@loicngr/kobo 1.11.39 → 1.11.41

package/dist/server/services/cron-service.js

@@ -63,8 +63,22 @@ function rowToCron(row) {
         lastFiredAt: row.last_fired_at,
         oneShot: row.one_shot === 1,
         createdAt: row.created_at,
+        ...(expressionError(row.expression) ? { validationError: expressionError(row.expression) } : {}),
     };
 }
+function expressionError(expression) {
+    const trimmed = expression.trim();
+    if (!['@hourly', '@daily', '@weekly', '@monthly', '@yearly'].includes(trimmed) && trimmed.split(/\s+/).length !== 5) {
+        return `Invalid cron expression: ${expression} — expected five fields or a supported alias`;
+    }
+    try {
+        CronExpressionParser.parse(trimmed);
+        return null;
+    }
+    catch (err) {
+        return `Invalid cron expression: ${expression} — ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
 /**
  * Compute the next fire time for an expression strictly after `from`.
  * Uses cron-parser 5.x API. Throws with a descriptive error if the
@@ -72,6 +86,9 @@ function rowToCron(row) {
  * `@monthly` / `@yearly` are accepted natively.
  */
 function nextAfter(expression, from) {
+    const validationError = expressionError(expression);
+    if (validationError)
+        throw new Error(validationError);
     try {
         const it = CronExpressionParser.parse(expression, { currentDate: from });
         return it.next().toDate();
@@ -173,6 +190,8 @@ function fireOrSkip(id) {
         const row = db.prepare('SELECT * FROM pending_crons WHERE id = ?').get(id);
         if (!row)
             return; // cancelled in flight
+        if (expressionError(row.expression))
+            return; // Retain invalid legacy intent without executing it.
         const wsRow = db
             .prepare(`SELECT project_path, working_branch, worktree_path, model, agent_permission_mode, reasoning_effort, archived_at
            FROM workspaces WHERE id = ?`)
@@ -212,6 +231,9 @@ function fireOrSkip(id) {
         const now = new Date();
         let nextFire;
         try {
+            // Valid five-field schedules have at most one occurrence per minute.
+            // Skip missed slots from now, without adding a minute of timer jitter
+            // that would discard the next scheduled occurrence too.
             nextFire = nextAfter(row.expression, now);
         }
         catch (err) {
@@ -220,7 +242,6 @@ function fireOrSkip(id) {
             // arm and this fire. Cancel as 'completed' (the cron self-terminates)
             // rather than 'user' which would imply the user requested it.
             console.error(`[cron-service] failed to recompute next fire for cron '${id}':`, err);
-            cancel(id, 'completed');
             return;
         }
         // One-shot crons cancel themselves after a real fire (not on skip-active —
@@ -278,6 +299,11 @@ export function restoreOnBoot() {
                     db.prepare('DELETE FROM pending_crons WHERE id = ?').run(row.id);
                     continue;
                 }
+                const validationError = expressionError(row.expression);
+                if (validationError) {
+                    console.warn(`[cron-service] ${validationError}; cron ${row.id} remains inactive`);
+                    continue;
+                }
                 const storedDate = new Date(row.next_fire_at);
                 let nextFireAt;
                 if (storedDate.getTime() <= now.getTime()) {

package/dist/server/services/image-service.js

@@ -39,14 +39,18 @@ function writeIndex(imagesDir, entries) {
         throw new Error('Symbolic links are not allowed for image index');
     }
     const tempPath = path.join(imagesDir, `.index-${randomUUID()}.tmp`);
-    let created = false;
+    const descriptor = fs.openSync(tempPath, 'wx', 0o600);
     try {
-        fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2), { flag: 'wx', mode: 0o600 });
-        created = true;
+        try {
+            fs.writeFileSync(descriptor, JSON.stringify(entries, null, 2));
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
         fs.renameSync(tempPath, indexPath);
     }
     finally {
-        if (created && fs.existsSync(tempPath))
+        if (fs.existsSync(tempPath))
             fs.unlinkSync(tempPath);
     }
 }
@@ -63,11 +67,16 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
     const imagesDir = ensureRealImagesDirectory(worktreePath);
     const filename = `${uid}.${ext}`;
     await withLock(worktreePath, () => {
-        // Write the image file inside the lock so both the file write and index
-        // update happen atomically — avoids orphan files on crash between the two.
+        // Serialize image/index writes and clean up incomplete writes on failure.
         const imagePath = path.join(imagesDir, filename);
-        fs.writeFileSync(imagePath, fileBuffer, { flag: 'wx', mode: 0o600 });
+        const descriptor = fs.openSync(imagePath, 'wx', 0o600);
         try {
+            try {
+                fs.writeFileSync(descriptor, fileBuffer);
+            }
+            finally {
+                fs.closeSync(descriptor);
+            }
             const entries = readIndex(imagesDir);
             entries.push({ uid, originalName, createdAt: new Date().toISOString() });
             writeIndex(imagesDir, entries);

