@loicngr/kobo 1.11.9 → 1.11.10

package/dist/server/services/forge/gitlab/provider.js

@@ -3,6 +3,10 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { deriveReadyToMerge } from '../types.js';
 const execFileAsync = promisify(execFile);
+const CLI_TIMEOUT_MS = 30_000;
+function cliOptions(repoPath) {
+    return { cwd: repoPath, encoding: 'utf-8', timeout: CLI_TIMEOUT_MS };
+}
 /** Map GitLab MR state to the normalised PrSnapshot state. */
 function mapState(state) {
     if (state === 'merged')
@@ -100,10 +104,7 @@ function mapGlabJobToCheck(job) {
  */
 async function fetchGlabCi(repoPath, branch) {
     try {
-        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], {
-            cwd: repoPath,
-            encoding: 'utf-8',
-        });
+        const { stdout } = await execFileAsync('glab', ['ci', 'get', '-b', branch, '-F', 'json'], cliOptions(repoPath));
         const raw = stdout.trim();
         if (!raw)
             return { rollup: null, checks: [] };
@@ -138,7 +139,7 @@ export const gitlabProvider = {
     },
     async isAvailable(repoPath) {
         try {
-            await execFileAsync('glab', ['auth', 'status'], { cwd: repoPath, encoding: 'utf-8' });
+            await execFileAsync('glab', ['auth', 'status'], cliOptions(repoPath));
             return { available: true };
         }
         catch (err) {
@@ -147,10 +148,7 @@ export const gitlabProvider = {
     },
     async getPrStatus(repoPath, branch) {
         try {
-            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], {
-                cwd: repoPath,
-                encoding: 'utf-8',
-            });
+            const { stdout } = await execFileAsync('glab', ['mr', 'view', branch, '--output', 'json'], cliOptions(repoPath));
             const raw = stdout.trim();
             if (!raw)
                 return null;
@@ -176,19 +174,19 @@ export const gitlabProvider = {
             '--description',
             opts.body,
             '--yes',
-        ], { cwd: repoPath, encoding: 'utf-8' });
+        ], cliOptions(repoPath));
         const match = stdout.match(/https?:\/\/[^\s]+\/-\/merge_requests\/(\d+)/);
         if (!match)
             throw new Error('Could not parse MR URL from glab output');
         return { url: match[0], number: Number.parseInt(match[1], 10) };
     },
     async changePrBase(repoPath, base) {
-        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'update', '--target-branch', base], cliOptions(repoPath));
     },
     async mergeRequest(repoPath, number) {
-        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('glab', ['mr', 'merge', String(number), '--yes'], cliOptions(repoPath));
     },
     async deleteRemoteBranch(repoPath, branch) {
-        await execFileAsync('git', ['push', 'origin', '--delete', branch], { cwd: repoPath, encoding: 'utf-8' });
+        await execFileAsync('git', ['push', 'origin', '--delete', branch], cliOptions(repoPath));
     },
 };

package/dist/server/services/git-stats-service.js

@@ -10,13 +10,15 @@ import { resolveForge } from './forge/resolve.js';
  */
 export async function computeGitStats(workspace, prSnapshot) {
     const { worktreePath, sourceBranch, workingBranch, projectPath } = workspace;
-    const commitCount = gitOps.getCommitCount(worktreePath, sourceBranch, workingBranch);
-    const behindCount = gitOps.getCommitsBehind(worktreePath, sourceBranch, workingBranch);
-    const diffStats = gitOps.getStructuredDiffStatsBetween(worktreePath, sourceBranch, workingBranch);
-    const unpushedCount = await gitOps.getUnpushedCountAsync(worktreePath, workingBranch);
-    const workingTree = gitOps.getWorkingTreeStatus(worktreePath);
     const forgeProvider = getForgeProvider(resolveForge(projectPath));
-    const availability = await forgeProvider.isAvailable(worktreePath);
+    const [commitCount, behindCount, diffStats, unpushedCount, workingTree, availability] = await Promise.all([
+        gitOps.getCommitCountAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getCommitsBehindAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getStructuredDiffStatsBetweenAsync(worktreePath, sourceBranch, workingBranch),
+        gitOps.getUnpushedCountAsync(worktreePath, workingBranch),
+        gitOps.getWorkingTreeStatusAsync(worktreePath),
+        forgeProvider.isAvailable(worktreePath),
+    ]);
     return {
         commitCount,
         behindCount,

