@loicngr/kobo 1.11.16 → 1.11.17

package/dist/server/services/agent/session-controller.js

@@ -6,6 +6,22 @@ export class SessionController {
     _engineProcess;
     _startPromise;
     _status = 'running';
+    /**
+     * Wall-clock creation time. The watchdog needs it: `engineProcess` stays
+     * undefined until `engine.start` resolves, and without a grace window any
+     * engine whose start becomes blocking would see every fresh session
+     * declared dead on the first sweep.
+     */
+    startedAt = Date.now();
+    /**
+     * Wall-clock time of the last event this controller relayed. Serialized to
+     * the client so a stalled agent is visible as "last event 22 min ago"
+     * instead of an indefinite "the agent is busy".
+     */
+    _lastEventAt = Date.now();
+    get lastEventAt() {
+        return this._lastEventAt;
+    }
     get engineProcess() {
         return this._engineProcess;
     }
@@ -48,6 +64,16 @@ export class SessionController {
     }
     async stop() {
         this._status = 'stopping';
+        // `startEngine` may still be in flight: `_engineProcess` stays undefined
+        // until `engine.start` resolves, so without this wait `stop()` would
+        // resolve instantly while the engine keeps spinning up in the
+        // background — the caller (e.g. worktree removal) would then race ahead
+        // of a process that hasn't even started yet. `startEngine` itself
+        // already stops the process it just got if it sees `_status ===
+        // 'stopping'`, so waiting here is enough; a failed start must not fail
+        // the stop, hence the swallowed rejection.
+        if (this._startPromise)
+            await this._startPromise.catch(() => { });
         if (this._engineProcess)
             await this._engineProcess.stop();
     }
@@ -61,6 +87,7 @@ export class SessionController {
         return this._engineProcess?.engineSessionId;
     }
     handle(ev) {
+        this._lastEventAt = Date.now();
         this.onEvent(ev);
     }
 }

package/dist/server/services/agent/{engines/codex/turn-liveness.js → turn-liveness.js}

@@ -1,6 +1,10 @@
 /**
- * Tracks a single active Codex turn. A pending user decision deliberately
- * pauses the deadline: the agent is waiting on a human, not stalled.
+ * Tracks a single active agent turn. Shared by every engine (D2): one module,
+ * armed BEFORE the handshake, re-armed on ANY event, paused while a human
+ * decision is pending, stopped in the cleanup block.
+ *
+ * A pending user decision deliberately pauses the deadline: the agent is
+ * waiting on a human, not stalled.
  */
 export function createTurnLiveness(input) {
     let timer;

