@harperfast/harper 5.2.0-beta.4 → 5.2.1

package/server/serverHelpers/serverHandlers.js

@@ -4,7 +4,7 @@ const terms = require('../../utility/hdbTerms.ts');
 const hdbUtil = require('../../utility/common_utils.ts');
 const harperLogger = require('../../utility/logging/harper_logger.ts');
 const { realExit } = require('../threads/workerProcessGuard.ts');
-const { handleHDBError, hdbErrors } = require('../../utility/errors/hdbError.ts');
+const { ClientError, handleHDBError, hdbErrors } = require('../../utility/errors/hdbError.ts');
 const { isMainThread } = require('worker_threads');
 const { Readable } = require('stream');
 
@@ -43,6 +43,19 @@ const NO_AUTH_OPERATIONS = [
 	terms.OPERATIONS_ENUM.LOGOUT,
 ];
 
+const UNSAFE_REQUEST_BODY_PROPERTIES = ['__proto__', 'constructor', 'prototype'];
+
+function validateRequestBodyProperties(body) {
+	if (!body || typeof body !== 'object') {
+		throw new ClientError('Invalid request body', 400);
+	}
+	for (const property of UNSAFE_REQUEST_BODY_PROPERTIES) {
+		if (Object.hasOwn(body, property)) {
+			throw new ClientError(`Request body property "${property}" is not allowed`, 400);
+		}
+	}
+}
+
 function handleServerUncaughtException(err) {
 	let message = `Found an uncaught exception with message: ${err.message}. ${os.EOL}Stack: ${err.stack} ${
 		os.EOL
@@ -145,8 +158,12 @@ async function handlePostRequest(req, res, _bypassAuth = false) {
 	let operation_function;
 
 	try {
-		// Just in case someone tries to bypass auth
-		if (req.body.bypass_auth) delete req.body.bypass_auth;
+		validateRequestBodyProperties(req.body);
+		// Authorization bypass is internal dispatch state, never client request data. Dispatch no
+		// longer reads these properties, but remove both true and false values before operation
+		// code sees the body.
+		if (Object.hasOwn(req.body, 'bypass_auth')) delete req.body.bypass_auth;
+		if (Object.hasOwn(req.body, 'bypassAuth')) delete req.body.bypassAuth;
 
 		operation_function = serverUtilities.chooseOperation(req.body);
 
@@ -174,9 +191,12 @@ async function handlePostRequest(req, res, _bypassAuth = false) {
 				res.header(name, value);
 			}
 			// fastify-compress has one job. I don't know why it can't do it. So we compress here to
-			// handle the case of returning a stream. Streams marked preCompressed (e.g. a stored
-			// .tar.gz payload) are passed through as-is — recompressing them wastes CPU for zero gain.
-			if (!result.preCompressed && req.headers['accept-encoding']?.includes('gzip')) {
+			// handle the case of returning a stream. Streams marked `noCompression` opt out (e.g.
+			// RocksDB get_backup tars: the binding gzips when requested; compressing here would
+			// mislabel a gzip:false tar or double-compress a gzip:true one). Streams marked
+			// `preCompressed` (e.g. a stored .tar.gz payload) are passed through as-is —
+			// recompressing them wastes CPU for zero gain.
+			if (req.headers['accept-encoding']?.includes('gzip') && !result.noCompression && !result.preCompressed) {
 				res.header('content-encoding', 'gzip');
 				const gzip = createGzip({ level: constants.Z_BEST_SPEED }); // go fast
 				// .pipe() does not tear down across the pipe in either direction, so wire both:
@@ -187,7 +207,8 @@ async function handlePostRequest(req, res, _bypassAuth = false) {
 				// - gzip close → destroy source: when the client disconnects mid-download Fastify
 				//   destroys only the stream it was handed (gzip); destroy the source too so its
 				//   underlying file/blob read stops and descriptors release. (No-op after a normal
-				//   end. preCompressed streams skip this block; Fastify handles them directly.)
+				//   end. noCompression/preCompressed streams skip this block; Fastify handles them
+				//   directly.)
 				const source = result;
 				source.on('error', (error) => gzip.destroy(error));
 				gzip.on('close', () => source.destroy());