package/dist/server/services/image-service.js

@@ -6,6 +6,29 @@ const IMAGES_DIR = '.ai/images';
 const INDEX_FILE = 'index.json';
 // Per-worktree lock to serialize index.json writes
 const locks = new Map();
+function ensureRealImagesDirectory(worktreePath) {
+    const realWorktree = fs.realpathSync(worktreePath);
+    let current = worktreePath;
+    for (const segment of ['.ai', 'images']) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current)) {
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                throw new Error(`Symbolic links are not allowed in image storage: ${current}`);
+            if (!stat.isDirectory())
+                throw new Error(`Image storage path is not a directory: ${current}`);
+        }
+        else {
+            fs.mkdirSync(current);
+        }
+        const realCurrent = fs.realpathSync(current);
+        const relative = path.relative(realWorktree, realCurrent);
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            throw new Error('Image storage path escapes the worktree');
+        }
+    }
+    return fs.realpathSync(current);
+}
 function withLock(worktreePath, fn) {
     const prev = locks.get(worktreePath) ?? Promise.resolve();
     // The second argument to .then() means: even if the previous operation in the
@@ -18,6 +41,8 @@ function readIndex(imagesDir) {
     const indexPath = path.join(imagesDir, INDEX_FILE);
     if (!fs.existsSync(indexPath))
         return [];
+    if (fs.lstatSync(indexPath).isSymbolicLink())
+        throw new Error('Symbolic links are not allowed for image index');
     try {
         return JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
     }
@@ -27,7 +52,13 @@ function readIndex(imagesDir) {
     }
 }
 function writeIndex(imagesDir, entries) {
-    fs.writeFileSync(path.join(imagesDir, INDEX_FILE), JSON.stringify(entries, null, 2));
+    const indexPath = path.join(imagesDir, INDEX_FILE);
+    if (fs.existsSync(indexPath) && fs.lstatSync(indexPath).isSymbolicLink()) {
+        throw new Error('Symbolic links are not allowed for image index');
+    }
+    const tempPath = path.join(imagesDir, `.index-${process.pid}.tmp`);
+    fs.writeFileSync(tempPath, JSON.stringify(entries, null, 2));
+    fs.renameSync(tempPath, indexPath);
 }
 /** Save an image buffer to `.ai/images/` and update the index. Returns the UID and relative path. */
 export async function saveImage(worktreePath, fileBuffer, originalName) {
@@ -39,9 +70,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
         throw new Error(`Unsupported image extension: '${ext}'. Allowed: ${[...ALLOWED_EXTENSIONS].join(', ')}`);
     }
     const uid = nanoid(10);
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
-    // mkdirSync is idempotent — safe to call outside the lock
-    fs.mkdirSync(imagesDir, { recursive: true });
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     const filename = `${uid}.${ext}`;
     await withLock(worktreePath, () => {
         // Write the image file inside the lock so both the file write and index
@@ -55,7 +84,7 @@ export async function saveImage(worktreePath, fileBuffer, originalName) {
 }
 /** Delete an image by UID from disk and the index. */
 export async function deleteImage(worktreePath, uid) {
-    const imagesDir = path.join(worktreePath, IMAGES_DIR);
+    const imagesDir = ensureRealImagesDirectory(worktreePath);
     await withLock(worktreePath, () => {
         const entries = readIndex(imagesDir);
         const idx = entries.findIndex((e) => e.uid === uid);

