@gmickel/gno 2.5.1 → 2.7.0

package/src/serve/security.ts

@@ -69,6 +69,15 @@ export function isRequestAllowed(req: Request, port: number): boolean {
   }
 
   // Unsafe methods - require valid Origin or token
+  return isOriginOrTokenAllowed(req, port);
+}
+
+/**
+ * Origin/token check without the safe-method exemption. Owner-only reads
+ * that return host paths use it so a cross-origin page is refused on GET
+ * the same way as on POST.
+ */
+export function isOriginOrTokenAllowed(req: Request, port: number): boolean {
   return validateToken(req) || validateOrigin(req, port);
 }
 

package/src/serve/server.ts

@@ -1,11 +1,4 @@
 import type { HttpGatewayOverrides } from "../mcp/http-security";
-/**
- * Bun.serve() web server for GNO web UI.
- * Uses Bun's fullstack dev server with HTML imports.
- * Opens DB once at startup, closes on shutdown.
- *
- * @module src/serve/server
- */
 import type { RequestPeerServer } from "./request-locality";
 import type { ResidentRuntime } from "./resident-runtime";
 import type { ContextHolder } from "./routes/api";
@@ -23,6 +16,14 @@ import {
   handlePdfjsVendorRequest,
   isPdfjsVendorPath,
 } from "./fn112-routes";
+/**
+ * Bun.serve() web server for GNO web UI.
+ * Uses Bun's fullstack dev server with HTML imports.
+ * Opens DB once at startup, closes on shutdown.
+ *
+ * @module src/serve/server
+ */
+import { withRemoteHostPathRedaction } from "./host-path-redaction";
 import { PDFJS_ASSET_CACHE_CONTROL } from "./pdfjs-assets";
 // HTML import - Bun handles bundling TSX/CSS automatically via routes
 import homepage from "./public/index.html";
@@ -82,6 +83,7 @@ import {
   handleTrashDoc,
   handleUpdateCollection,
   handleUpdateCollectionEgressPolicy,
+  handleRequestStatus,
   handleUpdateDoc,
   handleVerifyConnector,
 } from "./routes/api";
@@ -101,6 +103,24 @@ import {
   handleCreateSectionTarget,
   handleResolveSectionTarget,
 } from "./routes/section-targets";
+import {
+  handleSessionsAddSource,
+  handleSessionsAutomationDisable,
+  handleSessionsAutomationEnable,
+  handleSessionsAutomationPreview,
+  handleSessionsAutomationRemove,
+  handleSessionsAutomationRun,
+  handleSessionsAutomationSet,
+  handleSessionsDiscover,
+  handleSessionsImport,
+  handleSessionsInit,
+  handleSessionsRemoveSource,
+  handleSessionsStatus,
+} from "./routes/sessions";
+
+/** `/api/sessions/automation/:id[/...]` path parameter. */
+const automationProfileId = (req: Request): string =>
+  decodeURIComponent(new URL(req.url).pathname.split("/")[4] ?? "");
 import {
   handleTraceDelete,
   handleTraceExport,
@@ -109,7 +129,11 @@ import {
   handleTracePurge,
   handleTraceShow,
 } from "./routes/traces";
-import { forbiddenResponse, isRequestAllowed } from "./security";
+import {
+  forbiddenResponse,
+  isOriginOrTokenAllowed,
+  isRequestAllowed,
+} from "./security";
 import {
   createSpaBundleSource,
   type SpaBundleSource,
@@ -548,7 +572,7 @@ export async function startServer(
       development: isDev,
 