package/dist/server/services/mcp-client-context.js

@@ -0,0 +1,12 @@
+import { normalizeClientName } from '../../shared/workspace-message-types.js';
+export function createMcpClientContext(name, transport = 'http', encoding) {
+    if (encoding === 'uri' && typeof name === 'string') {
+        try {
+            name = decodeURIComponent(name);
+        }
+        catch {
+            name = undefined;
+        }
+    }
+    return { kind: 'mcp', clientName: normalizeClientName(name), transport };
+}

package/dist/server/services/mcp-connection-info-service.js

@@ -0,0 +1,63 @@
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { getCompiledMcpServerPath, getDbPath, getMcpServerSourcePath } from '../utils/paths.js';
+import { getLanHostnames, isAllowedRequestHost, resolveProxyHostname } from './network-access-service.js';
+/** No request/forwarded headers or credentials participate in generated metadata. */
+export function buildMcpConnectionInfo(input) {
+    const backendUrl = `http://127.0.0.1:${input.port}`;
+    const args = input.compiledPath
+        ? [input.compiledPath]
+        : input.sourcePath && input.loaderPath
+            ? ['--import', pathToFileURL(input.loaderPath).href, input.sourcePath]
+            : null;
+    return {
+        localUrl: `${backendUrl}/api/mcp`,
+        lanUrls: input.networkEnabled
+            ? input.lanHostnames
+                .map((host) => `${host.includes(':') ? `[${host}]` : host}:${input.port}`)
+                .filter((host) => isAllowedRequestHost({
+                host,
+                enabled: input.networkEnabled,
+                lanHostnames: input.lanHostnames,
+                behindProxy: input.behindProxy,
+                proxyHostname: input.proxyHostname,
+            }))
+                .map((host) => `http://${host}/api/mcp`)
+            : [],
+        networkEnabled: input.networkEnabled,
+        behindProxy: input.behindProxy,
+        proxyHostname: input.proxyHostname,
+        localRequiresToken: input.behindProxy,
+        stdio: args
+            ? {
+                command: input.command,
+                args,
+                env: { KOBO_DB_PATH: input.databasePath, KOBO_BACKEND_URL: backendUrl, KOBO_WORKSPACE_ID: '' },
+            }
+            : null,
+    };
+}
+export function getMcpConnectionInfo(port, settings, databasePath = getDbPath()) {
+    const source = getMcpServerSourcePath();
+    let loaderPath = null;
+    try {
+        loaderPath = createRequire(import.meta.url).resolve('tsx');
+    }
+    catch {
+        /* Production installs can omit the development loader. */
+    }
+    return buildMcpConnectionInfo({
+        port,
+        networkEnabled: settings.networkAccessEnabled,
+        behindProxy: settings.networkAccessBehindProxy,
+        proxyHostname: resolveProxyHostname(),
+        lanHostnames: getLanHostnames(),
+        command: process.execPath,
+        compiledPath: getCompiledMcpServerPath(),
+        sourcePath: fs.existsSync(source) ? source : null,
+        loaderPath,
+        databasePath: path.resolve(databasePath),
+    });
+}