package/dist/server/services/change-source-branch-service.js

@@ -2,6 +2,7 @@
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as gitOps from '../utils/git-ops.js';
+import { withGitRepoLock } from '../utils/git-repo-lock.js';
 import { getAgentStatus } from './agent/orchestrator.js';
 import { getForgeProvider } from './forge/registry.js';
 import { resolveForge } from './forge/resolve.js';
@@ -9,8 +10,33 @@ import { getEffectiveSettings } from './settings-service.js';
 import { getWorkspace, updateWorkspaceSourceBranch } from './workspace-service.js';
 /** Above this many proper commits, refuse and ask for a manual rebase. */
 export const MAX_PROPER_COMMITS = 50;
+/** Label written by `stashPush` and read back by `stashPop` — see F27. */
+const STASH_LABEL = 'kobo-change-source-branch';
 /** Wall-clock limit on the custom change-source-branch script. */
 const SCRIPT_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Rotate the backup branches, best-effort. Called on EVERY exit path that has
+ * already created one — a conflict is precisely the case that repeats, and
+ * rotating only on full success let the failure scenario grow without bound.
+ * Returns the warnings so a caller can surface them instead of burying them in
+ * the server log; never throws, since the outcome being returned (or the error
+ * being rethrown) always matters more than the housekeeping.
+ */
+function rotateBackupBranches(worktreePath, workingBranch) {
+    try {
+        const { warnings } = gitOps.pruneBackupBranches(worktreePath, workingBranch, BACKUP_BRANCHES_KEPT);
+        for (const warning of warnings)
+            console.warn(`[change-source-branch] ${warning}`);
+        return warnings;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(`[change-source-branch] backup rotation failed: ${message}`);
+        return [`Backup branch rotation failed: ${message}`];
+    }
+}
+/** Three kept means two levels of fallback beyond the branch just created. */
+const BACKUP_BRANCHES_KEPT = 3;
 /**
  * Re-target a workspace onto `newBase`: reconstruct its working branch via
  * cherry-pick of its proper commits, update the `source_branch` metadata, and
@@ -30,12 +56,53 @@ export async function changeSourceBranch(workspaceId, newBase) {
         throw new Error('New source branch is required');
     if (trimmedNew === oldBase)
         throw new Error(`The source branch is already '${oldBase}'`);
+    const worktreePath = workspace.worktreePath;
+    const workingBranch = workspace.workingBranch;
     const effective = getEffectiveSettings(workspace.projectPath);
-    if (effective.changeSourceBranchScript && effective.changeSourceBranchScript.trim().length > 0) {
+    const customScript = effective.changeSourceBranchScript?.trim() ?? '';
+    if (customScript.length > 0) {
+        // Un script personnalisé remplace la STRATEGIE, jamais les GARANTIES.
+        // Le script par défaut fait `git reset --hard`, qui détruit sans recours
+        // le travail non commité et les fichiers non suivis. Le chemin intégré
+        // sait mettre de côté puis restaurer quand la branche est alignée ; un
+        // script arbitraire étant une boîte noire, on ne peut pas le supposer —
+        // donc tout worktree sale est refusé ici, sans exception.
+        // Fail-closed: `worktreeHasChanges` swallows any git failure and reports
+        // "clean" (see its doc comment), which is exactly wrong on a destructive
+        // path — an unknown state must never be read as "safe to reset --hard".
+        // `worktreeHasChangesStrict` lets the error through instead, and here we
+        // treat that failure the same as "dirty": refuse rather than guess.
+        let dirty;
+        try {
+            dirty = gitOps.worktreeHasChangesStrict(worktreePath);
+        }
+        catch (err) {
+            console.error('[change-source-branch] could not determine worktree state, refusing as a precaution:', err);
+            dirty = true;
+        }
+        if (dirty) {
+            return { status: 'dirty', forcePushNeeded: false, commitCount: 0 };
+        }
+        // A stale index.lock makes every git write fail half-way through, and the
+        // raw git message tells the user nothing. Typical origin: a setup/cleanup
+        // script SIGKILLed at its timeout during a commit. The custom-script path
+        // does not go through the repository lock, so the check is immediate here.
+        gitOps.assertNoIndexLock(worktreePath);
         return runCustomScript(workspace, oldBase, trimmedNew, effective.changeSourceBranchScript);
     }
-    const worktreePath = workspace.worktreePath;
-    const workingBranch = workspace.workingBranch;
+    // The whole built-in strategy runs under the repository lock: it fetches,
+    // resets and cherry-picks, all of which touch the COMMON git dir shared by
+    // every worktree of the project. A concurrent fetch from the PR watcher
+    // during the cherry-pick leaves it aborted mid-way.
+    return withGitRepoLock(worktreePath, () => runBuiltInStrategy(workspaceId, worktreePath, workingBranch, workspace.projectPath, oldBase, trimmedNew));
+}
+/** The built-in cherry-pick strategy. Always called under the repository lock. */
+async function runBuiltInStrategy(workspaceId, worktreePath, workingBranch, projectPath, oldBase, trimmedNew) {
+    // Index-lock guard FIRST, and here rather than at the entry point: the
+    // repository lock above may have queued us for a while, so a check made at
+    // request time describes a state that no longer holds — it would miss a lock
+    // taken since, or report one that has been released in the meantime.
+    gitOps.assertNoIndexLock(worktreePath);
     // Fetch every branch so all `origin/*` refs are current: the proper-commit
     // computation and the `reset --hard` target both depend on fresh refs.
     // Best-effort — offline still lets us proceed with whatever is local, and
@@ -56,13 +123,25 @@ export async function changeSourceBranch(workspaceId, newBase) {
         return { status: 'too-many', forcePushNeeded, commitCount: commits.length };
     }
     const isAligned = commits.length === 0;
-    const dirty = gitOps.worktreeHasChanges(worktreePath);
+    // Fail-closed, same rule as the custom-script path above: an indeterminate
+    // worktree state must never be read as "nothing to lose". Refuse right
+    // here, before either branch below — in particular before the
+    // `isAligned && dirty` stash path, since stashing a state we could not
+    // inspect would be worse than refusing outright.
+    let dirty;
+    try {
+        dirty = gitOps.worktreeHasChangesStrict(worktreePath);
+    }
+    catch (err) {
+        console.error('[change-source-branch] could not determine worktree state, refusing as a precaution:', err);
+        return { status: 'dirty', forcePushNeeded, commitCount: commits.length };
+    }
     if (!isAligned && dirty) {
         return { status: 'dirty', forcePushNeeded, commitCount: commits.length };
     }
     const stashed = isAligned && dirty;
     if (stashed)
-        gitOps.stashPush(worktreePath, 'kobo-change-source-branch');
+        gitOps.stashPush(worktreePath, STASH_LABEL);
     try {
         gitOps.reconstructBranchOnto(worktreePath, workingBranch, trimmedNew, commits);
     }
@@ -73,7 +152,12 @@ export async function changeSourceBranch(workspaceId, newBase) {
             // or abort. `stashed` is always false here — a conflict needs commits,
             // the stash path is aligned-only — so no stash is stranded.
             updateWorkspaceSourceBranch(workspaceId, trimmedNew);
-            return { status: 'conflict', forcePushNeeded, commitCount: commits.length };
+            return {
+                status: 'conflict',
+                forcePushNeeded,
+                commitCount: commits.length,
+                warnings: emptyToUndefined(rotateBackupBranches(worktreePath, workingBranch)),
+            };
         }
         // Non-conflict failure (e.g. the `reset --hard` itself failed) — best
         // effort restore of the stash before letting the error propagate, same
@@ -81,12 +165,16 @@ export async function changeSourceBranch(workspaceId, newBase) {
         // work on an unrelated failure.
         if (stashed) {
             try {
-                gitOps.stashPop(worktreePath);
+                gitOps.stashPop(worktreePath, STASH_LABEL);
             }
             catch {
                 /* best-effort — the original error is more relevant than this one */
             }
         }
+        // The backup branch is created first, so it exists even when the reset that
+        // follows blew up. Rotate before rethrowing; its own warnings can only be
+        // logged here, the error is what reaches the caller.
+        rotateBackupBranches(worktreePath, workingBranch);
         throw err;
     }
     // The reset/reconstruct already landed on disk at this point. Update the
@@ -97,14 +185,19 @@ export async function changeSourceBranch(workspaceId, newBase) {
     updateWorkspaceSourceBranch(workspaceId, trimmedNew);
     if (stashed) {
         try {
-            gitOps.stashPop(worktreePath);
+            gitOps.stashPop(worktreePath, STASH_LABEL);
         }
         catch {
-            return { status: 'conflict', forcePushNeeded, commitCount: commits.length };
+            return {
+                status: 'conflict',
+                forcePushNeeded,
+                commitCount: commits.length,
+                warnings: emptyToUndefined(rotateBackupBranches(worktreePath, workingBranch)),
+            };
         }
     }
     try {
-        const provider = getForgeProvider(resolveForge(workspace.projectPath));
+        const provider = getForgeProvider(resolveForge(projectPath));
         if (provider.capabilities.canChangePrBase) {
             const pr = await provider.getPrStatus(worktreePath, workingBranch);
             if (pr)
@@ -114,7 +207,18 @@ export async function changeSourceBranch(workspaceId, newBase) {
     catch (err) {
         console.error('[change-source-branch] PR base update failed (non-fatal):', err);
     }
-    return { status: isAligned ? 'aligned' : 'done', forcePushNeeded, commitCount: commits.length };
+    // Each backup pins a whole previous history and git can never reclaim it.
+    const warnings = rotateBackupBranches(worktreePath, workingBranch);
+    return {
+        status: isAligned ? 'aligned' : 'done',
+        forcePushNeeded,
+        commitCount: commits.length,
+        warnings: emptyToUndefined(warnings),
+    };
+}
+/** Keep `warnings` out of the JSON response entirely when there is nothing to say. */
+function emptyToUndefined(warnings) {
+    return warnings.length > 0 ? warnings : undefined;
 }
 /** Spawn the script with `bash -c`, return the standard result on exit 0, throw on non-zero. */
 async function runCustomScript(workspace, oldBase, newBase, script) {

package/dist/server/services/db-backup-service.js

@@ -8,12 +8,12 @@ let backupSequence = 0;
 export function _resetBackupSequenceForTests() {
     backupSequence = 0;
 }
-function listBackups(dir) {
+function listBackups(dir, prefix = BACKUP_PREFIX) {
     if (!fs.existsSync(dir))
         return [];
     return fs
         .readdirSync(dir)
-        .filter((f) => f.startsWith(BACKUP_PREFIX))
+        .filter((f) => f.startsWith(prefix))
         .map((f) => {
         const full = path.join(dir, f);
         const stat = fs.statSync(full);
@@ -21,6 +21,23 @@ function listBackups(dir) {
     })
         .sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
+/** Delete every backup of `prefix` beyond the `keepCount` most recent. */
+function rotateBackups(dir, prefix, keepCount) {
+    const deleted = [];
+    const all = listBackups(dir, prefix);
+    if (all.length <= keepCount)
+        return deleted;
+    for (const entry of all.slice(keepCount)) {
+        try {
+            fs.unlinkSync(entry.path);
+            deleted.push(entry.path);
+        }
+        catch (err) {
+            console.error(`[kobo] Failed to delete old DB backup ${entry.path}:`, err);
+        }
+    }
+    return deleted;
+}
 /**
  * Create a WAL-safe snapshot of the Kōbō DB if no backup has been made in the
  * last 24h. Rotates old backups, keeping only the `keepCount` most recent.
@@ -46,18 +63,7 @@ export async function createDailyDbBackupIfNeeded(db, dbPath, keepCount = DEFAUL
         const backupPath = path.join(dir, `${BACKUP_PREFIX}${stamp}-${backupSequence}`);
         await db.backup(backupPath);
         result.created = backupPath;
-        const all = listBackups(dir);
-        if (all.length > keepCount) {
-            for (const entry of all.slice(keepCount)) {
-                try {
-                    fs.unlinkSync(entry.path);
-                    result.deleted.push(entry.path);
-                }
-                catch (err) {
-                    console.error(`[kobo] Failed to delete old DB backup ${entry.path}:`, err);
-                }
-            }
-        }
+        result.deleted.push(...rotateBackups(dir, BACKUP_PREFIX, keepCount));
     }
     catch (err) {
         console.error('[kobo] DB daily backup failed:', err);
@@ -65,14 +71,19 @@ export async function createDailyDbBackupIfNeeded(db, dbPath, keepCount = DEFAUL
     return result;
 }
 const PREMIGRATION_PREFIX = 'kobo.db.premigration-';
-export async function createPreMigrationBackup(db, dbPath, tag) {
+/** Backups of this prefix kept. One full-size copy was added per shipped
+ *  migration — of schema AND of settings — and nothing ever removed them. */
+const DEFAULT_PREMIGRATION_KEEP = 5;
+export async function createPreMigrationBackup(db, dbPath, tag, keepCount = DEFAULT_PREMIGRATION_KEEP) {
     const dir = path.dirname(dbPath);
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
     backupSequence += 1;
     const backupPath = path.join(dir, `${PREMIGRATION_PREFIX}${tag}-${stamp}-${backupSequence}`);
     try {
         await db.backup(backupPath);
-        return { created: backupPath, deleted: [] };
+        // Rotation is scoped to the pre-migration prefix: the daily backups are a
+        // separate net with its own retention and must never be touched here.
+        return { created: backupPath, deleted: rotateBackups(dir, PREMIGRATION_PREFIX, keepCount) };
     }
     catch (err) {
         console.error('[kobo] Pre-migration backup failed:', err);

package/dist/server/services/pr-watcher-service.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import { fetchSourceBranchAsync, isGitWorktree } from '../utils/git-ops.js';
+import { withGitRepoLock } from '../utils/git-repo-lock.js';
 import { stopDevServer } from './dev-server-service.js';
 import { getForgeProvider } from './forge/registry.js';
 import { resolveForge } from './forge/resolve.js';
@@ -162,7 +163,13 @@ export async function checkPrStatuses() {
             // logic below. Its own try/catch so a git failure neither skips PR
             // transitions nor poisons other workspaces.
             try {
-                void fetchSourceBranchAsync(ws.worktreePath, ws.sourceBranch).catch(() => { });
+                // AWAITED, and serialised on the repository's common git dir: remote
+                // refs live there, shared by every worktree of the project. Firing this
+                // without awaiting made the stats below read the refs from BEFORE the
+                // fetch, so ahead/behind counters were always one tick stale; firing it
+                // concurrently across four worktrees made them fight over the same file
+                // lock, with the error swallowed.
+                await withGitRepoLock(ws.worktreePath, () => fetchSourceBranchAsync(ws.worktreePath, ws.sourceBranch));
                 lastKnownGitStats.set(ws.id, await computeGitStats(ws, pr));
             }
             catch (err) {
@@ -219,7 +226,15 @@ export async function checkPrStatuses() {
                     try {
                         const { autoPurgeOnPrMerged } = getGlobalSettings();
                         if (autoPurgeOnPrMerged) {
-                            void purgeWorktree(ws.id).catch((err) => {
+                            void purgeWorktree(ws.id)
+                                .then((result) => {
+                                // Auto-purge runs with nobody watching: without this trace an
+                                // outcome of 'removal-failed' left no record anywhere.
+                                if (result.outcome !== 'purged') {
+                                    console.warn(`[pr-watcher] auto-purge for '${ws.name}' ended as '${result.outcome}':`, result.warnings.join('\n') || '(no warning)');
+                                }
+                            })
+                                .catch((err) => {
                                 console.error(`[pr-watcher] auto-purge failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                             });
                         }

package/dist/server/services/settings-service.js

@@ -832,6 +832,27 @@ const settingsMigrations = [
             global.whipVolume = normalizeWhipVolume(global.whipVolume);
         },
     },
+    {
+        version: 54,
+        name: 'add-ws-events-retention',
+        migrate: ({ global }) => {
+            // Seeded DISABLED (0), on fresh installs as well as migrated ones. This
+            // feature permanently deletes conversation history, so it is opt-in: a
+            // silent loss of history is worse than a growing file. A window the user
+            // already chose survives untouched; only a negative or non-integer value
+            // falls back to 0.
+            if (typeof global.wsEventsRetentionDays !== 'number' ||
+                !Number.isInteger(global.wsEventsRetentionDays) ||
+                global.wsEventsRetentionDays < 0) {
+                global.wsEventsRetentionDays = 0;
+            }
+            if (typeof global.wsEventsKeepPerWorkspace !== 'number' ||
+                !Number.isInteger(global.wsEventsKeepPerWorkspace) ||
+                global.wsEventsKeepPerWorkspace < 0) {
+                global.wsEventsKeepPerWorkspace = 0;
+            }
+        },
+    },
 ];
 /** Current settings schema version — always equals the highest migration version. */
 export const SETTINGS_SCHEMA_VERSION = settingsMigrations.length > 0 ? settingsMigrations[settingsMigrations.length - 1].version : 0;
@@ -879,6 +900,8 @@ function defaultSettings() {
             terminalCommand: '',
             autoPurgeOnPrMerged: false,
             autoLoopMaxRetries: 5,
+            wsEventsRetentionDays: 0,
+            wsEventsKeepPerWorkspace: 0,
             networkAccessEnabled: false,
             networkAccessToken: '',
             networkAccessBehindProxy: false,
@@ -1270,6 +1293,20 @@ export function updateGlobalSettings(data) {
             delete data.autoLoopMaxRetries;
         }
     }
+    // Same shape as the autoLoopMaxRetries guard above: an invalid value is
+    // dropped so the stored one survives. Retention deletes history — a bad write
+    // here would delete more than the user ever asked for. `0` is NOT invalid:
+    // it is the default, and it means "never delete anything".
+    for (const key of ['wsEventsRetentionDays', 'wsEventsKeepPerWorkspace']) {
+        if (key in data) {
+            const value = data[key];
+            const max = key === 'wsEventsRetentionDays' ? 3650 : 1_000_000;
+            if (typeof value !== 'number' || !Number.isInteger(value) || value < 0 || value > max) {
+                console.warn(`[settings] Invalid ${key} value rejected: ${value}`);
+                delete data[key];
+            }
+        }
+    }
     const allowedGlobalKeys = [
         'defaultModelByEngine',
         'dangerouslySkipPermissions',
@@ -1291,6 +1328,8 @@ export function updateGlobalSettings(data) {
         'terminalCommand',
         'autoPurgeOnPrMerged',
         'autoLoopMaxRetries',
+        'wsEventsRetentionDays',
+        'wsEventsKeepPerWorkspace',
         'browserNotifications',
         'audioNotifications',
         'audioQuestionNotifications',