package/server/serverHelpers/serverUtilities.ts

@@ -12,6 +12,7 @@ import { isDeployValidating } from './deployValidationState.ts';
 import harperLogger from '../../utility/logging/harper_logger.ts';
 import readLog from '../../utility/logging/readLog.ts';
 import * as export_ from '../../dataLayer/export.ts';
+import * as rocksdbBackup from '../../dataLayer/rocksdbBackup.ts';
 import * as opAuth from '../../utility/operation_authorization.ts';
 import * as jobs from '../jobs/jobs.ts';
 import * as terms from '../../utility/hdbTerms.ts';
@@ -47,6 +48,7 @@ import {
 	getRemoteOperationFunction,
 	setLocalOperationDispatch,
 } from './registeredOperations.ts';
+import { runWithOperationAuthorizationBypass } from './operationAuthorizationState.ts';
 
 const pSearchSearch = util.promisify(search.search);
 let pEvaluateSql: (sql: string) => Promise<any>;
@@ -202,7 +204,7 @@ server.setMcpQuotaHandler = (handler) => {
 	setMcpQuotaHandler(handler);
 };
 
-export function chooseOperation(json: OperationRequestBody) {
+export function chooseOperation(json: OperationRequestBody, bypassAuth = false) {
 	let getOpResult: OperationFunctionObject;
 	try {
 		getOpResult = getOperationFunction(json);
@@ -213,7 +215,7 @@ export function chooseOperation(json: OperationRequestBody) {
 		// and its metadata actually exist, so no perm check is skipped by returning early
 		// here (#1736). Workers never re-forward, so an unknown op can't loop.
 		if (isMainThread) {
-			const remoteOperationFunction = getRemoteOperationFunction(json.operation);
+			const remoteOperationFunction = getRemoteOperationFunction(json.operation, bypassAuth);
 			if (remoteOperationFunction) return remoteOperationFunction;
 		}
 		operationLog.error(`Error when selecting operation function - ${err}`);
@@ -230,7 +232,7 @@ export function chooseOperation(json: OperationRequestBody) {
 			const sqlStatement = json.operation === 'sql' ? json.sql : json.search_operation.sql;
 			const parsedSqlObject = sql.convertSQLToAST(sqlStatement);
 			json.parsed_sql_object = parsedSqlObject;
-			if (!json.bypass_auth) {
+			if (!bypassAuth) {
 				const astPermCheck = sql.checkASTPermissions(json, parsedSqlObject);
 				if (astPermCheck) {
 					operationLog.error(`${HTTP_STATUS_CODES.FORBIDDEN} from operation ${json.operation}`);
@@ -247,7 +249,7 @@ export function chooseOperation(json: OperationRequestBody) {
 			}
 			//we need to bypass permission checks to allow the createAuthorizationTokens
 		} else if (
-			!json.bypass_auth &&
+			!bypassAuth &&
 			json.operation !== terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS &&
 			json.operation !== terms.OPERATIONS_ENUM.LOGIN &&
 			json.operation !== terms.OPERATIONS_ENUM.LOGOUT
@@ -309,9 +311,11 @@ _assignPackageExport('operation', operation);
  */
 export function operation(operation: OperationRequestBody, context: Context, authorize: boolean) {
 	operation.hdb_user = context?.user;
-	operation.bypass_auth = !authorize;
-	const operation_function = chooseOperation(operation);
-	return processLocalTransaction({ body: operation }, operation_function);
+	const bypassAuth = !authorize;
+	return runWithOperationAuthorizationBypass(bypassAuth, () => {
+		const operation_function = chooseOperation(operation, bypassAuth);
+		return processLocalTransaction({ body: operation }, operation_function);
+	});
 }
 