package/dist/server/services/mcp-message-delivery-service.js

@@ -0,0 +1,59 @@
+import { getDb } from '../db/index.js';
+import { finishMessageRequest, markMessageDispatching, reserveMessageRequest, } from './mcp-message-request-service.js';
+import { broadcastPersistedEvent, persistWorkspaceEvent } from './websocket-service.js';
+import { deliverWorkspaceMessage } from './workspace-message-service.js';
+export async function deliverKeyedMcpMessage(workspaceId, key, message) {
+    const db = getDb();
+    const request = reserveMessageRequest(db, workspaceId, key, message.content, message.sessionId);
+    if (!request.fresh)
+        return request.result;
+    let dispatched = false;
+    let accepted;
+    try {
+        await deliverWorkspaceMessage(workspaceId, { ...message, clientMessageId: request.requestId }, {
+            beforeDispatch() {
+                // The normal closed-engine fallback may enter this boundary again
+                // while resuming the very same request, never a second reservation.
+                if (dispatched)
+                    return;
+                markMessageDispatching(db, request.requestId);
+                dispatched = true;
+            },
+            persist(payload, sessionId) {
+                const committed = db.transaction(() => {
+                    const event = persistWorkspaceEvent(workspaceId, 'user:message', payload, sessionId);
+                    const result = { accepted: true, requestId: request.requestId, eventId: event.id, sessionId };
+                    finishMessageRequest(db, request.requestId, 'accepted', result);
+                    return { event, result };
+                })();
+                accepted = committed.result;
+                broadcastPersistedEvent(committed.event);
+            },
+        });
+        if (!accepted)
+            throw new Error('Delivery completed without a durable receipt');
+        return accepted;
+    }
+    catch (error) {
+        // A notification failure cannot invalidate an already committed receipt.
+        if (accepted)
+            return accepted;
+        const result = {
+            accepted: false,
+            requestId: request.requestId,
+            code: dispatched ? 'delivery_unknown' : 'delivery_rejected',
+            message: dispatched
+                ? 'Delivery may have occurred; inspect history before sending a new request'
+                : error instanceof Error
+                    ? error.message
+                    : String(error),
+        };
+        try {
+            finishMessageRequest(db, request.requestId, dispatched ? 'unknown' : 'rejected', result);
+        }
+        catch {
+            /* The reserved/dispatching row still prevents redelivery if storage failed. */
+        }
+        return result;
+    }
+}

package/dist/server/services/mcp-message-request-service.js

@@ -0,0 +1,64 @@
+import { createHash } from 'node:crypto';
+import { nanoid } from 'nanoid';
+export function reserveMessageRequest(db, workspaceId, key, content, sessionId) {
+    const fingerprint = createHash('sha256')
+        .update(JSON.stringify([content, sessionId ?? null]))
+        .digest('hex');
+    return db
+        .transaction(() => {
+        const requestId = `mcp-${nanoid()}`;
+        const now = new Date().toISOString();
+        const inserted = db
+            .prepare(`INSERT INTO mcp_message_requests(workspace_id,idempotency_key,request_id,fingerprint,state,created_at,updated_at)
+      VALUES (?,?,?,?,'reserved',?,?) ON CONFLICT(workspace_id,idempotency_key) DO NOTHING`)
+            .run(workspaceId, key, requestId, fingerprint, now, now);
+        if (inserted.changes)
+            return { fresh: true, requestId };
+        const row = db
+            .prepare('SELECT request_id,fingerprint,state,result_json FROM mcp_message_requests WHERE workspace_id=? AND idempotency_key=?')
+            .get(workspaceId, key);
+        let result;
+        if (row.fingerprint !== fingerprint)
+            result = {
+                accepted: false,
+                requestId: row.request_id,
+                code: 'idempotency_conflict',
+                message: 'This key was already used for different content or a different session',
+            };
+        else if (row.result_json) {
+            result = JSON.parse(row.result_json);
+            if (result.accepted)
+                result = { ...result, replayed: true };
+        }
+        else
+            result = {
+                accepted: false,
+                requestId: row.request_id,
+                code: row.state === 'unknown' ? 'delivery_unknown' : 'in_progress',
+                message: row.state === 'unknown'
+                    ? 'Delivery may have occurred; inspect history before sending a new request'
+                    : 'This request is still in progress; retry the same key to check its outcome',
+            };
+        return { fresh: false, requestId: row.request_id, result };
+    })
+        .immediate();
+}
+export function markMessageDispatching(db, requestId) {
+    const result = db
+        .prepare("UPDATE mcp_message_requests SET state='dispatching',updated_at=? WHERE request_id=? AND state='reserved'")
+        .run(new Date().toISOString(), requestId);
+    if (result.changes !== 1)
+        throw new Error('MCP request is no longer reserved');
+}
+export function finishMessageRequest(db, requestId, state, result) {
+    const changed = db
+        .prepare(`UPDATE mcp_message_requests SET state=?,result_json=?,event_id=?,session_id=?,updated_at=?
+    WHERE request_id=? AND state IN ('reserved','dispatching')`)
+        .run(state, JSON.stringify(result), result.accepted ? result.eventId : null, result.accepted ? (result.sessionId ?? null) : null, new Date().toISOString(), requestId);
+    if (changed.changes !== 1)
+        throw new Error('MCP request is no longer pending');
+}
+/** Backend startup only: never assume an interrupted engine delivery did not happen. */
+export function reconcileMessageRequests(db) {
+    db.prepare("UPDATE mcp_message_requests SET state='unknown',updated_at=? WHERE state IN ('reserved','dispatching')").run(new Date().toISOString());
+}