       // Static routes - Bun handles HTML bundling and /_bun/* assets automatically
-      routes: {
+      routes: withRemoteHostPathRedaction({
         "/mcp": gateway.route,
         ...clipperRoutesForBind(
           isHttpGatewayLoopbackBind(gatewayConfig.host),
@@ -566,6 +590,7 @@ export async function startServer(
         "/collections": spaPageRoute,
         "/connectors": spaPageRoute,
         "/traces": spaPageRoute,
+        "/sessions": spaPageRoute,
         "/context/compiled": spaPageRoute,
         "/ask": spaPageRoute,
         "/graph": spaPageRoute,
@@ -833,6 +858,174 @@ export async function startServer(
             );
           },
         },
+        "/api/sessions/status": {
+          GET: async (req: Request) =>
+            withSecurityHeaders(
+              await handleResidentRead(runtime as ResidentRuntime, req, () =>
+                handleSessionsStatus(ctxHolder)
+              ),
+              isDev
+            ),
+        },
+        "/api/sessions/discover": {
+          GET: async (req: Request, server: RequestPeerServer) => {
+            // Returns host paths: a cross-origin page is refused like a write.
+            if (!isOriginOrTokenAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleResidentRead(runtime as ResidentRuntime, req, () =>
+                handleSessionsDiscover(ctxHolder, req, { server })
+              ),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/import": {
+          POST: async (req: Request) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsImport(ctxHolder, req),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/sources": {
+          POST: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAddSource(ctxHolder, store, req, { server }),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/sources/:id": {
+          DELETE: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            const id = decodeURIComponent(
+              new URL(req.url).pathname.split("/")[4] ?? ""
+            );
+            return withSecurityHeaders(
+              await handleSessionsRemoveSource(ctxHolder, store, id, req, {
+                server,
+              }),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/automation/run": {
+          POST: async (req: Request) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAutomationRun(ctxHolder, store, req),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/automation/:id": {
+          PUT: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAutomationSet(
+                ctxHolder,
+                store,
+                automationProfileId(req),
+                req,
+                { server }
+              ),
+              isDev
+            );
+          },
+          DELETE: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAutomationRemove(
+                ctxHolder,
+                store,
+                automationProfileId(req),
+                req,
+                { server }
+              ),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/automation/:id/preview": {
+          GET: async (req: Request, server: RequestPeerServer) =>
+            !isOriginOrTokenAllowed(req, port)
+              ? withSecurityHeaders(forbiddenResponse(), isDev)
+              : withSecurityHeaders(
+                  await handleResidentRead(
+                    runtime as ResidentRuntime,
+                    req,
+                    () =>
+                      handleSessionsAutomationPreview(
+                        ctxHolder,
+                        automationProfileId(req),
+                        req,
+                        { server }
+                      )
+                  ),
+                  isDev
+                ),
+        },
+        "/api/sessions/automation/:id/enable": {
+          POST: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAutomationEnable(
+                ctxHolder,
+                store,
+                automationProfileId(req),
+                req,
+                { server }
+              ),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/automation/:id/disable": {
+          POST: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsAutomationDisable(
+                ctxHolder,
+                store,
+                automationProfileId(req),
+                req,
+                { server }
+              ),
+              isDev
+            );
+          },
+        },
+        "/api/sessions/init": {
+          POST: async (req: Request, server: RequestPeerServer) => {
+            if (!isRequestAllowed(req, port)) {
+              return withSecurityHeaders(forbiddenResponse(), isDev);
+            }
+            return withSecurityHeaders(
+              await handleSessionsInit(ctxHolder, store, req, { server }),
+              isDev
+            );
+          },
+        },
         "/api/memory/remember": {
           POST: async (req: Request) => {
             if (!isRequestAllowed(req, port)) {
@@ -1046,6 +1239,18 @@ export async function startServer(
             );
           },
         },
+        "/api/requests/:requestId": {
+          GET: async (req: Request) => {
+            const url = new URL(req.url);
+            const requestId = decodeURIComponent(
+              url.pathname.split("/").pop() || ""
+            );
+            return withSecurityHeaders(
+              await handleRequestStatus(store, requestId),
+              isDev
+            );
+          },
+        },
         "/api/doc": {
           GET: async (req: Request) => {
             const url = new URL(req.url);
@@ -1539,7 +1744,7 @@ export async function startServer(
             );
           },
         },
-      },
+      }),
       // Production catch-all: /vendor/pdfjs prefix, then hashed SPA chunks
       // (gzip + immutable) and the private SPA source — the same factory the
       // tests mount (no test-only fallback path).