package/dist/server/services/pr-watcher-service.js

@@ -18,8 +18,19 @@ import { purgeWorktree } from './worktree-purge-service.js';
 // it is recorded but NOT acted upon — prevents re-archiving manually
 // unarchived workspaces.
 const POLL_INTERVAL_MS = 30 * 1000; // 30 seconds
+const WORKSPACE_CHECK_CONCURRENCY = 4;
 let timer = null;
 let checking = false;
+async function runBounded(items, concurrency, worker) {
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+        while (nextIndex < items.length) {
+            const item = items[nextIndex++];
+            await worker(item);
+        }
+    });
+    await Promise.all(workers);
+}
 /** Tracks the last known PR snapshot per workspace, used to detect transitions
  *  (state, base, reviewDecision). */
 const lastKnownPr = new Map();
@@ -110,11 +121,11 @@ export async function checkPrStatuses() {
             lastKnownGitStats.delete(id);
         }
     }
-    for (const ws of workspaces) {
+    await runBounded(workspaces, WORKSPACE_CHECK_CONCURRENCY, async (ws) => {
         // Without this guard, every git/forge spawn below fails with ENOENT and
         // floods the logs when a worktree was deleted externally.
         if (!fs.existsSync(ws.worktreePath))
-            continue;
+            return;
         try {
             // Opt-out: skip the forge call entirely for a workspace with PR-watch
             // disabled — no PR-status fetch, no auto-archive/purge, no PR-derived
@@ -143,7 +154,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] updateWorkspaceSourceBranch failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                         // Leave the cache untouched so the next tick retries — and skip
                         // stats too, since they'd be computed against the stale base.
-                        continue;
+                        return;
                     }
                 }
             }
@@ -158,7 +169,7 @@ export async function checkPrStatuses() {
                 console.error(`[pr-watcher] computeGitStats failed for '${ws.name}':`, err instanceof Error ? err.message : err);
             }
             if (!pr)
-                continue;
+                return;
             const prev = lastKnownPr.get(ws.id);
             // We delay updating `lastKnownPr` until after the actions succeed.
             // Setting it eagerly would poison the cache: if updateWorkspaceSourceBranch
@@ -179,13 +190,13 @@ export async function checkPrStatuses() {
                     // (The defensive base preservation from the no-base branch doesn't apply here
                     // because we ARE in the OPEN→MERGED/CLOSED branch which always has a base.)
                     lastKnownPr.set(ws.id, pr);
-                    continue;
+                    return;
                 }
                 console.log(`[pr-watcher] PR ${pr.state.toLowerCase()} for workspace '${ws.name}' — archiving`);
                 // Best-effort cleanup (same as manual archive): stop dev server + terminal.
                 // Agent is already not running here (guarded above).
                 try {
-                    stopDevServer(ws.id);
+                    await stopDevServer(ws.id);
                 }
                 catch (err) {
                     console.error(`[pr-watcher] stopDevServer failed for '${ws.name}':`, err instanceof Error ? err.message : err);
@@ -217,7 +228,7 @@ export async function checkPrStatuses() {
                         console.error(`[pr-watcher] auto-purge guard failed for '${ws.name}':`, err instanceof Error ? err.message : err);
                     }
                 }
-                continue; // do not run base-change detection on a workspace we just archived
+                return; // do not run base-change detection on a workspace we just archived
             }
             // Review, CI, mergeability, and readiness transitions (only on OPEN PRs;
             // first-sight is silent). Each check is independent so simultaneous
@@ -254,7 +265,7 @@ export async function checkPrStatuses() {
             if (pr.state !== 'OPEN' || !pr.base) {
                 const next = pr.base ? pr : { ...pr, base: prev?.base ?? pr.base };
                 lastKnownPr.set(ws.id, next);
-                continue;
+                return;
             }
             lastKnownPr.set(ws.id, pr);
             // Emit the base-change event AFTER the snapshot is committed so a
@@ -272,7 +283,7 @@ export async function checkPrStatuses() {
         catch (err) {
             console.error(`[pr-watcher] Failed to check PR for workspace '${ws.name}':`, err instanceof Error ? err.message : err);
         }
-    }
+    });
 }
 /**
  * On-demand refresh of a single workspace's PR snapshot. Bypasses the 30s tick.