 interface Transaction {
@@ -388,6 +392,9 @@ export async function executeJob(json: OperationRequestBody): Promise<JobResult>
 			};
 		}
 	} catch (err) {
+		// errors that already carry a statusCode (e.g. ClientError from job validation) are
+		// client-facing as-is; wrapping them here would turn a 400/404/409 into a 500
+		if (err instanceof Error && typeof (err as any).statusCode === 'number') throw err;
 		const error = err instanceof Error ? err : null;
 		const message = `There was an error executing job: ${error && 'http_resp_msg' in error ? error.http_resp_msg : err}`;
 		operationLog.error(message);
@@ -581,6 +588,21 @@ function initializeOperationFunctionMap(): Map<OperationFunctionName, OperationF
 	);
 	opFuncMap.set(terms.OPERATIONS_ENUM.INSTALL_NODE_MODULES, new OperationFunctionObject(npmUtilities.installModules));
 	opFuncMap.set(terms.OPERATIONS_ENUM.GET_BACKUP, new OperationFunctionObject(schema.getBackup));
+	opFuncMap.set(
+		terms.OPERATIONS_ENUM.CREATE_BACKUP,
+		new OperationFunctionObject(executeJob, rocksdbBackup.createBackup)
+	);
+	opFuncMap.set(terms.OPERATIONS_ENUM.LIST_BACKUPS, new OperationFunctionObject(rocksdbBackup.listBackups));
+	opFuncMap.set(
+		terms.OPERATIONS_ENUM.VERIFY_BACKUP,
+		new OperationFunctionObject(executeJob, rocksdbBackup.verifyBackup)
+	);
+	opFuncMap.set(terms.OPERATIONS_ENUM.DELETE_BACKUP, new OperationFunctionObject(rocksdbBackup.deleteBackup));
+	opFuncMap.set(terms.OPERATIONS_ENUM.PURGE_BACKUPS, new OperationFunctionObject(rocksdbBackup.purgeBackups));
+	opFuncMap.set(
+		terms.OPERATIONS_ENUM.RESTORE_BACKUP,
+		new OperationFunctionObject(executeJob, rocksdbBackup.restoreBackup)
+	);
 	opFuncMap.set(terms.OPERATIONS_ENUM.CLEANUP_ORPHAN_BLOBS, new OperationFunctionObject(schema.cleanupOrphanBlobs));
 
 	opFuncMap.set(terms.OPERATIONS_ENUM.GET_ANALYTICS, new OperationFunctionObject(analytics.getOp));

package/server/static.ts

@@ -1,5 +1,5 @@
 import { realpathSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { Scope } from '../components/Scope';
 import { resolveBaseURLPath } from '../components/resolveBaseURLPath.ts';
 import { convertToMS } from '../utility/common_utils.ts';
@@ -52,7 +52,7 @@ import send from 'send';
  *
  * This plugin dynamically updates its behavior based on the current configuration file. Users can make updates and immediately see the changes reflect in the next request.
  *
- * Updates to the `files` option will clear the in-memory maps and allow them to regenerate based on the new configuration (since the default EntryHandler will regenerate anyways).
+ * Updates to the `files` option incrementally add newly matched paths and remove paths that no longer match while preserving common entries.
  * Updates to `urlPath` request a restart: the HTTP route mount is registered once at load and cannot be re-registered on a live server (#1583).
  */
 /**
@@ -146,12 +146,52 @@ export function handleApplication(scope: Scope) {
 	// in-memory map of static files
 	// keys are the URL paths relative to the mount base, values are the absolute paths to the files
 	const staticFiles = new Map<string, string>();
-	const indexEntries = new Map<string, string>();
+	const indexEntries = new Map<string, string | null>();
+	const staticFileOwners = new Map<string, Map<string, string>>();
+	const indexEntryOwners = new Map<string, Map<string, string | null>>();
+
+	function setOwnedPath<Path>(
+		paths: Map<string, Path>,
+		ownersByURL: Map<string, Map<string, Path>>,
+		urlPath: string,
+		owner: string,
+		path: Path
+	) {
+		let owners = ownersByURL.get(urlPath);
+		if (!owners) ownersByURL.set(urlPath, (owners = new Map()));
+		owners.delete(owner);
+		owners.set(owner, path);
+		paths.set(urlPath, path);
+	}
+
+	function removeOwnedPath<Path>(
+		paths: Map<string, Path>,
+		ownersByURL: Map<string, Map<string, Path>>,
+		urlPath: string,
+		owner: string
+	) {
+		const owners = ownersByURL.get(urlPath);
+		if (!owners?.delete(owner)) return;
+		const replacement = [...owners.values()].at(-1);
+		if (replacement === undefined) {
+			ownersByURL.delete(urlPath);
+			paths.delete(urlPath);
+		} else {
+			paths.set(urlPath, replacement);
+		}
+	}
 