package/src/serve/session-automation.ts

@@ -0,0 +1,146 @@
+/**
+ * Daemon-only session automation tick: heartbeat, coalesced schedule
+ * admissions and a drain of pending profiles through the manual importer.
+ *
+ * Runs only in `gno daemon` on a session-archive config (never in `serve`).
+ * One tick at a time over the daemon's background-work tracker; the owner
+ * config is reread every tick, so enable/disable take effect without a
+ * restart. Imports take the shared write lease; a busy lease backs off.
+ */
+
+import type { SessionAutomationRunResult } from "../sessions/types";
+import type { SqliteAdapter } from "../store/sqlite/adapter";
+
+import { acquireCliWriteLease } from "../core/write-lease";
+import { heartbeatAutomation, tickAutomation } from "../sessions/automation";
+import { AUTOMATION_TICK_MS } from "../sessions/automation-state";
+
+const LEASE_HOLDER_COMMAND = "gno daemon (session automation)";
+
+/**
+ * The importer syncs the lexical index itself, so the resident watcher later
+ * sees unchanged files and never queues embedding: do it here for the
+ * collections a run synced, and mark the mutation (as the REST import does).
+ */
+export function notifyAutomationImport(
+  result: SessionAutomationRunResult,
+  sink: {
+    markMutation: () => void;
+    notifySyncComplete: (collections: string[]) => void;
+  }
+): void {
+  const collections = [
+    ...new Set(
+      result.receipts.flatMap((receipt) => receipt.lexical.collections)
+    ),
+  ];
+  if (collections.length === 0) return;
+  sink.markMutation();
+  sink.notifySyncComplete(collections);
+}
+
+export interface SessionAutomationSchedulerOptions {
+  store: SqliteAdapter;
+  configPath: string;
+  indexName: string;
+  dbPath: string;
+  startBackgroundWork: (
+    operation: (signal: AbortSignal) => Promise<void>
+  ) => boolean;
+  /** Called after every run; the daemon logs content-free counts. */
+  onResult?: (result: SessionAutomationRunResult) => void;
+  onError?: (error: unknown) => void;
+  now?: () => Date;
+  tickMs?: number;
+}
+
+export class SessionAutomationScheduler {
+  readonly #options: SessionAutomationSchedulerOptions;
+  readonly #startedAt: Date;
+  #timer: ReturnType<typeof setTimeout> | null = null;
+  #heartbeat: ReturnType<typeof setInterval> | null = null;
+  #running: Promise<void> | null = null;
+  #disposed = false;
+
+  constructor(options: SessionAutomationSchedulerOptions) {
+    this.#options = options;
+    this.#startedAt = (options.now ?? (() => new Date()))();
+  }
+
+  /** Drain once at startup, then tick; heartbeat independently of ticks. */
+  start(): void {
+    this.#beat();
+    this.#heartbeat = setInterval(
+      () => this.#beat(),
+      this.#options.tickMs ?? AUTOMATION_TICK_MS
+    );
+    this.#heartbeat.unref?.();
+    this.#schedule(0);
+  }
+
+  /** A tick or import in progress must not let the heartbeat go stale. */
+  #beat(): void {
+    if (this.#disposed) return;
+    const options = this.#options;
+    heartbeatAutomation({
+      configPath: options.configPath,
+      indexName: options.indexName,
+      now: options.now,
+      daemonStartedAt: this.#startedAt,
+    }).catch((error: unknown) => options.onError?.(error));
+  }
+
+  /** One tick; coalesces with a tick already in flight. */
+  tick(): Promise<void> {
+    if (this.#running) return this.#running;
+    const options = this.#options;
+    const run = tickAutomation({
+      configPath: options.configPath,
+      indexName: options.indexName,
+      store: options.store,
+      now: options.now,
+      daemonStartedAt: this.#startedAt,
+      // The daemon serves MCP and status over HTTP: keep its loop free.
+      inChildProcess: true,
+      acquireLease: async () => {
+        const lease = await acquireCliWriteLease({
+          dbPath: options.dbPath,
+          waitMs: 0,
+          noWait: true,
+          command: LEASE_HOLDER_COMMAND,
+        });
+        return lease.ok ? { ok: true, release: lease.release } : { ok: false };
+      },
+    })
+      .then((results) => {
+        for (const result of results) options.onResult?.(result);
+      })
+      .catch((error: unknown) => options.onError?.(error))
+      .finally(() => {
+        this.#running = null;
+        this.#schedule(options.tickMs ?? AUTOMATION_TICK_MS);
+      });
+    this.#running = run;
+    return run;
+  }
+
+  dispose(): void {
+    this.#disposed = true;
+    if (this.#heartbeat) clearInterval(this.#heartbeat);
+    this.#heartbeat = null;
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = null;
+  }
+
+  #schedule(delayMs: number): void {
+    if (this.#disposed) return;
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = setTimeout(() => {
+      this.#timer = null;
+      if (this.#disposed || this.#running) return;
+      const started = this.#options.startBackgroundWork(() => this.tick());
+      if (!started) this.#schedule(this.#options.tickMs ?? AUTOMATION_TICK_MS);
+    }, delayMs);
+    this.#timer.unref?.();
+  }
+}

