@loicngr/kobo 2.1.2 → 2.1.5

package/dist/server/services/ws-events-retention-service.js

@@ -1,133 +1,226 @@
-import { recomputeSessionMetricsOn } from './workspace-service.js';
-/** Rows deleted per transaction. Small enough that the SQLite write lock is
- *  never held for more than a few milliseconds at a time — the whole point of
- *  doing this AFTER the quadratic AFTER DELETE trigger was removed. */
-const BATCH_SIZE = 5_000;
-/** Free-page ratio above which a full VACUUM is worth its cost. Production was
- *  measured at 620 free pages out of 656 (95 %) for zero remaining rows. */
+import { setImmediate as yieldToEventLoop } from 'node:timers/promises';
+/** Keep each write transaction short enough for live event writers. */
+const BATCH_SIZE = 500;
 const VACUUM_FREE_PAGE_RATIO = 0.25;
-/** Retention is OPT-IN: absent or invalid settings mean "delete nothing". */
 const DISABLED = 0;
-/** Anything that is not a non-negative integer falls back to "disabled": a bad
- *  value must never be read as a licence to delete. */
 function normalize(value) {
-    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : DISABLED;
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : DISABLED;
 }
-/** Read the retention window from the global settings. */
 export function resolveRetentionConfig(global) {
     return {
         retentionDays: normalize(global.wsEventsRetentionDays),
         keepPerWorkspace: normalize(global.wsEventsKeepPerWorkspace),
     };
 }
-/** Shared candidate selection: rows older than the cutoff that fall outside the
- *  per-workspace tail. Used both to count (preview) and to delete. */
-const CANDIDATE_CTE = `
-  WITH ranked AS (
-    SELECT rowid AS rid,
-           workspace_id,
-           session_id,
-           created_at,
-           ROW_NUMBER() OVER (PARTITION BY workspace_id ORDER BY rowid DESC) AS rn
-    FROM ws_events
-  )`;
 function cutoffFor(config, nowMs) {
     return new Date(nowMs - config.retentionDays * 24 * 60 * 60 * 1000).toISOString();
 }
-/**
- * How many events `config` would delete right now. Deletes nothing — this backs
- * the confirmation dialog, so the user is told the real volume before agreeing
- * to destroy it.
- */
+/** Compute each protected tail once using the workspace/rowid index. Rows
+ * appended beyond the initial rowid are outside this pass. The age cutoff also
+ * protects newly emitted events while other workspaces continue writing. */
+function workspaceBoundaries(db, keep) {
+    return db.transaction(() => {
+        const last = db.prepare('SELECT rowid AS rid FROM ws_events ORDER BY rowid DESC LIMIT 1').get();
+        if (!last)
+            return [];
+        const workspaces = db.prepare('SELECT id FROM workspaces ORDER BY id').all();
+        const tail = db.prepare('SELECT rowid AS rid FROM ws_events WHERE workspace_id = ? AND rowid <= ? ORDER BY rowid DESC LIMIT 1 OFFSET ?');
+        return workspaces.map(({ id }) => {
+            const boundary = keep > 0 ? tail.get(id, last.rid, keep - 1) : undefined;
+            return {
+                workspaceId: id,
+                beforeRowid: keep > 0 ? (boundary?.rid ?? 0) : last.rid + 1,
+                afterRowid: 0,
+            };
+        });
+    })();
+}
+/** Read-only preview, using the same protected boundaries as deletion. */
 export function countPrunableWsEvents(db, config, nowMs = Date.now()) {
     if (config.retentionDays <= 0)
         return 0;
-    const row = db
-        .prepare(`${CANDIDATE_CTE}
-       SELECT COUNT(*) AS c FROM ranked WHERE created_at < ? AND rn > ?`)
-        .get(cutoffFor(config, nowMs), config.keepPerWorkspace);
-    return row.c;
-}
-/**
- * Delete `ws_events` rows older than the retention window, batch by batch, then
- * recompute the metrics of the sessions touched and reclaim the freed pages.
- *
- * Deletes agent output ONLY: workspaces, tasks, sessions, branches and worktrees
- * are never touched.