package/dist/server/services/search-service.js

@@ -1,6 +1,6 @@
 import { getDb } from '../db/index.js';
 /** Event types that carry user-authored or assistant-authored readable text. */
-const SEARCHABLE_TYPES = ['user:message', 'agent:output'];
+const SEARCHABLE_TYPES = ['user:message', 'agent:event', 'agent:output'];
 const SNIPPET_CONTEXT = 100; // chars on each side of the match
 /**
  * Extract the readable text content of a ws_events payload, or `null` when
@@ -29,6 +29,9 @@ function extractReadableText(type, payload) {
             return parts.length > 0 ? parts.join('\n') : null;
         }
     }
+    if (type === 'agent:event' && p.kind === 'message:text') {
+        return typeof p.text === 'string' ? p.text : null;
+    }
     return null;
 }
 function buildSnippet(text, matchIndex, query) {
@@ -56,49 +59,59 @@ export function searchEvents(query, options = {}) {
     const db = getDb();
     const typePlaceholders = SEARCHABLE_TYPES.map(() => '?').join(', ');
     const archiveFilter = includeArchived ? '' : 'AND w.archived_at IS NULL';
-    const likePattern = `%${trimmed}%`;
-    // Over-fetch a bit so post-filter rejects don't shrink us below `limit` on
-    // realistic datasets, without scanning the entire table.
-    const dbLimit = Math.max(limit * 3, 100);
-    const rows = db
-        .prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
-              w.name AS workspace_name, w.archived_at
-       FROM ws_events e
-       JOIN workspaces w ON e.workspace_id = w.id
-       WHERE e.type IN (${typePlaceholders})
-         AND e.payload LIKE ?
-         ${archiveFilter}
-       ORDER BY e.created_at DESC
-       LIMIT ?`)
-        .all(...SEARCHABLE_TYPES, likePattern, dbLimit);
+    const escapedQuery = trimmed.replace(/[\\%_]/g, '\\$&');
+    const likePattern = `%${escapedQuery}%`;
     const needle = trimmed.toLowerCase();
     const results = [];
-    for (const row of rows) {
-        let parsed;
-        try {
-            parsed = JSON.parse(row.payload);
-        }
-        catch {
-            continue;
+    const batchSize = Math.min(Math.max(limit * 3, 100), 500);
+    const statement = db.prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
+            w.name AS workspace_name, w.archived_at
+     FROM ws_events e
+     JOIN workspaces w ON e.workspace_id = w.id
+     WHERE e.type IN (${typePlaceholders})
+       AND e.payload LIKE ? ESCAPE '\\'
+       ${archiveFilter}
+       AND (? IS NULL OR e.created_at < ? OR (e.created_at = ? AND e.id < ?))
+     ORDER BY e.created_at DESC, e.id DESC
+     LIMIT ?`);
+    let cursorCreatedAt = null;
+    let cursorId = null;
+    while (results.length < limit) {
+        const rows = statement.all(...SEARCHABLE_TYPES, likePattern, cursorCreatedAt, cursorCreatedAt, cursorCreatedAt, cursorId, batchSize);
+        for (const row of rows) {
+            let parsed;
+            try {
+                parsed = JSON.parse(row.payload);
+            }
+            catch {
+                continue;
+            }
+            const text = extractReadableText(row.type, parsed);
+            if (!text)
+                continue;
+            const idx = text.toLowerCase().indexOf(needle);
+            if (idx < 0)
+                continue;
+            results.push({
+                eventId: row.id,
+                sessionId: row.session_id,
+                workspaceId: row.workspace_id,
+                workspaceName: row.workspace_name,
+                archived: row.archived_at !== null,
+                type: row.type,
+                timestamp: row.created_at,
+                snippet: buildSnippet(text, idx, trimmed),
+            });
+            if (results.length >= limit)
+                break;
         }
-        const text = extractReadableText(row.type, parsed);
-        if (!text)
-            continue;
-        const idx = text.toLowerCase().indexOf(needle);
-        if (idx < 0)
-            continue;
-        results.push({
-            eventId: row.id,
-            sessionId: row.session_id,
-            workspaceId: row.workspace_id,
-            workspaceName: row.workspace_name,
-            archived: row.archived_at !== null,
-            type: row.type,
-            timestamp: row.created_at,
-            snippet: buildSnippet(text, idx, trimmed),
-        });
-        if (results.length >= limit)
+        if (rows.length < batchSize)
+            break;
+        const last = rows.at(-1);
+        if (!last)
             break;
+        cursorCreatedAt = last.created_at;
+        cursorId = last.id;
     }
     return results;
 }

