRetryCount}/${maxRetries})`
       );
-      await new Promise((resolve2) => setTimeout(resolve2, delayMs));
+      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {