@loicngr/kobo 1.11.36 → 1.11.37

package/AGENTS.md

@@ -239,6 +239,8 @@ Each event maps to one effective-settings key (`sessionEndedScript` / `prMergedS
 
 ### Engine comparison
 
+Successful paired creation opens the existing `split` route with `left` and `right` workspace ids in creation order. A single successful creation keeps the normal workspace route, including when the second creation fails.
+
 One task, two engines, two sibling worktrees. `POST /api/workspaces` accepts a `comparisonId`; the client posts twice with the same one (sequentially — parallel creations contend on the git index lock), suffixing the name with the engine's display name and the branch with the engine id and giving the non-configured engine the model picked for it on the form and its own effort / permission defaults. `workspaces.comparison_id` (migration v40) groups them; `listComparisonMembers` reads them back, treating an empty id as no group rather than as a match against the NULL majority. `GET /api/workspaces/:id/comparison` returns each member with its cached git stats (`null`, never zeros, when nothing has been measured). `ComparisonPanel.vue` renders the table at the top of the Git tab, only for workspaces that belong to a comparison. See [CONFIGURATION.md → Comparing two engines on one task](CONFIGURATION.md#comparing-two-engines-on-one-task).
 
 ### Unanswered question reminder
@@ -384,3 +386,16 @@ deviate from the documented system without explicit user approval.
 - Don't skip `try/catch` swallowing on best-effort cleanup (agent stop, dev-server stop, worktree removal). These must never break the primary operation.
 - Don't hardcode user-visible text in the frontend. Every string must go through `$t()` / `t()` with keys in all 5 locale files. See [Internationalization (i18n)](#internationalization-i18n).
 - Don't hardcode hex colors, spacing literals, or font names in components. Use the CSS variables from `src/client/src/css/design-tokens.scss` and the patterns in `DESIGN.md`. See [Design System](#design-system).
+
+
+## Audit remediation contracts (September 2026)
+
+- `stopAgentAndWait` returns `stopped | not-running | timeout | failed`. Destructive callers must pass its result through `assertAgentStopped`. A timeout or failure retains the same controller in `stopping` until actual stop completion; it never authorizes a replacement or worktree removal. Pending replacements remain cancellable and are finalized as `killed` when stopped before starting. Dev-server shutdown retains ownership of the entire process group until no live member remains, including when the shell exits first; process inspection failures propagate to destructive callers. A successful custom stop can override a failed generic Docker shutdown only after an independent successful query confirms no running containers with the exact project label.
+- Acquire `withWorkspaceLifecycleGuard` before `withGitRepoLock`. Agent/dev-server starts check lifecycle ownership centrally. Wakeups and cron defer while busy; auto-loop waiters are reconsidered on guard release and confirmed capacity release. A user stop persistently disables auto-loop, including while waiting for capacity without a controller. Internal stops explicitly pass `replacement`, `setup`, `archive` or `shutdown` to preserve that intent; delete and purge retain their dedicated causes.
+- Quota-backoff `arm` receives the authoritative next `retryCount` from the orchestrator. Persist that value directly; consuming the preceding timer row must not reset the retry sequence.
+- A quota retry with a residual controller awaits a confirmed technical stop before starting another iteration. Persist recovery before that await and retain its attempt count if the stop remains unconfirmed. Shutdown suspends quota, wakeup and cron timers without consuming their rows; late arms stay persisted but do not deliver until boot restores the schedulers. Automatic continuations also check shutdown when deferred lifecycle callbacks run, preserving auto-loop intent instead of treating a refused start as an error.
+- Codex uses a 120-second stream-idle deadline and a bounded 30-minute deadline while normalized foreground tool calls remain unresolved. Synthetic `TodoWrite` calls emitted for completed plans must have matching results so they do not keep the tool deadline active. Human-input pauses remain independent of the tool timeout.
+- Codex explicit stop confirms `exit` after each escalation, including `SIGKILL`; an unconfirmed exit rejects the stop instead of authorizing destructive follow-up. Exit listeners and deadlines are removed when that wait settles.
+- Conversation loading indicators follow outstanding session/history/sync requests only while no content is available. Background refreshes must preserve the displayed conversation, component state and reading position, including feeds containing only user messages.
+- PR diagnosis fingerprints are asynchronous and include binary staged/unstaged diffs and untracked file contents (symlink targets, not their destinations). Untracked nested Git repositories are fingerprinted recursively, including HEAD and index changes; ignored files and Git internals are excluded. Await them at every callsite. Workspace matching always includes normalized project identity.
+- Daily DB backups are checked at startup and hourly, with the existing 24-hour minimum age and retention. Stop the scheduler and await its active backup before closing SQLite.