 	// The HTTP route below is registered once, with the urlPath in effect at load time; the mount
 	// cannot be re-registered at runtime. Capture the matching base once so map keys always agree
 	// with the registered route (#1583).
 	const baseURLPath = resolveBaseURLPath(scope.pluginName, (scope.options.getAll() as any)?.urlPath);
+	// The same base as the client sees. `baseURLPath` is mount-relative — it must stay that way to
+	// keep agreeing with the entry URL paths the file map is keyed by — but a redirect Location has
+	// to carry the application's mount too, or it would point outside the mount (#1583).
+	const externalBaseURLPath = scope.externalBasePath(baseURLPath);
+	let urlPathRestartPending = false;
+	let fileSelectionChangePending = false;
+	let entryHandler: ReturnType<Scope['handleEntry']>;
 
 	// A bare `before:` / `after:` key in YAML parses as null — treat it as unset, like before this
 	// option was validated.
@@ -183,14 +223,19 @@ export function handleApplication(scope: Scope) {
 
 	scope.options.on('change', (key) => {
 		if (key[0] === 'files') {
-			// If the files option changes, clear the maps and let the entry handler regenerate them
-			staticFiles.clear();
-			indexEntries.clear();
-			scope.logger.info(`Static files reinitialized due to change in ${key.join('.')}`);
+			fileSelectionChangePending = true;
+			const updateReady = entryHandler?.ready;
+			const clearPending = () => {
+				if (entryHandler?.ready === updateReady) fileSelectionChangePending = false;
+			};
+			updateReady?.then(clearPending, clearPending);
+			// EntryHandler updates are incremental: paths no longer matched emit unlink, newly matched
+			// paths emit add, and common unchanged paths remain valid in these maps.
+			scope.logger.info(`Static file matches updated due to change in ${key.join('.')}`);
 			return;
 		}
 		if (key[0] === 'urlPath') {
-			// The route mount cannot be changed on a live server registration — restart to apply
+			urlPathRestartPending = true;
 			scope.requestRestart();
 			return;
 		}
@@ -207,7 +252,12 @@ export function handleApplication(scope: Scope) {
 	});
 