package/src/serve/status-model.ts

@@ -1,6 +1,10 @@
 import type { ContentTypeBoostStatus } from "../config/content-types";
 import type { ActivationStatus } from "../core/activation-status";
 import type { ChunkingStatus } from "../store/chunking";
+import type {
+  VectorPartitionStatus,
+  VectorRuntimeStatus,
+} from "../store/vector/status";
 
 export type HealthCheckStatus = "ok" | "warn" | "error";
 
@@ -109,6 +113,16 @@ export interface ResidentStatus {
     content: number;
     index: number;
   };
+  /** Present only while a background job is in trouble. */
+  backgroundIssues?: BackgroundIssue[];
+}
+
+/** A resident background job that keeps failing, has stopped retrying, or overruns. */
+export interface BackgroundIssue {
+  job: "embed" | "resident";
+  state: "failing" | "parked" | "overrunning" | "unresponsive";
+  consecutiveFailures: number;
+  runningSeconds: number | null;
 }
 
 export interface BackgroundServiceState {
@@ -186,6 +200,8 @@ export interface AppStatusResponse {
   totalDocuments: number;
   totalChunks: number;
   embeddingBacklog: number;
+  vectorPartitions?: VectorPartitionStatus[];
+  vectorRuntime?: VectorRuntimeStatus;
   lastUpdated: string | null;
   recentErrors: number;
   healthy: boolean;

package/src/serve/status.ts

@@ -734,6 +734,8 @@ export async function buildAppStatus(
     totalDocuments: status.activeDocuments,
     totalChunks: status.totalChunks,
     embeddingBacklog: status.embeddingBacklog,
+    vectorPartitions: status.vectorPartitions,
+    vectorRuntime: status.vectorRuntime,
     chunking: status.chunking,
     lastUpdated: status.lastUpdatedAt,
     recentErrors: status.recentErrors,

package/src/serve/watch-reconciliation-shared.ts

@@ -45,6 +45,9 @@ export const WATCHER_MAX_SUPPRESSION_ENTRIES = 4_096;
 /** Bounded retry delay after failed classification/sync. */
 export const WATCHER_RETRY_BACKOFF_MS = 500;
 
+/** Retry delay while another writer holds the shared writer lease. */
+export const WATCHER_LEASE_RETRY_MS = 5_000;
+
 /**
  * Single fixed budget for fallback classification across visited directories,
  * candidates, removals, dirty dirs, and aggregate store rows.

package/src/serve/watch-service-events.ts

@@ -219,7 +219,8 @@ export function requeueAfterFailure(
   collectionName: string,
   exact: string[],
   dirty: string[],
-  forceFlags?: PendingForceFlags
+  forceFlags?: PendingForceFlags,
+  delayMs = WATCHER_RETRY_BACKOFF_MS
 ): void {
   queueWithoutSchedule(host, collectionName, exact, dirty, forceFlags);
   if (host.disposed()) {
@@ -241,7 +242,7 @@ export function requeueAfterFailure(
       host.timers.delete(collectionName);
       host.retryScheduled.delete(collectionName);
       startFlush(host, collectionName);
-    }, WATCHER_RETRY_BACKOFF_MS)
+    }, delayMs)
   );
 }
 

package/src/serve/watch-service-run-flush.ts

@@ -14,6 +14,7 @@ import type { WatchQueueHost } from "./watch-service-events";
 import type { CollectionPending } from "./watch-service-state";
 import type { WatcherSnapshot, WatcherSnapshotFs } from "./watch-snapshot";
 
