@loicngr/kobo 1.11.8 → 1.11.10

package/dist/server/routes/health.js

@@ -1,5 +1,6 @@
-import { spawnSync } from 'node:child_process';
+import { execFile as execFileCb } from 'node:child_process';
 import fs from 'node:fs';
+import { promisify } from 'node:util';
 import { Hono } from 'hono';
 import { getDb } from '../db/index.js';
 import { SCHEMA_VERSION } from '../db/migrations.js';
@@ -9,24 +10,22 @@ import { getDbPath, getKoboHome, getPackageVersion } from '../utils/paths.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
 import { resolveWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 const app = new Hono();
-function checkClaudeCli() {
+const execFileAsync = promisify(execFileCb);
+async function checkCli(binary) {
     try {
-        const r = spawnSync('claude', ['--version'], { encoding: 'utf-8' });
-        if (r.error || r.status !== 0)
-            return { available: false, version: null };
-        return { available: true, version: (r.stdout ?? '').trim() || null };
+        const { stdout } = await execFileAsync(binary, ['--version'], { encoding: 'utf-8', timeout: 2_000 });
+        return { available: true, version: stdout.trim() || null };
     }
     catch {
         return { available: false, version: null };
     }
 }
-function checkCodexCli() {
+function checkClaudeCli() {
+    return checkCli('claude');
+}
+async function checkCodexCli() {
     try {
-        const bin = resolveCodexBinary();
-        const r = spawnSync(bin, ['--version'], { encoding: 'utf-8' });
-        if (r.error || r.status !== 0)
-            return { available: false, version: null };
-        return { available: true, version: (r.stdout ?? '').trim() || null };
+        return await checkCli(resolveCodexBinary());
     }
     catch {
         return { available: false, version: null };
@@ -50,10 +49,11 @@ function safeFileSize(p) {
     }
 }
 // GET /api/health/report — detailed health diagnostics for the Health panel.
-app.get('/report', (c) => {
+app.get('/report', async (c) => {
     const db = getDb();
     const dbPath = getDbPath();
     const home = getKoboHome();
+    const cliChecks = Promise.all([checkClaudeCli(), checkCodexCli()]);
     // DB schema version
     const row = db.prepare('SELECT MAX(version) as v FROM schema_migrations').get();
     const dbSchemaVersion = row?.v ?? 0;
@@ -145,6 +145,7 @@ app.get('/report', (c) => {
         .all();
     const settingsRow = db.prepare('SELECT COUNT(*) as n FROM workspaces').get();
     const archivedRow = db.prepare('SELECT COUNT(*) as n FROM workspaces WHERE archived_at IS NOT NULL').get();
+    const [claudeCli, codexCli] = await cliChecks;
     const report = {
         version: getPackageVersion(),
         koboHome: home,
@@ -155,8 +156,8 @@ app.get('/report', (c) => {
             currentSchemaVersion: SCHEMA_VERSION,
         },
         settings: { schemaVersion: SETTINGS_SCHEMA_VERSION },
-        claudeCli: checkClaudeCli(),
-        codexCli: checkCodexCli(),
+        claudeCli,
+        codexCli,
         workspaces: {
             total: settingsRow.n,
             archived: archivedRow.n,