- *
- * Order matters: this must never run while the removed `AFTER DELETE` trigger
- * is present — it re-aggregated the whole session per deleted row and held the
- * write lock long enough to make every concurrent WebSocket emit time out and
- * lose its event.
- */
-export function pruneWsEvents(db, config, nowMs = Date.now()) {
-    const freePagesBefore = db.pragma('freelist_count', { simple: true }) ?? 0;
-    const result = {
-        deleted: 0,
-        sessionsRecomputed: 0,
-        vacuumed: false,
-        freePagesBefore,
-        freePagesAfter: freePagesBefore,
-    };
-    if (config.retentionDays <= 0)
-        return result;
+    const count = db.prepare('SELECT COUNT(*) AS count FROM ws_events WHERE workspace_id = ? AND rowid < ? AND created_at < ?');
     const cutoff = cutoffFor(config, nowMs);
-    const selectBatch = db.prepare(`${CANDIDATE_CTE}
-     SELECT rid, workspace_id, session_id
-     FROM ranked
-     WHERE created_at < ? AND rn > ?
-     ORDER BY rid ASC
-     LIMIT ?`);
-    const deleteOne = db.prepare('DELETE FROM ws_events WHERE rowid = ?');
-    const touched = new Set();
-    for (;;) {
-        const batch = selectBatch.all(cutoff, config.keepPerWorkspace, BATCH_SIZE);
-        if (batch.length === 0)
-            break;
-        db.transaction(() => {
+    return workspaceBoundaries(db, config.keepPerWorkspace).reduce((total, boundary) => total + count.get(boundary.workspaceId, boundary.beforeRowid, cutoff).count, 0);
+}
+/** Aggregate outside the write transaction; concurrent WAL writers may keep emitting. */
+function readSessionMetrics(db, workspaceId, sessionId) {
+    const signature = db
+        .prepare(`SELECT COUNT(*) AS rows, COALESCE(MAX(rowid), 0) AS maxRowid
+       FROM ws_events WHERE workspace_id = ? AND session_id = ?`)
+        .get(workspaceId, sessionId);
+    return { ...signature, ...readMetricsAfter(db, workspaceId, sessionId, 0) };
+}
+function readMetricsAfter(db, workspaceId, sessionId, afterRowid) {
+    return db
+        .prepare(`SELECT
+         COUNT(*) AS events,
+         COALESCE(SUM(CASE WHEN json_extract(e.payload, '$.kind') = 'tool:call' THEN 1 ELSE 0 END), 0) AS toolCalls,
+         COALESCE(SUM(CASE WHEN json_extract(e.payload, '$.kind') = 'error'
+           OR (json_extract(e.payload, '$.kind') = 'tool:result'
+             AND json_extract(e.payload, '$.isError') = 1) THEN 1 ELSE 0 END), 0) AS errors,
+         COALESCE(MAX(CASE WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.inputTokens') IN ('integer', 'real')
+           THEN CAST(json_extract(e.payload, '$.inputTokens') AS INTEGER) ELSE 0 END), 0) AS inputTokens,
+         COALESCE(MAX(CASE WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.outputTokens') IN ('integer', 'real')
+           THEN CAST(json_extract(e.payload, '$.outputTokens') AS INTEGER) ELSE 0 END), 0) AS outputTokens
+       FROM ws_events e
+       JOIN agent_sessions s ON s.id = e.session_id AND s.workspace_id = e.workspace_id
+       WHERE e.workspace_id = ? AND e.session_id = ? AND e.rowid > ?
+         AND e.type = 'agent:event' AND json_valid(e.payload)`)
+        .get(workspaceId, sessionId, afterRowid);
+}
+class RetentionPass {
+    db;
+    result;
+    boundaries;
+    cutoff;
+    selectBatch;
+    deleteOne;
+    touched = new Map();
+    workspaceIndex = 0;
+    constructor(db, config, nowMs) {
+        this.db = db;
+        const freePagesBefore = db.pragma('freelist_count', { simple: true });
+        this.result = {
+            deleted: 0,
+            sessionsRecomputed: 0,
+            vacuumed: false,
+            freePagesBefore,
+            freePagesAfter: freePagesBefore,
+        };
+        this.boundaries = config.retentionDays > 0 ? workspaceBoundaries(db, config.keepPerWorkspace) : [];
+        this.cutoff = config.retentionDays > 0 ? cutoffFor(config, nowMs) : '';
+        this.selectBatch = db.prepare(`SELECT id, rowid AS rid, session_id FROM ws_events
+       WHERE workspace_id = ? AND rowid > ? AND rowid < ? AND created_at < ?