+import { WATCHER_LEASE_RETRY_MS } from "./watch-reconciliation-shared";
 import {
   requeueAfterFailure,
   requeueGenerationReconcile,
@@ -65,6 +66,11 @@ export interface RunFlushContext {
   snapshotFs?: WatcherSnapshotFs;
   /** Test seam: lower snapshot entry ceiling for overflow→full proofs. */
   snapshotEntryCeiling?: number;
+  /**
+   * Shared writer lease for this flush; null when another writer holds it,
+   * which leaves the work queued for the retry timer instead of waiting.
+   */
+  acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
 }
 
 /**
@@ -86,19 +92,44 @@ export async function runOwnedCollectionFlush(
     return;
   }
 
+  ctx.syncing.add(collectionName);
+  let releaseLease: (() => Promise<void>) | null = null;
+  if (ctx.acquireWriteLease) {
+    releaseLease = await ctx.acquireWriteLease();
+    if (!releaseLease || ctx.disposed()) {
+      ctx.syncing.delete(collectionName);
+      await releaseLease?.();
+      if (!ctx.disposed()) {
+        requeueAfterFailure(
+          ctx.queueHost,
+          collectionName,
+          [],
+          [],
+          undefined,
+          WATCHER_LEASE_RETRY_MS
+        );
+      }
+      return;
+    }
+  }
+
   const collection = ctx
     .collections()
     .find((entry) => entry.name === collectionName);
   if (!collection) {
+    await releaseLease?.();
+    ctx.syncing.delete(collectionName);
     ctx.pendingByCollection.delete(collectionName);
     ctx.flushDeadlineAt.delete(collectionName);
     return;
   }
 
-  const taken = takePending(pending);
+  // Events that arrived while the lease was being taken join this flush.
+  const taken = takePending(
+    ctx.pendingByCollection.get(collectionName) ?? pending
+  );
   ctx.pendingByCollection.set(collectionName, emptyPending());
   ctx.flushDeadlineAt.delete(collectionName);
-  ctx.syncing.add(collectionName);
 
   const ownerGeneration = ctx.collectionGenerations.get(collectionName) ?? 0;
   const ownerRoot = normalize(collection.path);
@@ -219,6 +250,8 @@ export async function runOwnedCollectionFlush(
       throw outcome.error;
     }
   } finally {
+    // Release before any follow-up flush below tries to take the lease again.
+    await releaseLease?.();
     ctx.syncing.delete(collectionName);
     ctx.clearLifecycleTombstones(collectionName);
     ctx.pruneSuppression();

package/src/serve/watch-service.ts

@@ -108,6 +108,8 @@ interface CollectionWatchServiceOptions {
    * Production leaves this unset (uses WATCHER_SNAPSHOT_ENTRY_CEILING).
    */
   snapshotEntryCeiling?: number;
+  /** Shared writer lease taken (no wait) around each flush's writes. */
+  acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
 }
 
 export class CollectionWatchService {
@@ -146,6 +148,7 @@ export class CollectionWatchService {
     | undefined;
   readonly #snapshotFs: WatcherSnapshotFs | undefined;
   readonly #snapshotEntryCeiling: number | undefined;
+  readonly #acquireWriteLease: CollectionWatchServiceOptions["acquireWriteLease"];
   #nextCollectionGeneration = 0;
   #disposed = false;
   #lastEventAt: string | null = null;
@@ -169,6 +172,7 @@ export class CollectionWatchService {
     this.#buildSnapshot = options.buildSnapshot;
     this.#snapshotFs = options.snapshotFs;
     this.#snapshotEntryCeiling = options.snapshotEntryCeiling;
+    this.#acquireWriteLease = options.acquireWriteLease;
   }
 
   start(): void {
@@ -394,6 +398,7 @@ export class CollectionWatchService {
       },
       snapshotFs: this.#snapshotFs,
       snapshotEntryCeiling: this.#snapshotEntryCeiling,
+      acquireWriteLease: this.#acquireWriteLease,
     });
   }