package/dist/server/services/pr-checkout-service.js

@@ -9,7 +9,7 @@ import { fingerprintWorktree } from '../utils/git-worktree-fingerprint.js';
 import { withWorkspaceLifecycleGuard } from '../utils/workspace-lifecycle-guard.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 import { hasController } from './agent/orchestrator.js';
-import { createWorktree, listWorktrees, removeWorktreeUnlocked } from './worktree-service.js';
+import { createWorktreeUnlocked, listWorktrees, removeWorktreeUnlocked } from './worktree-service.js';
 /**
  * A `pathCollision.worktreePath` decision is untrusted input reaching
  * `git worktree add` directly — including from a network-access client that
@@ -81,9 +81,9 @@ function hasCommonAncestor(repoPath, branch) {
     }
 }
 /** Locate any worktree already sitting on `branch`, or at the target path. */
-function diagnoseWorktree(projectPath, branch, targetPath, attachedPaths) {
+async function diagnoseWorktree(projectPath, branch, targetPath, attachedPaths) {
     const blockers = [];
-    const worktrees = listWorktrees(projectPath);
+    const worktrees = await listWorktrees(projectPath);
     const onBranch = worktrees.find((wt) => wt.branch === branch);
     if (onBranch) {
         if (!fs.existsSync(onBranch.path)) {
@@ -163,7 +163,7 @@ export async function computeFingerprint(report) {
  * `attachedPaths` maps worktree path -> workspace id; the route supplies it so
  * this function stays free of database access and easy to test.
  */
-export function diagnoseLocalState(projectPath, headBranch, worktreesPath, attachedPaths = new Map(), workspaces = []) {
+export async function diagnoseLocalState(projectPath, headBranch, worktreesPath, attachedPaths = new Map(), workspaces = []) {
     const targetWorktreePath = resolveWorkspaceWorktreePath(projectPath, headBranch, worktreesPath);
     const blockers = [];
     const lockPath = gitOps.getIndexLockPath(projectPath);
@@ -174,7 +174,7 @@ export function diagnoseLocalState(projectPath, headBranch, worktreesPath, attac
         !hasCommonAncestor(projectPath, headBranch)) {
         blockers.push({ kind: 'no-common-ancestor', branch: headBranch });
     }
-    const { worktree, blockers: worktreeBlockers } = diagnoseWorktree(projectPath, headBranch, targetWorktreePath, attachedPaths);
+    const { worktree, blockers: worktreeBlockers } = await diagnoseWorktree(projectPath, headBranch, targetWorktreePath, attachedPaths);
     blockers.push(...worktreeBlockers);
     const inspectPath = worktree.state === 'orphan' || worktree.state === 'attached' ? worktree.path : null;
     return {
@@ -256,8 +256,8 @@ export class StaleDiagnosisError extends Error {
  * `change-source-branch-service`, so it cannot interleave with a worktree purge
  * or a source-branch change.
  */
-export function resolvePrCheckout(input) {
-    const initial = diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths, input.workspaces);
+export async function resolvePrCheckout(input) {
+    const initial = await diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths, input.workspaces);
     const owner = initial.worktree.state === 'attached'
         ? initial.worktree.workspaceId
         : initial.workspace.state !== 'none'
@@ -274,7 +274,7 @@ function resolvePrCheckoutLocked(input, owner) {
         // 1. Refresh, then refuse a plan built on facts that no longer hold.
         gitOps.fetchSourceBranch(input.projectPath, input.headBranch);
         applied.push({ kind: 'fetch', detail: `origin/${input.headBranch}` });
-        const fresh = diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
+        const fresh = await diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
         if ((await computeFingerprint(fresh)) !== input.fingerprint)
             throw new StaleDiagnosisError(fresh);
         if ((fresh.worktree.state === 'orphan' || fresh.worktree.state === 'attached') &&
@@ -346,7 +346,7 @@ function resolvePrCheckoutLocked(input, owner) {
             const baseRef = gitOps.localBranchExists(input.projectPath, input.headBranch)
                 ? input.headBranch
                 : `origin/${input.headBranch}`;
-            const target = createWorktree(input.projectPath, input.headBranch, baseRef, input.worktreesPath, undefined, explicitPath);
+            const target = await createWorktreeUnlocked(input.projectPath, input.headBranch, baseRef, input.worktreesPath, undefined, explicitPath);
             worktreePath = target.worktreePath;
             created = true;
             applied.push({ kind: 'create-worktree', detail: worktreePath });
@@ -361,7 +361,7 @@ function resolvePrCheckoutLocked(input, owner) {
         catch (err) {
             if (created) {
                 try {
-                    removeWorktreeUnlocked(input.projectPath, worktreePath);
+                    await removeWorktreeUnlocked(input.projectPath, worktreePath);
                 }
                 catch (cleanupErr) {
                     console.error('[pr-checkout] rollback failed to remove the worktree:', cleanupErr);