package/dist/server/routes/images.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { Hono } from 'hono';
 import * as imageService from '../services/image-service.js';
 import * as workspaceService from '../services/workspace-service.js';
+import { isPathInside } from '../utils/safe-path.js';
 /** Maximum allowed upload size for a single image (10 MB). */
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
 /** MIME types accepted for image uploads. */
@@ -67,7 +68,7 @@ app.get('/:id/images/file', async (c) => {
         }
         // Allowlist: only the upload storage layout is served. No symlink escape
         // either — we resolve and check containment.
-        if (!/^(\.ai\/images\/|images\/)[^/]/.test(requested) || requested.includes('..')) {
+        if (!/^\.ai\/images\/[^/]+$/.test(requested) || requested.includes('..')) {
             return c.json({ error: 'Invalid or disallowed image path' }, 400);
         }
         const worktreePath = workspace.worktreePath;
@@ -78,9 +79,23 @@ app.get('/:id/images/file', async (c) => {
         if (fullPath !== imagesRoot && !fullPath.startsWith(imagesRoot + path.sep)) {
             return c.json({ error: 'Path escapes images root' }, 400);
         }
+        if (!fs.existsSync(imagesRoot) || fs.lstatSync(imagesRoot).isSymbolicLink()) {
+            return c.json({ error: 'Invalid images root' }, 400);
+        }
+        if (!fs.existsSync(fullPath))
+            return c.json({ error: 'Image not found' }, 404);
+        const fileStat = fs.lstatSync(fullPath);
+        if (fileStat.isSymbolicLink())
+            return c.json({ error: 'Symbolic links are not allowed' }, 400);
+        const realWorktree = await fs.promises.realpath(worktreePath);
+        const realImagesRoot = await fs.promises.realpath(imagesRoot);
+        const realFile = await fs.promises.realpath(fullPath);
+        if (!isPathInside(realWorktree, realImagesRoot) || !isPathInside(realImagesRoot, realFile)) {
+            return c.json({ error: 'Path escapes images root' }, 400);
+        }
         let buffer;
         try {
-            buffer = await fs.promises.readFile(fullPath);
+            buffer = await fs.promises.readFile(realFile);
         }
         catch {
             return c.json({ error: 'Image not found' }, 404);

