@loicngr/kobo 2.1.4 → 2.1.5

package/dist/server/services/engine-handoff-service.js

@@ -1,41 +1,137 @@
-import { execFileSync } from 'node:child_process';
 import { getDb } from '../db/index.js';
-function runGit(worktreePath, args) {
+import { getWorkingTreeDiffStatsAsync, getWorkingTreePorcelainAsync } from '../utils/git-ops.js';
+const MAX_RECENT_MESSAGES = 6;
+const MAX_HISTORY_ROWS = 10_000;
+const MAX_MESSAGE_CHARS = 2_000;
+const MAX_CONVERSATION_CHARS = 12_000;
+const TRUNCATED = '[Earlier text omitted]\n';
+/** Normalized text events are deltas; a non-streaming snapshot is complete. */
+function readableFragment(row) {
     try {
-        return execFileSync('git', args.split(' '), { cwd: worktreePath, encoding: 'utf8', timeout: 10_000 }).trim();
+        const payload = JSON.parse(row.payload);
+        if (!payload || typeof payload !== 'object')
+            return null;
+        if (row.type === 'user:message' &&
+            typeof payload.content === 'string' &&
+            (payload.sender === undefined || payload.sender === 'user')) {
+            return { key: `user:${row.id}`, role: 'user', text: payload.content, complete: true };
+        }
+        if (row.type === 'agent:event' && payload.kind === 'message:text' && typeof payload.text === 'string') {
+            return {
+                // A resumed/native session may reuse the same message id elsewhere.
+                key: JSON.stringify([row.session_id, typeof payload.messageId === 'string' ? payload.messageId : row.id]),
+                role: 'assistant',
+                text: payload.text,
+                complete: payload.streaming === false,
+            };
+        }
     }
     catch {
-        return '';
+        // Historical damaged rows are not evidence of a conversation message.
     }
+    return null;
+}
+function boundedText(text, limit) {
+    if (text.length <= limit)
+        return text;
+    const marker = '\n[Middle text omitted]\n';
+    const available = Math.max(0, limit - marker.length);
+    const first = Math.ceil(available / 2);
+    return `${text.slice(0, first)}${marker}${text.slice(-(available - first))}`.slice(0, limit);
 }
 function recentConversation(workspaceId, sessionId) {
-    const rows = getDb()
-        .prepare(`SELECT type, payload FROM ws_events
-       WHERE workspace_id = ? AND (? IS NULL OR session_id = ?)
-         AND (type = 'user:message' OR (type = 'agent:event' AND json_extract(payload, '$.kind') = 'message:text'))
-       ORDER BY rowid DESC LIMIT 6`)
-        .all(workspaceId, sessionId ?? null, sessionId ?? null);
-    return rows
-        .reverse()
-        .flatMap((row) => {
-        try {
-            const payload = JSON.parse(row.payload);
-            const text = typeof payload.content === 'string' ? payload.content : typeof payload.text === 'string' ? payload.text : '';
-            return text ? [text.slice(0, 1600)] : [];
+    const db = getDb();
+    const filter = 'workspace_id = ? AND (? IS NULL OR session_id = ?)';
+    const parameters = [workspaceId, sessionId ?? null, sessionId ?? null];
+    // Pin the most recent real user message independently of streaming volume.
+    const userRows = db
+        .prepare(`SELECT rowid AS ordinal, id, type, payload, session_id FROM ws_events
+       WHERE ${filter} AND type = 'user:message' ORDER BY rowid DESC`)
+        .iterate(...parameters);
+    let latestUser;
+    for (const row of userRows) {
+        const fragment = readableFragment(row);
+        if (!fragment?.text)
+            continue;
+        latestUser = { ...fragment, ordinal: row.ordinal, truncated: false };
+        break;
+    }
+    const rows = db
+        .prepare(`SELECT rowid AS ordinal, id, type, payload, session_id FROM ws_events
+       WHERE ${filter} AND type IN ('user:message', 'agent:event')
+       ORDER BY rowid DESC LIMIT ?`)
+        .iterate(...parameters, MAX_HISTORY_ROWS + 1);
+    const messages = new Map();
+    let scanned = 0;
+    let historyTruncated = false;
+    for (const row of rows) {
+        if (++scanned > MAX_HISTORY_ROWS) {
+            historyTruncated = true;
+            break;
         }
-        catch {
-            return [];
+        const fragment = readableFragment(row);
+        if (!fragment?.text)
+            continue;
+        const existing = messages.get(fragment.key);
+        if (existing) {
+            existing.ordinal = row.ordinal;
+            if (existing.complete)
+                continue;
+            const merged = fragment.text + existing.text;
+            existing.text = merged.slice(-MAX_MESSAGE_CHARS);
+            existing.truncated ||= merged.length > MAX_MESSAGE_CHARS;
+            existing.complete = fragment.complete;
         }
-    })
-        .join('\n\n');
+        else if (messages.size < MAX_RECENT_MESSAGES) {
+            messages.set(fragment.key, {
+                ...fragment,
+                ordinal: row.ordinal,
+                text: fragment.text.slice(-MAX_MESSAGE_CHARS),
+                truncated: fragment.text.length > MAX_MESSAGE_CHARS,
+            });
+        }
+    }
+    const selected = [];
+    const warning = historyTruncated
+        ? '\n\n[Conversation history truncated; recover older context from the source session.]'
+        : '';
+    let remaining = MAX_CONVERSATION_CHARS - warning.length;
+    if (latestUser) {
+        const pinned = `Latest user instruction:\n${boundedText(latestUser.text, 6_000)}`;
+        selected.push({ ordinal: latestUser.ordinal, text: pinned });
+        remaining -= pinned.length + 2;
+        messages.delete(latestUser.key);
+    }
+    const newestFirst = [...messages.values()].sort((a, b) => b.ordinal - a.ordinal);
+    for (const message of newestFirst) {
+        const label = message.role === 'assistant' ? 'Assistant:\n' : 'User:\n';
+        if (remaining <= label.length + TRUNCATED.length + 2)
+            break;
+        const text = message.truncated ? TRUNCATED + message.text : message.text;
+        const rendered = label + boundedText(text, Math.min(MAX_MESSAGE_CHARS, remaining - label.length - 2));
+        selected.push({ ordinal: message.ordinal, text: rendered });
+        remaining -= rendered.length + 2;
+    }
+    return (selected
+        .sort((a, b) => a.ordinal - b.ordinal)
+        .map((message) => message.text)
+        .join('\n\n') + warning);
 }
 /** Build a deterministic, secret-free handoff for a fresh session on another engine. */
-export function buildEngineHandoff(workspace, sourceEngine, targetEngine, sourceSessionId) {
+export async function buildEngineHandoff(workspace, sourceEngine, targetEngine, sourceSessionId) {
     const taskLines = workspace.tasks.length
         ? workspace.tasks.map((task) => `- [${task.status === 'done' ? 'x' : ' '}] ${task.title}`).join('\n')
         : '- No Kōbō task recorded.';
-    const changedFiles = runGit(workspace.worktreePath, 'status --short') || 'No uncommitted changes detected.';
-    const diffStat = runGit(workspace.worktreePath, 'diff --stat') || 'No uncommitted diff stat available.';
+    const [status, diff] = await Promise.allSettled([
+        getWorkingTreePorcelainAsync(workspace.worktreePath),
+        getWorkingTreeDiffStatsAsync(workspace.worktreePath),
+    ]);
+    const changedFiles = status.status === 'fulfilled'
+        ? status.value.trim() || 'No uncommitted changes detected.'
+        : 'Git state unavailable. Verify the working tree before making changes.';
+    const diffStat = diff.status === 'fulfilled'
+        ? diff.value.trim() || 'No uncommitted diff stat available.'
+        : 'Git state unavailable. Run git diff --stat to recover the summary.';
     const history = recentConversation(workspace.id, sourceSessionId) || 'No recent conversation message available.';
     return `# Kōbō engine handoff\n\nYou are taking over this workspace from ${sourceEngine} using ${targetEngine}. Work in the existing worktree and verify the repository state before making changes.\n\n## Objective\n${workspace.description ?? workspace.name}\n\n## Tasks\n${taskLines}\n\n## Git state\n- Branch: ${workspace.workingBranch}\n- Base: ${workspace.sourceBranch}\n- Worktree: ${workspace.worktreePath}\n\nChanged files:\n\`\`\`\n${changedFiles}\n\`\`\`\n\nDiff summary:\n\`\`\`\n${diffStat}\n\`\`\`\n\n## Recent conversation\n${history}\n\n## Recover more context\nIf this handoff is insufficient, use \`kobo__read_workspace_events_csv\` to read the previous workspace conversation in pages (optionally filter by \`session_id\`). Use \`kobo__search_codebase\` to find a precise past decision or user request. Read only the context needed, then continue the task.\n`;
 }