package/dist/server/services/websocket-service.js

@@ -109,16 +109,18 @@ export function handleConnection(ws) {
 export function emit(workspaceId, type, payload, sessionId) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
+    let replayable = false;
     // Best-effort persist — don't let FK violation (deleted workspace) break the broadcast
     try {
         const db = getDb();
         db.prepare('INSERT INTO ws_events (id, workspace_id, type, payload, session_id, created_at) VALUES (?, ?, ?, ?, ?, ?)').run(id, workspaceId, type, JSON.stringify(payload), sessionId ?? null, createdAt);
+        replayable = true;
     }
     catch (err) {
         console.error(`[websocket-service] Failed to persist event (workspace=${workspaceId}, type=${type}):`, err);
     }
     // Build the event object to send
-    const event = { id, workspaceId, type, payload, sessionId, createdAt };
+    const event = { id, workspaceId, type, payload, sessionId, createdAt, replayable };
     const message = JSON.stringify(event);
     // Broadcast to subscribed clients. Wrap `.send` in try/catch so a dropped
     // client doesn't throw and abort delivery to the remaining subscribers.
@@ -145,7 +147,7 @@ export function emit(workspaceId, type, payload, sessionId) {
 export function emitEphemeral(workspaceId, type, payload) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
-    const event = { id, workspaceId, type, payload, createdAt };
+    const event = { id, workspaceId, type, payload, createdAt, replayable: false };
     const message = JSON.stringify(event);
     let sendErrorLogged = false;
     for (const [ws, subs] of clients) {
@@ -188,12 +190,14 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
     // up. This keeps first-paint fast on long-lived workspaces with tens of
     // thousands of events without ever deleting anything from the DB.
     const INITIAL_WINDOW = 300;
+    let mode = 'snapshot';
     if (lastEventId) {
         // Resume path: replay every event strictly after the cursor (delta
         // since last seen). If the cursor is stale/unknown, fall back to the
         // recent window rather than streaming the entire history.
         const lastRow = db.prepare('SELECT rowid FROM ws_events WHERE id = ?').get(lastEventId);
         if (lastRow) {
+            mode = 'delta';
             rows = db
                 .prepare(`SELECT * FROM ws_events WHERE workspace_id IN (${placeholders}) AND rowid > ? ORDER BY rowid ASC`)
                 .all(...resolvedIds, lastRow.rowid);
@@ -232,9 +236,10 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
             payload: parsedPayload,
             sessionId: row.session_id ?? undefined,
             createdAt: row.created_at,
+            replayable: true,
         };
     });
-    ws.send(JSON.stringify({ type: 'sync:response', payload: { events } }));
+    ws.send(JSON.stringify({ type: 'sync:response', payload: { events, mode } }));
 }
 // ── Utilities ──────────────────────────────────────────────────────────────────
 /**