package/dist/server/routes/workspaces.js

@@ -48,9 +48,23 @@ const app = new Hono();
 /** Tracks workspaces currently running a setup script to prevent concurrent executions. */
 const setupScriptRunning = new Set();
 const VALID_AGENT_PERMISSION_MODES = ['plan', 'bypass', 'strict', 'interactive'];
+const VALID_WORKSPACE_STATUSES = [
+    'created',
+    'extracting',
+    'brainstorming',
+    'executing',
+    'awaiting-user',
+    'completed',
+    'idle',
+    'error',
+    'quota',
+];
 function isAgentPermissionMode(value) {
     return typeof value === 'string' && VALID_AGENT_PERMISSION_MODES.includes(value);
 }
+function isWorkspaceStatus(value) {
+    return typeof value === 'string' && VALID_WORKSPACE_STATUSES.includes(value);
+}
 async function deliverAgentPrompt(workspace, workingDir, prompt) {
     const delivery = await agentManager.sendMessageForFallback(workspace.id, prompt);
     if (delivery.status === 'sent')
@@ -1650,29 +1664,19 @@ app.get('/:id/session-metrics', (c) => {
             session.id,
             { sessionId: session.id, toolCalls: 0, errors: 0, inputTokens: 0, outputTokens: 0 },
         ]));
-        const events = db
-            .prepare("SELECT session_id, payload FROM ws_events WHERE workspace_id = ? AND type = 'agent:event' AND session_id IS NOT NULL")
+        const rows = db
+            .prepare(`SELECT session_id, tool_calls, errors, input_tokens, output_tokens
+         FROM session_event_metrics
+         WHERE workspace_id = ?`)
             .all(id);
-        for (const row of events) {
+        for (const row of rows) {
             const metric = metrics.get(row.session_id);
             if (!metric)
                 continue;
-            try {
-                const event = JSON.parse(row.payload);
-                if (event.kind === 'tool:call')
-                    metric.toolCalls++;
-                if (event.kind === 'error' || (event.kind === 'tool:result' && event.isError === true))
-                    metric.errors++;
-                if (event.kind === 'usage') {
-                    if (typeof event.inputTokens === 'number')
-                        metric.inputTokens = Math.max(metric.inputTokens, event.inputTokens);
-                    if (typeof event.outputTokens === 'number')
-                        metric.outputTokens = Math.max(metric.outputTokens, event.outputTokens);
-                }
-            }
-            catch {
-                // Corrupt historical events are intentionally ignored in diagnostics.
-            }
+            metric.toolCalls = row.tool_calls;
+            metric.errors = row.errors;
+            metric.inputTokens = row.input_tokens;
+            metric.outputTokens = row.output_tokens;
         }
         return c.json({ sessions, metrics: [...metrics.values()] });
     }
@@ -1719,7 +1723,8 @@ app.get('/:id/events', (c) => {
         // optional: scope to a session view. Session views also include
         // workspace-level rows where session_id IS NULL (legacy/pre-session items).
         const session = c.req.query('session');
-        const limit = Math.min(parseInt(c.req.query('limit') ?? '100', 10) || 100, 500);
+        const parsedLimit = parseInt(c.req.query('limit') ?? '100', 10);
+        const limit = Math.max(1, Math.min(Number.isFinite(parsedLimit) ? parsedLimit : 100, 500));
         const db = getDb();
         let rows;
         if (around) {
@@ -1758,12 +1763,12 @@ app.get('/:id/events', (c) => {
                     .prepare('SELECT * FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) ORDER BY rowid DESC LIMIT ?')
                     .all(id, session, limit)
                 : db
-                    .prepare('SELECT * FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC LIMIT ?')
+                    .prepare('SELECT * FROM ws_events WHERE workspace_id = ? ORDER BY rowid DESC LIMIT ?')
                     .all(id, limit);
         }
         // Reverse to chronological order (we queried DESC for "before" pagination,
         // or for the "session + no cursor" case where we fetched the newest first).
-        if (before || (session && !around))
+        if (!around)
             rows.reverse();
         const events = rows.map((row) => {
             let parsedPayload;
@@ -1785,7 +1790,7 @@ app.get('/:id/events', (c) => {
         // Check if there are more older events beyond what we returned
         let hasMore = false;
         if (rows.length > 0) {
-            if (before) {
+            if (before || around) {
                 const firstRow = db.prepare('SELECT rowid FROM ws_events WHERE id = ?').get(rows[0].id);
                 if (firstRow) {
                     const older = session
@@ -1798,10 +1803,12 @@ app.get('/:id/events', (c) => {
                     hasMore = older.c > 0;
                 }
             }
-            else if (session) {
-                const total = db
-                    .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
-                    .get(id, session);
+            else {
+                const total = session
+                    ? db
+                        .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
+                        .get(id, session)
+                    : db.prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ?').get(id);
                 hasMore = total.c > rows.length;
             }
         }
@@ -2017,7 +2024,11 @@ app.put('/:id/tags', async (c) => {
 app.patch('/:id', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const parsed = await c.req.json();
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return c.json({ error: 'Request body must be a JSON object' }, 400);
+        }
+        const body = parsed;
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -2026,12 +2037,12 @@ app.patch('/:id', migrationGuard, async (c) => {
         if ('agent_description' in body) {
             return c.json({ error: 'agent_description must be set via the agent MCP tool, not via the API' }, 400);
         }
-        let updated = workspace;
-        if (body.model !== undefined) {
-            updated = workspaceService.updateWorkspaceModel(id, body.model);
+        if (body.model !== undefined && (typeof body.model !== 'string' || !body.model.trim())) {
+            return c.json({ error: 'model must be a non-empty string' }, 400);
         }
-        if (body.reasoningEffort !== undefined) {
-            updated = workspaceService.updateWorkspaceReasoningEffort(id, body.reasoningEffort);
+        if (body.reasoningEffort !== undefined &&