 	// Handle entry events for the default entry handler based on the `files` and `urlPath` options
-	scope.handleEntry((entry) => {
+	entryHandler = scope.handleEntry((entry) => {
+		if (
+			urlPathRestartPending &&
+			(!fileSelectionChangePending || (entry.eventType !== 'unlink' && entry.eventType !== 'unlinkDir'))
+		)
+			return;
 		// entry.urlPath includes the component's base URL path, but when a `urlPath` is configured
 		// the routing chain strips that mount prefix from req.pathname before this plugin's handler
 		// runs — so key the maps relative to the base (#1583)
@@ -218,34 +268,43 @@ export function handleApplication(scope: Scope) {
 		switch (entry.eventType) {
 			// Directories only matter for the `index` files
 			case 'addDir':
-			case 'unlinkDir':
 				// Handle `index.html` for directories for if/when the user enables the `index` option
 				const indexPath = join(entry.absolutePath, 'index.html');
-				if (existsSync(indexPath)) {
-					indexEntries[entry.eventType === 'addDir' ? 'set' : 'delete'](urlPath, indexPath);
-				}
+				if (existsSync(indexPath)) setOwnedPath(indexEntries, indexEntryOwners, urlPath, entry.absolutePath, indexPath);
+				break;
+			case 'unlinkDir':
+				removeOwnedPath(indexEntries, indexEntryOwners, urlPath, entry.absolutePath);
 				break;
 			// Otherwise, user must specify pattern to match individual files
 			case 'add':
 				// Store the file in memory for serving
-				staticFiles.set(urlPath, entry.absolutePath);
+				setOwnedPath(staticFiles, staticFileOwners, urlPath, entry.absolutePath, entry.absolutePath);
 				// If the file is an index.html, also store it in the index entries
 				if (urlPath.endsWith('index.html')) {
 					// Without trailing slash; null -> 301 redirect to trailing slash
 					let lastSlashIndex = urlPath.lastIndexOf('/');
-					indexEntries.set(urlPath.slice(0, lastSlashIndex), null);
+					setOwnedPath(indexEntries, indexEntryOwners, urlPath.slice(0, lastSlashIndex), entry.absolutePath, null);
 					// With trailing slash; serves the index.html file
-					indexEntries.set(urlPath.slice(0, lastSlashIndex + 1), entry.absolutePath);
+					setOwnedPath(
+						indexEntries,
+						indexEntryOwners,
+						urlPath.slice(0, lastSlashIndex + 1),
+						entry.absolutePath,
+						entry.absolutePath
+					);
 				}
 				break;
 			case 'unlink':
-				// Remove the file from memory when it is deleted
-				staticFiles.delete(urlPath);
+				removeOwnedPath(staticFiles, staticFileOwners, urlPath, entry.absolutePath);
 				// If the file is an index.html, remove it from the index entries as well
 				if (urlPath.endsWith('index.html')) {
 					let lastSlashIndex = urlPath.lastIndexOf('/');
-					indexEntries.delete(urlPath.slice(0, lastSlashIndex));
-					indexEntries.delete(urlPath.slice(0, lastSlashIndex + 1));
+					const directoryURLPath = urlPath.slice(0, lastSlashIndex);
+					const directoryOwner = dirname(entry.absolutePath);
+					removeOwnedPath(indexEntries, indexEntryOwners, directoryURLPath, entry.absolutePath);
+					removeOwnedPath(indexEntries, indexEntryOwners, directoryURLPath, directoryOwner);
+					removeOwnedPath(indexEntries, indexEntryOwners, urlPath.slice(0, lastSlashIndex + 1), entry.absolutePath);
+					removeOwnedPath(indexEntries, indexEntryOwners, urlPath.slice(0, lastSlashIndex + 1), directoryOwner);
 				}
 				break;
 		}
@@ -283,7 +342,11 @@ export function handleApplication(scope: Scope) {
 					// redirect the no-slash form so relative links on the index page resolve under
 					// the mount (#1583). Query string is preserved across both redirects; compute it
 					// lazily inside each branch so the common (non-redirect) index serve stays allocation-free.
-					if (staticFile && req.pathname === '/' && baseURLPath !== '/') {
+					// Gated on the EXTERNAL base path, not the plugin-local one: a root-level static
+					// plugin (baseURLPath === '/') still needs this redirect when the application
+					// itself carries a host/urlPath mount, since the client-visible mount root is then
+					// externalBaseURLPath, not '/' (review finding).
+					if (staticFile && req.pathname === '/' && externalBaseURLPath !== '/') {
 						const originalPathname: string | undefined = (req as any).originalPathname;
 						if (originalPathname && !originalPathname.endsWith('/')) {
 							const queryIndex = (req.url as string).indexOf('?');
@@ -291,7 +354,7 @@ export function handleApplication(scope: Scope) {
 							return {
 								status: 301,
 								headers: {
-									Location: baseURLPath + query,
+									Location: externalBaseURLPath + query,
 								},
 							};
 						}
@@ -300,7 +363,8 @@ export function handleApplication(scope: Scope) {
 					// If `null`, redirect to trailing slash. req.pathname arrives with the mount
 					// prefix stripped, so rebuild the external path for the Location header (#1583)
 					if (staticFile === null) {
-						const externalPath = baseURLPath === '/' ? req.pathname : baseURLPath.slice(0, -1) + req.pathname;
+						const externalPath =
+							externalBaseURLPath === '/' ? req.pathname : externalBaseURLPath.slice(0, -1) + req.pathname;
 						const queryIndex = (req.url as string).indexOf('?');
 						const query = queryIndex === -1 ? '' : (req.url as string).slice(queryIndex);
 						return {

package/server/storageReclamation.ts

@@ -1,6 +1,6 @@
-import { readFile } from 'node:fs/promises';
+import { readFile, realpath } from 'node:fs/promises';
 import { statfs } from 'node:fs/promises';
-import { join } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { getWorkerIndex, getWorkerCount } from '../server/threads/manageThreads.js';
 import { logger } from '../utility/logging/logger.ts';
 import { CONFIG_PARAMS } from '../utility/hdbTerms.ts';
@@ -27,6 +27,56 @@ export type QuotaStatusData = {
 	updatedAt: number;
 };
 