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.37
+
+- fix(kobo): harden workspace lifecycle and comparison navigation
+
 ## 1.11.36
 
 - fix(agent): resume quota waits and scheduled background checks

package/dist/server/index.js

@@ -29,12 +29,12 @@ import usageRoutes from './routes/usage.js';
 import voiceRouter from './routes/voice.js';
 import workspaceTemplatesRouter from './routes/workspace-templates.js';
 import workspacesRouter from './routes/workspaces.js';
-import { getAvailableSkills, isAgentUnavailableError, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
+import { getAvailableSkills, isAgentUnavailableError, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgentAndWait, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
 import * as autoLoopService from './services/auto-loop-service.js';
 import { startAwaitingUserReminder, stopAwaitingUserReminder } from './services/awaiting-user-reminder-service.js';
 import { runContentMigrationIfNeeded } from './services/content-migration-service.js';
 import * as cronService from './services/cron-service.js';
-import { createDailyDbBackupIfNeeded, createPreMigrationBackup } from './services/db-backup-service.js';
+import { createDailyDbBackupIfNeeded, createPreMigrationBackup, startDailyDbBackupScheduler, } from './services/db-backup-service.js';
 import { startDevServer, stopAllDevServers, stopDevServer } from './services/dev-server-service.js';
 import { authorizeWsUpgrade, generateToken, getLanHostnames, getLanUrls, isAllowedOrigin, isAllowedRequestHost, resolveBindHost, resolveDevClientOrigin, resolveNetworkAccessEnvOverrides, resolveProxyHostname, } from './services/network-access-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
@@ -101,23 +101,11 @@ runRetentionPass('at boot');
 const RETENTION_INTERVAL_MS = 24 * 60 * 60 * 1000;
 const retentionTimer = setInterval(() => runRetentionPass('daily'), RETENTION_INTERVAL_MS);
 retentionTimer.unref?.();
-// Daily DB backup (best-effort, fire-and-forget — never blocks boot).
-// Creates a WAL-safe snapshot alongside kobo.db if no backup exists in the
-// last 24h, and rotates out older backups beyond the retention window.
-void createDailyDbBackupIfNeeded(db, getDbPath())
-    .then((r) => {
-    if (r.created) {
-        startupDebug(`[kobo] Daily DB backup: ${r.created}`);
-        if (r.deleted.length > 0) {
-            startupDebug(`[kobo] Rotated ${r.deleted.length} old DB backup(s)`);
-        }
-    }
-})
-    .catch((err) => {
-    // A full disk or an unwritable backup directory must not stop the server
-    // from booting: without this catch the rejection reaches the last-resort
-    // handler below and Kōbō exits before it ever listens.
-    console.error('[kobo] Daily DB backup failed (continuing):', err);
+// Check on boot and hourly so servers running longer than a day keep backing up.
+const dailyBackupScheduler = startDailyDbBackupScheduler(async () => {
+    const result = await createDailyDbBackupIfNeeded(db, getDbPath());
+    if (result.created)
+        startupDebug(`[kobo] Daily DB backup: ${result.created}`);
 });
 // Initialize process cleanup, agent watchdog, PR watcher, and wakeup rehydration
 reconcileOrphanSessions();
@@ -128,7 +116,7 @@ autoLoopService.rehydrate();
 // otherwise the next arm() after restart would compute the next ladder rung
 // from retryCount=0 and undo the progression.
 restoreRetryCountsFromDb();
-quotaBackoffService.restoreOnBoot((workspaceId) => autoLoopService.onQuotaBackoffExpired(workspaceId));
+quotaBackoffService.restoreOnBoot((workspaceId, pending) => autoLoopService.onQuotaBackoffExpired(workspaceId, pending));
 cronService.restoreOnBoot();
 // Deliver any new default prompt templates to existing installs (seed-once via the
 // seededDefaultSlugs watermark; never overwrites or re-adds deleted defaults).
@@ -453,10 +441,8 @@ setMessageHandler(async (type, payload) => {
     }
     if (type === 'workspace:stop' && p?.workspaceId) {
         try {
-            // A deliberate stop must not be treated like a recoverable engine
-            // interruption: disable before the engine emits session:ended(killed).
-            autoLoopService.disable(p.workspaceId, 'user-action');
-            stopAgent(p.workspaceId);
+            // Share the HTTP stop contract, including loops waiting without an agent.
+            await stopAgentAndWait(p.workspaceId);
         }
         catch (err) {
             console.error('[ws] Failed to stop agent:', err);
@@ -613,6 +599,7 @@ async function gracefulShutdown(signal, exitCode = 0) {
     }
     finally {
         try {
+            await dailyBackupScheduler.stop();
             closeDb();
             console.log('[kobo] Database closed');
         }