+       ORDER BY rowid ASC LIMIT ?`);
+        this.deleteOne = db.prepare('DELETE FROM ws_events WHERE rowid = ? AND id = ?');
+    }
+    /** One indexed read and at most BATCH_SIZE deletes; no whole-table reranking. */
+    step() {
+        const boundary = this.boundaries[this.workspaceIndex];
+        if (!boundary)
+            return false;
+        const batch = this.selectBatch.all(boundary.workspaceId, boundary.afterRowid, boundary.beforeRowid, this.cutoff, BATCH_SIZE);
+        const touched = new Set();
+        const deleted = this.db
+            .transaction(() => {
+            let count = 0;
             for (const row of batch) {
-                deleteOne.run(row.rid);
-                if (row.session_id)
-                    touched.add(`${row.workspace_id}::${row.session_id}`);
+                const change = this.deleteOne.run(row.rid, row.id).changes;
+                count += change;
+                if (change && row.session_id)
+                    touched.add(row.session_id);
             }
-        })();
-        result.deleted += batch.length;
+            return count;
+        })
+            .immediate();
+        this.result.deleted += deleted;
+        if (touched.size) {
+            const sessions = this.touched.get(boundary.workspaceId) ?? new Set();
+            for (const sessionId of touched)
+                sessions.add(sessionId);
+            this.touched.set(boundary.workspaceId, sessions);
+        }
+        if (batch.length)
+            boundary.afterRowid = batch[batch.length - 1].rid;
         if (batch.length < BATCH_SIZE)
-            break;
+            this.workspaceIndex++;
+        return true;
     }
-    // Once per session, at the very end — never per deleted row.
-    for (const key of touched) {
-        const separator = key.indexOf('::');
-        const workspaceId = key.slice(0, separator);
-        const sessionId = key.slice(separator + 2);
-        try {
-            recomputeSessionMetricsOn(db, workspaceId, sessionId);
-            result.sessionsRecomputed += 1;
-        }
-        catch (err) {
-            console.error(`[retention] metric recompute failed (workspace=${workspaceId}, session=${sessionId}):`, err);
+    async finishAsync() {
+        for (const [workspaceId, sessions] of this.touched) {
+            for (const sessionId of sessions) {
+                // Transactional recompute cannot overwrite metrics from a concurrent emit.
+                await this.recomputeAsync(workspaceId, sessionId);
+                await yieldToEventLoop();
+            }
         }
+        return this.finish(false);
     }
-    if (result.deleted === 0)
-        return result;
-    // Truncate the WAL, then compact only when it is actually worth it.
-    try {
-        db.pragma('wal_checkpoint(TRUNCATE)');
+    finishSync(compact) {
+        for (const [workspaceId, sessions] of this.touched) {
+            for (const sessionId of sessions)
+                this.recomputeSync(workspaceId, sessionId);
+        }
+        return this.finish(compact);
     }
-    catch (err) {
-        console.error('[retention] wal_checkpoint failed:', err);
+    async recomputeAsync(workspaceId, sessionId) {
+        while (!this.recomputeOnce(workspaceId, sessionId))
+            await yieldToEventLoop();
+        this.result.sessionsRecomputed++;
     }
-    const freelist = db.pragma('freelist_count', { simple: true }) ?? 0;
-    const pageCount = db.pragma('page_count', { simple: true }) ?? 0;
-    if (pageCount > 0 && freelist / pageCount >= VACUUM_FREE_PAGE_RATIO) {
-        try {
-            db.exec('VACUUM');
-            result.vacuumed = true;
+    recomputeSync(workspaceId, sessionId) {
+        while (!this.recomputeOnce(workspaceId, sessionId)) {
+            // The synchronous maintenance API has no interleaved local writer;
+            // a second connection may still change this session between phases.