package/dist/server/services/workspace-service.js

@@ -165,20 +165,29 @@ export function updateWorkspaceStatus(id, status) {
     return getWorkspace(id);
 }
 const WORKSPACE_NAME_MAX_LENGTH = 200;
-/** Update a workspace's display name. */
-export function updateWorkspaceName(id, name) {
-    // Strip control characters (incl. newlines) and collapse whitespace
+function sanitizeWorkspaceName(name) {
     const noControl = Array.from(name, (c) => {
         const code = c.charCodeAt(0);
         return code < 32 || code === 127 ? ' ' : c;
     }).join('');
     const sanitized = noControl.replace(/\s+/g, ' ').trim();
-    if (!sanitized) {
+    if (!sanitized)
         throw new Error('Workspace name cannot be empty');
-    }
     if (sanitized.length > WORKSPACE_NAME_MAX_LENGTH) {
         throw new Error(`Workspace name cannot exceed ${WORKSPACE_NAME_MAX_LENGTH} characters`);
     }
+    return sanitized;
+}
+function normalizeWorkspaceDescription(description) {
+    const trimmed = description == null ? null : description.trim();
+    if (trimmed !== null && trimmed.length > 200) {
+        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
+    }
+    return trimmed && trimmed.length > 0 ? trimmed : null;
+}
+/** Update a workspace's display name. */
+export function updateWorkspaceName(id, name) {
+    const sanitized = sanitizeWorkspaceName(name);
     const db = getDb();
     const now = new Date().toISOString();
     const result = db.prepare('UPDATE workspaces SET name = ?, updated_at = ? WHERE id = ?').run(sanitized, now, id);
@@ -311,11 +320,7 @@ export function updateAgentPermissionMode(id, mode) {
  *   does not exist.
  */
 export function updateWorkspaceDescription(id, description) {
-    const trimmed = description == null ? null : description.trim();
-    if (trimmed !== null && trimmed.length > 200) {
-        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
-    }
-    const stored = trimmed && trimmed.length > 0 ? trimmed : null;
+    const stored = normalizeWorkspaceDescription(description);
     const db = getDb();
     const result = db
         .prepare('UPDATE workspaces SET description = ?, updated_at = ? WHERE id = ?')
@@ -326,6 +331,72 @@ export function updateWorkspaceDescription(id, description) {
     emitEphemeral(id, 'workspace:description-updated', { description: stored });
     return getWorkspace(id);
 }
+/** Validate and persist a multi-field API update with one atomic SQL statement. */
+export function updateWorkspaceFields(id, fields) {
+    const workspace = getWorkspace(id);
+    if (!workspace)
+        throw new Error(`Workspace '${id}' not found`);
+    const assignments = [];
+    const values = [];
+    if (fields.model !== undefined) {
+        if (typeof fields.model !== 'string' || !fields.model.trim())
+            throw new Error('model must be a non-empty string');
+        assignments.push('model = ?');
+        values.push(fields.model.trim());
+    }
+    if (fields.reasoningEffort !== undefined) {
+        if (typeof fields.reasoningEffort !== 'string' || !fields.reasoningEffort.trim()) {
+            throw new Error('reasoningEffort must be a non-empty string');
+        }
+        assignments.push('reasoning_effort = ?');
+        values.push(fields.reasoningEffort.trim());
+    }
+    if (fields.agentPermissionMode !== undefined) {
+        if (!['plan', 'bypass', 'strict', 'interactive'].includes(fields.agentPermissionMode)) {
+            throw new Error('Invalid agentPermissionMode');
+        }
+        const legacyMode = fields.agentPermissionMode === 'plan' ? 'plan' : 'auto-accept';
+        const legacyProfile = fields.agentPermissionMode === 'plan' ? 'bypass' : fields.agentPermissionMode;
+        assignments.push('agent_permission_mode = ?', 'permission_mode = ?', 'permission_profile = ?');
+        values.push(fields.agentPermissionMode, legacyMode, legacyProfile);
+    }
+    if (fields.status !== undefined) {
+        const allowed = VALID_TRANSITIONS[workspace.status];
+        if (!allowed || (fields.status !== workspace.status && !allowed.includes(fields.status))) {
+            throw new Error(`Invalid status transition from '${workspace.status}' to '${fields.status}'. Allowed: ${allowed?.join(', ') ?? ''}`);
+        }
+        assignments.push('status = ?');
+        values.push(fields.status);
+    }
+    if (fields.name !== undefined) {
+        if (typeof fields.name !== 'string')
+            throw new Error('name must be a string');
+        assignments.push('name = ?');
+        values.push(sanitizeWorkspaceName(fields.name));
+    }
+    const hasDescription = Object.hasOwn(fields, 'description');
+    let storedDescription;
+    if (hasDescription) {
+        if (fields.description !== null && typeof fields.description !== 'string') {
+            throw new Error('description must be a string or null');
+        }
+        storedDescription = normalizeWorkspaceDescription(fields.description ?? null);
+        assignments.push('description = ?');
+        values.push(storedDescription);
+    }
+    if (assignments.length === 0)
+        return workspace;
+    assignments.push('updated_at = ?');
+    values.push(new Date().toISOString(), id);
+    const result = getDb()
+        .prepare(`UPDATE workspaces SET ${assignments.join(', ')} WHERE id = ?`)
+        .run(...values);
+    if (result.changes === 0)
+        throw new Error(`Workspace '${id}' not found`);
+    if (hasDescription)
+        emitEphemeral(id, 'workspace:description-updated', { description: storedDescription ?? null });
+    return getWorkspace(id);
+}
 /**
  * Update a workspace's agent-side description (≤ 200 chars after trim).
  * Empty string (after trim) or `null` clears the column.

package/dist/server/services/worktree-purge-service.js

@@ -24,7 +24,7 @@ export async function purgeWorktree(workspaceId) {
         console.error(`[purge] stopAgent failed for '${workspace.name}':`, msg);
     }
     try {
-        devServerService.stopDevServer(workspaceId);
+        await devServerService.stopDevServer(workspaceId);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);