+/**
+ * Resolves `target` to its real (symlink-free) path. `target` itself may not exist yet (e.g. a
+ * table's storage directory that hasn't been created), so walk up to the nearest existing
+ * ancestor, resolve that, and rejoin the not-yet-existing remainder lexically — this still
+ * catches a symlinked *parent* directory, which is the case that actually matters for quota
+ * scoping (leaf directories are created by Harper itself, not symlinked).
+ */
+async function resolveRealPath(target: string): Promise<string> {
+	try {
+		return await realpath(target);
+	} catch {
+		const parent = dirname(target);
+		if (parent === target) return resolve(target);
+		return join(await resolveRealPath(parent), basename(target));
+	}
+}
+
+/**
+ * Whether `target` resolves to a path inside `root`. quota-status.json is scoped to a single
+ * ROOTPATH; a database or table configured with its own STORAGE_PATH (or a STORAGE_BLOBPATHS
+ * entry) can live on an entirely different volume, and must not be reported against the root's
+ * quota. Compares real (symlink-resolved) paths, not just lexically-normalized ones — a `..`-free
+ * path can still be a symlink into another volume, and `resolve()` alone wouldn't catch that.
+ */
+async function isPathWithinRoot(root: string, target: string): Promise<boolean> {
+	const [resolvedRoot, resolvedTarget] = await Promise.all([resolveRealPath(root), resolveRealPath(target)]);
+	const relativePath = relative(resolvedRoot, resolvedTarget);
+	if (relativePath === '') return true;
+	if (isAbsolute(relativePath)) return false;
+	// Check the first segment specifically (`..`), not a `..`-prefix match — a child directory
+	// literally named e.g. `..data` (the Kubernetes ConfigMap/Secret atomic-update symlink
+	// convention) is not a parent-traversal and must not be rejected as escaping the root.
+	const firstSegment = relativePath.split(sep)[0];
+	return firstSegment !== '..';
+}
+
+/**
+ * Guards against a syntactically valid but semantically broken quota-status.json (missing or
+ * negative usage, non-positive quota, non-finite timestamp) being read as "100% free" or worse.
+ */
+function isValidQuotaStatus(status: QuotaStatusData): boolean {
+	return (
+		Number.isFinite(status.updatedAt) &&
+		Number.isFinite(status.quotaBytes) &&
+		status.quotaBytes > 0 &&
+		Number.isFinite(status.usedBytes) &&
+		status.usedBytes >= 0
+	);
+}
+
 /**
  * Reads the quota-status.json file written by host-manager.
  * Returns undefined if the file is absent or malformed; does not apply age filtering.
@@ -70,15 +120,61 @@ export function onStorageReclamation(
 }
 let reclamationTimer: NodeJS.Timeout;
 