package/dist/server/routes/dev-server.js

@@ -3,6 +3,7 @@ import { migrationGuard } from '../middleware/migration-guard.js';
 import { getDevServerLogs, getStatus, startDevServer, stopDevServer } from '../services/dev-server-service.js';
 import { getProjectSettings } from '../services/settings-service.js';
 import { getWorkspace } from '../services/workspace-service.js';
+import { WorkspaceLifecycleBusyError } from '../utils/workspace-lifecycle-guard.js';
 /** Hono sub-router for per-workspace dev server lifecycle (start, stop, status, logs). */
 const app = new Hono();
 // GET /api/dev-server/:workspaceId/status
@@ -51,7 +52,7 @@ app.post('/:workspaceId/start', migrationGuard, (c) => {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const status = message.includes('already starting') ? 409 : 500;
+        const status = err instanceof WorkspaceLifecycleBusyError || /already starting|is stopping/.test(message) ? 409 : 500;
         return c.json({ error: message }, status);
     }
 });

package/dist/server/routes/pull-requests.js

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { Hono } from 'hono';
 import { getForgeProvider } from '../services/forge/registry.js';
 import { resolveForge } from '../services/forge/resolve.js';
@@ -61,7 +62,7 @@ app.post('/diagnose', async (c) => {
                 ongoingOperation: null,
                 branch: { state: 'absent' },
             };
-            return c.json({ report, pr: null, fingerprint: prCheckout.computeFingerprint(report) });
+            return c.json({ report, pr: null, fingerprint: await prCheckout.computeFingerprint(report) });
         }
         // Page through the full list — a PR the user explicitly diagnosed by
         // number must never come back "not found" just for sitting past the
@@ -75,11 +76,11 @@ app.post('/diagnose', async (c) => {
         } while (!pr && cursor !== null);
         if (!pr)
             return c.json({ error: `Pull request #${prNumber} not found` }, 404);
-        const workspaces = listWorkspaces(true);
+        const workspaces = listWorkspaces(true).filter((workspace) => path.resolve(workspace.projectPath) === path.resolve(projectPath));
         const report = prCheckout.diagnoseLocalState(projectPath, pr.headBranch, worktreesPath ?? null, attachedWorktreePaths(workspaces), workspaces);
         if (pr.isFork)
             report.blockers.push({ kind: 'fork-pr' });
-        return c.json({ report, pr, fingerprint: prCheckout.computeFingerprint(report) });
+        return c.json({ report, pr, fingerprint: await prCheckout.computeFingerprint(report) });
     }
     catch (err) {
         return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
@@ -93,7 +94,7 @@ app.post('/resolve', async (c) => {
         if (!body.projectPath || !body.fingerprint) {
             return c.json({ error: 'Missing required fields: projectPath, fingerprint' }, 400);
         }
-        const workspaces = listWorkspaces(true);
+        const workspaces = listWorkspaces(true).filter((workspace) => path.resolve(workspace.projectPath) === path.resolve(body.projectPath));
         const result = await prCheckout.resolvePrCheckout({
             projectPath: body.projectPath,
             headBranch: body.headBranch,