         }
-        catch (err) {
-            console.error('[retention] VACUUM failed:', err);
+        this.result.sessionsRecomputed++;
+    }
+    recomputeOnce(workspaceId, sessionId) {
+        const snapshot = this.db.transaction(() => readSessionMetrics(this.db, workspaceId, sessionId))();
+        return this.db
+            .transaction(() => {
+            const unchanged = this.db
+                .prepare(`SELECT COUNT(*) AS rows FROM ws_events
+           WHERE workspace_id = ? AND session_id = ? AND rowid <= ?`)
+                .get(workspaceId, sessionId, snapshot.maxRowid);
+            if (unchanged.rows !== snapshot.rows)
+                return false;
+            // Rows appended after the read snapshot are small and are aggregated
+            // under the lock so the insert trigger cannot race with our replacement.
+            const appended = readMetricsAfter(this.db, workspaceId, sessionId, snapshot.maxRowid);
+            this.db
+                .prepare('DELETE FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?')
+                .run(workspaceId, sessionId);
+            if (snapshot.events + appended.events === 0)
+                return true;
+            this.db
+                .prepare(`INSERT INTO session_event_metrics (
+             workspace_id, session_id, tool_calls, errors, input_tokens, output_tokens
+           ) SELECT ?, ?, ?, ?, ?, ? WHERE EXISTS (
+             SELECT 1 FROM agent_sessions WHERE id = ? AND workspace_id = ?
+           )`)
+                .run(workspaceId, sessionId, snapshot.toolCalls + appended.toolCalls, snapshot.errors + appended.errors, Math.max(snapshot.inputTokens, appended.inputTokens), Math.max(snapshot.outputTokens, appended.outputTokens), sessionId, workspaceId);
+            return true;
+        })
+            .immediate();
+    }
+    finish(compact) {
+        if (!this.result.deleted)
+            return this.result;
+        // PASSIVE never waits for live readers. Reusable pages remain available for
+        // new events. Full VACUUM is reserved for explicit offline maintenance.
+        this.db.pragma(`wal_checkpoint(${compact ? 'TRUNCATE' : 'PASSIVE'})`);
+        const freelist = this.db.pragma('freelist_count', { simple: true });
+        const pageCount = this.db.pragma('page_count', { simple: true });
+        if (compact && pageCount > 0 && freelist / pageCount >= VACUUM_FREE_PAGE_RATIO) {
+            this.db.exec('VACUUM');
+            this.result.vacuumed = true;
         }
+        this.result.freePagesAfter = this.db.pragma('freelist_count', { simple: true });
+        return this.result;
+    }
+}
+/** Synchronous helper for offline maintenance and fixtures. Never call from
+ * HTTP handlers or the server scheduler; use the dedicated worker service. */
+export function pruneWsEvents(db, config, nowMs = Date.now(), options = {}) {
+    const pass = new RetentionPass(db, config, nowMs);
+    while (pass.step()) { }
+    return pass.finishSync(options.compact ?? true);
+}
+/** Worker-only maintenance: yield between bounded transactions so stop requests
+ * are handled promptly. Always repair touched session metrics before closing. */
+export async function pruneWsEventsInBatches(db, config, nowMs = Date.now(), shouldStop = () => false) {
+    const pass = new RetentionPass(db, config, nowMs);
+    try {
+        while (!shouldStop() && pass.step())
+            await yieldToEventLoop();
+    }
+    catch (error) {
+        await pass.finishAsync();
+        throw error;
     }
-    result.freePagesAfter = db.pragma('freelist_count', { simple: true }) ?? 0;
-    return result;
+    return pass.finishAsync();
 }

package/dist/server/services/ws-events-retention-worker-service.js

@@ -0,0 +1,112 @@
+import { Worker } from 'node:worker_threads';
+import { getDb } from '../db/index.js';
+let active;
+let requestId = 0;
+function start() {
+    const dbPath = getDb().name;
+    if (active) {
+        if (active.stopping)
+            throw new Error('Retention worker stopped');
+        if (active.dbPath !== dbPath)
+            throw new Error('Stop the retention worker before replacing its database');
+        return active;
+    }
+    if (!dbPath || dbPath === ':memory:')
+        throw new Error('Retention worker requires a file-backed database');
+    const development = import.meta.url.endsWith('.ts');
+    const entry = new URL(`./retention/worker.${development ? 'ts' : 'js'}`, import.meta.url);