-// If a fresh quota-status.json exists (written by host-manager every ~90s), use quota-based ratio.
-// Otherwise fall back to statfs for the registered path.
-const defaultGetAvailableSpaceRatio = async (path: string): Promise<number> => {
+export type StorageSpaceStats = {
+	available: number;
+	free: number;
+	size: number;
+	// Whether these numbers reflect a quota (accurate for what Harper can actually write) or
+	// raw filesystem-level statfs (can be wildly wrong under a quota-limited data directory).
+	basis: 'quota' | 'filesystem';
+};
+
+/**
+ * Get available/free/size storage stats for a path, preferring a fresh quota-status.json (see
+ * getQuotaStatus) over statfs. statfs describes the filesystem, which is misleading whenever
+ * the data directory is quota-limited on a larger shared volume (#1976).
+ */
+export async function getStorageSpaceStats(path: string): Promise<StorageSpaceStats> {
+	const rootPath = envMgr.get(CONFIG_PARAMS.ROOTPATH);
 	const status = await getQuotaStatus();
-	if (status?.quotaBytes && Date.now() - status.updatedAt < QUOTA_STATUS_MAX_AGE_MS) {
-		return Math.max(0, status.quotaBytes - status.usedBytes) / status.quotaBytes;
+	const statusAge = status ? Date.now() - status.updatedAt : undefined;
+	if (
+		status &&
+		isValidQuotaStatus(status) &&
+		rootPath &&
+		// A negative age (clock skew, or a corrupt/future updatedAt) is not "fresh" — treat it the
+		// same as stale rather than trusting quota data indefinitely.
+		statusAge >= 0 &&
+		statusAge < QUOTA_STATUS_MAX_AGE_MS &&
+		// Checked last: it's the only async/IO-bound condition, so short-circuit it behind the
+		// cheap synchronous checks above.
+		(await isPathWithinRoot(rootPath, path))
+	) {
+		const available = Math.max(0, status.quotaBytes - status.usedBytes);
+		return { available, free: available, size: status.quotaBytes, basis: 'quota' };
 	}
 	const fsStats = await statfs(path);
-	return fsStats.bavail / fsStats.blocks;
+	return {
+		available: fsStats.bavail * fsStats.bsize,
+		free: fsStats.bfree * fsStats.bsize,
+		size: fsStats.blocks * fsStats.bsize,
+		basis: 'filesystem',
+	};
+}
+
+/**
+ * Ratio of available to total size, guarding the 0/0 = NaN case (a zero-size statfs/quota result,
+ * e.g. an empty or misconfigured mount) so a full disk still reports a ratio of 0 rather than NaN.
+ */
+export function computeAvailableRatio(available: number, size: number): number {
+	return size > 0 ? available / size : 0;
+}
+
+// If a fresh quota-status.json exists (written by host-manager every ~90s), use quota-based ratio.
+// Otherwise fall back to statfs for the registered path.
+const defaultGetAvailableSpaceRatio = async (path: string): Promise<number> => {
+	const { available, size } = await getStorageSpaceStats(path);
+	return computeAvailableRatio(available, size);
 };
 let getAvailableSpaceRatio: (path: string) => Promise<number> = defaultGetAvailableSpaceRatio;
 

package/server/threads/socketRouter.ts

@@ -8,6 +8,12 @@ import { join } from 'path';
 
 const workers = [];
 const workersReady = [];
+// startHTTPThreads() can be called more than once in-process (e.g. a test harness adding more
+// worker threads to an already-running server via addThreads()). The crash-path sweep below must
+// run only on the very first call — a later call happens after real mirrors are already bound, and
+// sweeping the sockets directory then would delete their live files, reintroducing the exact outage
+// this guards against.
+let sweptSocketsDirectory = false;
 
 if (isMainThread) {
 	process.on('uncaughtException', (error) => {
@@ -23,6 +29,20 @@ if (isMainThread) {
 }
 
 export async function startHTTPThreads(threadCount = 2, dynamicThreads?: boolean) {
+	// Crash-path defense: a hard crash can skip a worker's exit-time UDS cleanup and leave stale
+	// mirror files behind. This runs before any worker below can start (and thus before any mirror
+	// can bind), so it can only ever clear files nothing is using yet — never a live mirror. The
+	// inode ownership guard in cleanupUdsFiles()/markUdsBindFailed() (see http.ts) is the matching
+	// defense for the in-process rolling-restart case, which this sweep does not cover.
+	// Lazy dynamic import (not a top-level one), matching server/status/index.ts's own lazy import of
+	// http.ts: http.ts's module graph reaches security/auth.ts, whose module-scope table() call needs
+	// config already initialized — pulling that graph in at this file's own top level (which
+	// bin/run.ts imports before parsing argv / initializing config) breaks startup with "Unable to
+	// determine database storage path" before main() ever runs.
+	if (isMainThread && !sweptSocketsDirectory) {
+		sweptSocketsDirectory = true;
+		(await import('../http.ts')).cleanupSocketsDirectory();
+	}
 	recordHostname().catch((err) => harperLogger.error?.('Error recording hostname for analytics:', err));
 	// Drive transaction-log cooling from the main thread (the registry is a
 	// process-global singleton; see startTransactionLogCooling). Runs for all