+            (typeof body.reasoningEffort !== 'string' || !body.reasoningEffort.trim())) {
+            return c.json({ error: 'reasoningEffort must be a non-empty string' }, 400);
         }
         if (body.agentPermissionMode !== undefined) {
             if (!isAgentPermissionMode(body.agentPermissionMode)) {
@@ -2048,25 +2059,25 @@ app.patch('/:id', migrationGuard, async (c) => {
                     error: `Engine '${engineId}' does not support agentPermissionMode '${body.agentPermissionMode}'. Supported: ${supported.join(', ')}`,
                 }, 400);
             }
-            updated = workspaceService.updateAgentPermissionMode(id, body.agentPermissionMode);
         }
-        if (body.status) {
+        if (body.status !== undefined) {
+            if (!isWorkspaceStatus(body.status)) {
+                return c.json({ error: `Invalid status. Must be one of: ${VALID_WORKSPACE_STATUSES.join(', ')}` }, 400);
+            }
             if (body.status === 'idle' && agentManager.hasController(id)) {
                 return c.json({ error: 'Cannot mark an active agent workspace idle; end or stop the agent session first' }, 409);
             }
-            updated = workspaceService.updateWorkspaceStatus(id, body.status);
         }
-        if (body.name !== undefined) {
-            updated = workspaceService.updateWorkspaceName(id, body.name);
+        if (body.name !== undefined && typeof body.name !== 'string') {
+            return c.json({ error: 'name must be a string' }, 400);
         }
         if ('description' in body) {
             const desc = body.description;
             if (desc !== null && typeof desc !== 'string') {
                 return c.json({ error: 'description must be a string or null' }, 400);
             }
-            updated = workspaceService.updateWorkspaceDescription(id, desc);
         }
-        if (!body.status &&
+        if (body.status === undefined &&
             body.model === undefined &&
             body.reasoningEffort === undefined &&
             body.agentPermissionMode === undefined &&
@@ -2074,7 +2085,7 @@ app.patch('/:id', migrationGuard, async (c) => {
             !('description' in body)) {
             return c.json({ error: 'Missing field: status, model, reasoningEffort, agentPermissionMode, name, or description' }, 400);
         }
-        return c.json(updated);
+        return c.json(workspaceService.updateWorkspaceFields(id, body));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -2270,7 +2281,7 @@ app.post('/:id/run-setup-script', async (c) => {
     }
 });
 // POST /api/workspaces/:id/archive — mark workspace as archived (soft-delete)
-app.post('/:id/archive', migrationGuard, (c) => {
+app.post('/:id/archive', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -2287,7 +2298,7 @@ app.post('/:id/archive', migrationGuard, (c) => {
             // Agent may not be running — ignore
         }
         try {
-            devServerService.stopDevServer(id);
+            await devServerService.stopDevServer(id);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -2362,7 +2373,7 @@ app.post('/:id/unarchive', migrationGuard, (c) => {
 // Every side-effect is best-effort — failures are collected as warnings
 // rather than thrown, so a bulk delete never aborts mid-batch. Returns the
 // list of user-facing warning messages (empty when everything was clean).
-function deleteWorkspaceWithSideEffects(workspace, opts) {
+async function deleteWorkspaceWithSideEffects(workspace, opts) {
     // Stop agent if running (best-effort)
     try {
         agentManager.stopAgent(workspace.id);
@@ -2373,7 +2384,7 @@ function deleteWorkspaceWithSideEffects(workspace, opts) {
     // Stop dev server if it was running. The processSpawn would otherwise
     // outlive the workspace (and keep its port + docker containers alive).
     try {
-        devServerService.stopDevServer(workspace.id);
+        await devServerService.stopDevServer(workspace.id);
     }
     catch (err) {
         console.error(`[workspaces] stopDevServer during delete failed for '${workspace.name}':`, err);
@@ -2457,7 +2468,7 @@ app.delete('/archived', migrationGuard, async (c) => {
         let deleted = 0;
         for (const workspace of archived) {
             try {
-                warnings.push(...deleteWorkspaceWithSideEffects(workspace, body));
+                warnings.push(...(await deleteWorkspaceWithSideEffects(workspace, body)));
                 deleted++;
             }
             catch (err) {
@@ -2485,7 +2496,7 @@ app.delete('/:id', migrationGuard, async (c) => {
         const body = await c.req
             .json()
             .catch(() => ({}));
-        const warnings = deleteWorkspaceWithSideEffects(workspace, body);
+        const warnings = await deleteWorkspaceWithSideEffects(workspace, body);
         // When everything worked cleanly we keep the legacy 204 response so
         // existing clients aren't surprised by a JSON body. Warnings promote the
         // response to 200 so the body is readable.
@@ -2507,6 +2518,10 @@ app.post('/:id/start', migrationGuard, async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
+        if (workspace.archivedAt)
+            return c.json({ error: `Workspace '${id}' is archived` }, 409);
+        if (workspace.worktreePurgedAt)
+            return c.json({ error: `Workspace '${id}' worktree is purged` }, 409);
         // If the workspace declares an engine, ensure it is still registered.
         // Otherwise startAgent() would throw from deep inside resolveEngine and
         // surface as an opaque 500 — better to fail fast with a clear 400.
@@ -3300,7 +3315,7 @@ app.post('/:id/merge-pr', async (c) => {
             }, 409);
         }
         const snapshot = await provider.getPrStatus(workspace.worktreePath, workspace.workingBranch);
-        if (!snapshot || snapshot.state !== 'OPEN') {
+        if (snapshot?.state !== 'OPEN') {
             return c.json({ error: 'No open PR found for this workspace', code: 'pr_not_open' }, 409);
         }
         if (!snapshot.readyToMerge) {
@@ -3654,7 +3669,7 @@ app.post('/:id/start-ci-fix', migrationGuard, async (c) => {
         if (!snapshot) {
             snapshot = getAllPrSnapshots()[id] ?? null;
         }
-        if (!snapshot || snapshot.state !== 'OPEN' || snapshot.ci.rollup !== 'FAILURE') {
+        if (snapshot?.state !== 'OPEN' || snapshot.ci.rollup !== 'FAILURE') {
             return c.json({ error: 'No failing CI detected on this workspace' }, 400);
         }
         const effective = settingsService.getEffectiveSettings(workspace.projectPath);