package/dist/server/services/pr-watcher-service.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import { fetchSourceBranchAsync } from '../utils/git-ops.js';
 import { withGitRepoLock } from '../utils/git-repo-lock.js';
-import { isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
+import { isWorkspaceLifecycleBusy, withWorkspaceLifecycleGuard } from '../utils/workspace-lifecycle-guard.js';
 import { hasController } from './agent/orchestrator.js';
 import { stopDevServer } from './dev-server-service.js';
 import { getForgeProvider } from './forge/registry.js';
@@ -99,19 +99,24 @@ function markUnread(workspaceId) {
         console.error('[pr-watcher] markUnread failed:', err instanceof Error ? err.message : err);
     }
 }
-function autoRestoreManuallyRecreatedWorktrees() {
+async function autoRestoreManuallyRecreatedWorktrees() {
     for (const ws of listArchivedWorkspaces()) {
         if (!ws.worktreePurgedAt || !ws.worktreeOwned || isWorkspaceLifecycleBusy(ws.id))
             continue;
         if (!fs.existsSync(ws.worktreePath))
             continue;
-        if (!isMatchingWorkspaceWorktree(ws))
-            continue;
         try {
-            const restored = restoreWorktreeFromDisk(ws.id);
-            invalidateWorkspacePrCaches(ws.id);
-            emitEphemeral(ws.id, 'workspace:worktree-restored', { workspace: restored });
-            console.log(`[pr-watcher] auto-restored worktree for workspace '${ws.name}' (manual restore detected)`);
+            await withWorkspaceLifecycleGuard(ws.id, async () => {
+                const current = getWorkspace(ws.id);
+                if (!current?.worktreePurgedAt || !current.worktreeOwned)
+                    return;
+                if (!(await isMatchingWorkspaceWorktree(current)))
+                    return;
+                const restored = restoreWorktreeFromDisk(ws.id);
+                invalidateWorkspacePrCaches(ws.id);
+                emitEphemeral(ws.id, 'workspace:worktree-restored', { workspace: restored });
+                console.log(`[pr-watcher] auto-restored worktree for workspace '${ws.name}' (manual restore detected)`);
+            });
         }
         catch (err) {
             console.error(`[pr-watcher] auto-restore failed for '${ws.name}':`, err instanceof Error ? err.message : err);
@@ -119,7 +124,7 @@ function autoRestoreManuallyRecreatedWorktrees() {
     }
 }
 export async function checkPrStatuses() {
-    autoRestoreManuallyRecreatedWorktrees();
+    await autoRestoreManuallyRecreatedWorktrees();
     const workspaces = listWorkspaces(false); // non-archived only
     // Clean up entries for workspaces that no longer exist
     for (const id of lastKnownPr.keys()) {