package/server/threads/threadServer.js

@@ -275,6 +275,11 @@ function listenOnDomainSocket(port, server) {
 		}
 		function onListening() {
 			server.removeListener('error', onError);
+			// Record ownership of the inode we just bound, so cleanupUdsFiles()/markUdsBindFailed()
+			// (see http.ts) can tell this worker's own file apart from a replacement's later rebind
+			// at the same path (see registerUdsCleanupPaths). A no-op for domain sockets that aren't
+			// UDS mirrors (e.g. the operations API's primary socket), which were never registered.
+			httpComponent.recordUdsBindSuccess(port);
 			harperLogger.info('Domain socket listening on ' + port);
 			resolve({ port, name: server.name, protocol_name: server.protocol_name });
 		}
@@ -387,6 +392,9 @@ function listenOnPorts() {
 							callback?.();
 						},
 					};
+					// createUwsServer() only resolves once uWS's own listen_unix() confirms the bind, so
+					// ownership is confirmed now (see http.ts's ownership-aware cleanupUdsFiles()).
+					if (cfg.socketPath) httpComponent.recordUdsBindSuccess(cfg.socketPath);
 					harperLogger.info('uWS listening on ' + (cfg.socketPath ?? cfg.port));
 					return { port: key };
 				})
@@ -517,6 +525,9 @@ async function listenOnPortsBun() {
 				});
 				SERVERS[udsPath] = udsServer;
 				httpComponent.registerUdsCleanupPaths(udsPath, yamlPath);
+				// Bun.serve() above already succeeded (a bind failure throws synchronously into the
+				// surrounding catch), so this worker's ownership of udsPath is confirmed now.
+				httpComponent.recordUdsBindSuccess(udsPath);
 
 				const writeMetadata = () => httpComponent.writeUdsMetadata(yamlPath, port, config.pseudoServer);
 				config.tlsSelector.ready.then(writeMetadata);

package/sqlTranslator/index.ts

@@ -17,6 +17,7 @@ import * as terms from '../utility/hdbTerms.ts';
 import { handleHDBError } from '../utility/errors/hdbError.ts';
 import { HTTP_STATUS_CODES } from '../utility/errors/commonErrors.ts';
 import * as sqlEngineRouter from '../sqlEngine/router.ts';
+import { isOperationAuthorizationBypassed } from '../server/serverHelpers/operationAuthorizationState.ts';
 
 //here we call to define and import custom functions to alasql
 alasqlFunctionImporter(alasql);
@@ -129,7 +130,11 @@ export function processAST(jsonMessage: any, parsedSqlObject: any, callback: any
 	try {
 		let sqlFunction = nullFunction;
 
-		if (!jsonMessage.bypass_auth && !parsedSqlObject.permissions_checked) {
+		// Trusted bypass is dispatch/async-context state (set by chooseOperation's caller via
+		// runWithOperationAuthorizationBypass), never body state — jsonMessage.bypass_auth is
+		// caller-controlled and is stripped before operation code sees it (see
+		// server/serverHelpers/serverHandlers.js and components/mcp/tools/operations.ts).
+		if (!isOperationAuthorizationBypassed() && !parsedSqlObject.permissions_checked) {
 			let permissionsCheck = checkASTPermissions(jsonMessage, parsedSqlObject);
 			if (permissionsCheck && permissionsCheck.length > 0) {
 				return callback(UNAUTHORIZED_RESPONSE, permissionsCheck);

package/static/defaultConfig.yaml

@@ -72,8 +72,11 @@ storage:
   writeAsync: false
   caching: true
   compression: true
+  rocks:
+    compression: null
   noReadAhead: false
   path: null
+  backupPath: null
   prefetchWrites: true
 tls:
   privateKey: null