package/dist/server/services/agent/engines/codex/engine.js

@@ -378,7 +378,11 @@ export function createCodexEngine() {
                     if (!pending)
                         return false;
                     pendingByCallId.delete(callId);
-                    turnLiveness.resume();
+                    // Only resume the idle-timeout clock once every outstanding
+                    // approval has been answered — a sibling request may still be
+                    // waiting on a human decision.
+                    if (pendingByCallId.size === 0)
+                        turnLiveness.resume();
                     const result = buildResponseForResolve(pending, response);
                     client.peer.respond(pending.requestId, result);
                     return true;

package/dist/server/services/agent/orchestrator.js

@@ -847,6 +847,13 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
  * query the controller via `_getControllers()` for tests.
  */
 export function startAgent(workspaceId, workingDir, prompt, model, resume = false, agentPermissionMode, existingSessionId, reasoningEffort) {
+    const workspace = getWs(workspaceId);
+    if (!workspace)
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    if (workspace.archivedAt)
+        throw new Error(`Workspace '${workspaceId}' is archived`);
+    if (workspace.worktreePurgedAt)
+        throw new Error(`Workspace '${workspaceId}' worktree is purged`);
     // "For this turn" never survives a new agent session.
     permissionPolicyService.clearTurnPermissions(workspaceId);
     // Zombie detection: an SDK iterator hung on a never-resolved canUseTool
@@ -1317,7 +1324,7 @@ export function _getPendingDeferred() {
     const out = new Map();
     for (const [wid, arr] of pendingQueue) {
         const head = arr[0];
-        if (!head || head.kind !== 'question')
+        if (head?.kind !== 'question')
             continue;
         out.set(wid, {
             toolCallId: head.toolCallId,