+    const worker = development
+        ? new Worker(`const { workerData } = require('node:worker_threads'); import('tsx/esm/api').then(({ tsImport }) => tsImport(workerData.entry, workerData.parent));`, { eval: true, workerData: { dbPath, entry: entry.href, parent: import.meta.url } })
+        : new Worker(entry, { workerData: { dbPath } });
+    const state = { worker, dbPath, pending: new Map() };
+    active = state;
+    worker.unref();
+    const fail = (error) => {
+        for (const request of state.pending.values())
+            request.reject(error);
+        state.pending.clear();
+    };
+    worker.on('error', fail);
+    worker.on('exit', (code) => {
+        fail(new Error(`Retention worker stopped (${code})`));
+        if (active === state)
+            active = undefined;
+    });
+    worker.on('message', (message) => {
+        const pending = state.pending.get(message.id);
+        if (!pending)
+            return;
+        state.pending.delete(message.id);
+        if (message.error)
+            pending.reject(new Error(message.error));
+        else if (message.result)
+            pending.resolve(message.result);
+        else
+            pending.reject(new Error('Retention worker returned no result'));
+        if (!state.pending.size && !state.stopping)
+            worker.unref();
+    });
+    return state;
+}
+function request(config, nowMs, preview) {
+    let state;
+    try {
+        state = start();
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    // Coalesce the same policy around the first request's snapshot time; distinct
+    // configurations remain serialized in
+    // the same worker, so two maintenance passes never compete for write locks.
+    const key = JSON.stringify([preview, config.retentionDays, config.keepPerWorkspace]);
+    for (const pending of state.pending.values())
+        if (pending.key === key)
+            return pending.promise;
+    const id = ++requestId;
+    let resolve;
+    let reject;
+    const promise = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    state.pending.set(id, { key, promise, resolve, reject });
+    state.worker.ref();
+    state.worker.postMessage({ id, config, nowMs, preview });
+    return promise;
+}
+/** Daily/boot maintenance runs off the HTTP thread and never VACUUMs live data. */
+export function runWsEventsRetention(config, nowMs = Date.now()) {
+    if (config.retentionDays <= 0) {
+        return Promise.resolve({
+            deleted: 0,
+            sessionsRecomputed: 0,
+            vacuumed: false,
+            freePagesBefore: 0,
+            freePagesAfter: 0,
+        });
+    }
+    return request(config, nowMs, false);
+}
+/** The confirmation preview is also off the live event loop. */
+export function previewWsEventsRetention(config, nowMs = Date.now()) {
+    return request(config, nowMs, true);
+}
+/** Stop after the current bounded transaction, repair affected metrics and
+ * confirm worker exit before the server closes its main SQLite connection. */
+export function stopWsEventsRetention() {
+    const state = active;
+    if (!state)
+        return Promise.resolve();
+    if (state.stopping)
+        return state.stopping;
+    for (const pending of state.pending.values())
+        pending.reject(new Error('Retention worker stopped'));
+    state.pending.clear();
+    state.worker.ref();
+    state.stopping = new Promise((resolve) => {
+        state.worker.once('exit', () => resolve());
+        state.worker.postMessage({ stop: true });
+    });
+    return state.stopping;
+}

package/dist/server/utils/atomic-json-file.js

@@ -0,0 +1,23 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+/** Replace a JSON file only after a complete write in the same filesystem. */
+export function writeJsonFileAtomically(filePath, value) {
+    const contents = JSON.stringify(value, null, 2);
+    const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
+    mkdirSync(path.dirname(filePath), { recursive: true });
+    try {
+        writeFileSync(temporaryPath, contents, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        renameSync(temporaryPath, filePath);
+    }
+    finally {
+        try {
+            unlinkSync(temporaryPath);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                console.error('[atomic-json-file] Failed to remove temporary file:', error);
+            }
+        }
+    }
+}