package/dist/server/services/auto-loop-service.js

@@ -78,7 +78,7 @@ export function enable(workspaceId) {
  */
 export function disable(workspaceId, reason) {
     const row = getRow(workspaceId);
-    if (!row || row.auto_loop !== 1)
+    if (row?.auto_loop !== 1)
         return;
     const db = getDb();
     db.prepare('UPDATE workspaces SET auto_loop = 0 WHERE id = ?').run(workspaceId);

package/dist/server/services/change-source-branch-service.js

@@ -75,13 +75,34 @@ export async function changeSourceBranch(workspaceId, newBase) {
             updateWorkspaceSourceBranch(workspaceId, trimmedNew);
             return { status: 'conflict', forcePushNeeded, commitCount: commits.length };
         }
+        // Non-conflict failure (e.g. the `reset --hard` itself failed) — best
+        // effort restore of the stash before letting the error propagate, same
+        // as the original `finally` did, so the user doesn't lose uncommitted
+        // work on an unrelated failure.
+        if (stashed) {
+            try {
+                gitOps.stashPop(worktreePath);
+            }
+            catch {
+                /* best-effort — the original error is more relevant than this one */
+            }
+        }
         throw err;
     }
-    finally {
-        if (stashed)
+    // The reset/reconstruct already landed on disk at this point. Update the
+    // DB's source_branch BEFORE attempting the stash pop: if the pop conflicts
+    // (the stashed local edits collide with the new base's content), the
+    // worktree and DB must not disagree about which base it's on — the user
+    // resolves the stash conflict manually, same as a cherry-pick conflict.
+    updateWorkspaceSourceBranch(workspaceId, trimmedNew);
+    if (stashed) {
+        try {
             gitOps.stashPop(worktreePath);
+        }
+        catch {
+            return { status: 'conflict', forcePushNeeded, commitCount: commits.length };
+        }
     }
-    updateWorkspaceSourceBranch(workspaceId, trimmedNew);
     try {
         const provider = getForgeProvider(resolveForge(workspace.projectPath));
         if (provider.capabilities.canChangePrBase) {
@@ -126,8 +147,25 @@ async function runCustomScript(workspace, oldBase, newBase, script) {
                 KOBO_FORGE: forgeId,
                 KOBO_PR_NUMBER: prNumber,
             },
+            // Detached so `child` leads its own process group. Node's native
+            // `timeout` option below only signals `child` itself — without this,
+            // a script that backgrounds a long-running command (`docker compose
+            // up -d &`) leaves it running as an orphan after the timeout fires.
+            detached: true,
             timeout: SCRIPT_TIMEOUT_MS,
+            killSignal: 'SIGTERM',
         });
+        // Node's `timeout` option kills only `child`. Mirror that same signal to
+        // the whole process group so a backgrounded child dies with it.
+        const groupKillTimer = setTimeout(() => {
+            try {
+                if (child.pid)
+                    process.kill(-child.pid, 'SIGTERM');
+            }
+            catch {
+                /* process group already gone */
+            }
+        }, SCRIPT_TIMEOUT_MS);
         let stderrBuf = '';
         child.stderr?.on('data', (chunk) => {
             stderrBuf += chunk.toString();
@@ -135,9 +173,11 @@ async function runCustomScript(workspace, oldBase, newBase, script) {
                 stderrBuf = stderrBuf.slice(-8 * 1024);
         });
         child.on('error', (err) => {
+            clearTimeout(groupKillTimer);
             reject(new Error(`Custom change-source-branch script failed to spawn: ${err.message}`));
         });
         child.on('exit', (code, signal) => {
+            clearTimeout(groupKillTimer);
             if (code === 0) {
                 updateWorkspaceSourceBranch(workspace.id, newBase);
                 resolve({ status: 'done', forcePushNeeded: false, commitCount: 0 });