package/dist/server/services/pr-checkout-service.js

@@ -1,7 +1,8 @@
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { promisify } from 'node:util';
 import * as gitOps from '../utils/git-ops.js';
 import { GitConflictError } from '../utils/git-ops.js';
 import { withGitRepoLock } from '../utils/git-repo-lock.js';
@@ -41,23 +42,41 @@ const EMPTY_CHANGES = { present: false, modified: 0, staged: 0, untracked: 0 };
 // interactively over a pipe nobody can answer; the timeout is a backstop for
 // anything else that could still stall (a slow filesystem, a stuck lock).
 const GIT_TIMEOUT_MS = 60_000;
-function git(repoPath, args) {
-    return execFileSync('git', args, {
+const execFileAsync = promisify(execFile);
+async function runGitAsync(repoPath, args, timeout = GIT_TIMEOUT_MS) {
+    const { stdout } = await execFileAsync('git', args, {
         cwd: repoPath,
         encoding: 'utf-8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: GIT_TIMEOUT_MS,
-        env: { ...process.env, LC_ALL: 'C', LANG: 'C', GIT_TERMINAL_PROMPT: '0' },
-    }).trim();
+        timeout,
+        maxBuffer: 64 * 1024 * 1024,
+        env: gitOps.buildNonInteractiveGitEnv(),
+    });
+    return stdout.trim();
+}
+function readGitAsync(repoPath, args) {
+    return runGitAsync(repoPath, args, 15_000);
+}
+async function conflictedFilesAsync(repoPath) {
+    try {
+        return (await readGitAsync(repoPath, ['diff', '--name-only', '--diff-filter=U']))
+            .split('\n')
+            .map((file) => file.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
 }
 /** Compare the local branch against `origin/<branch>`. */
-function diagnoseBranch(projectPath, branch) {
-    if (!gitOps.localBranchExists(projectPath, branch))
+async function diagnoseBranch(projectPath, branch, localExists, remoteExists) {
+    if (!localExists)
         return { state: 'absent' };
-    if (!gitOps.listRemoteBranches(projectPath).includes(`origin/${branch}`))
+    if (!remoteExists)
         return { state: 'in-sync' };
-    const ahead = gitOps.getCommitCount(projectPath, branch, branch);
-    const behind = gitOps.getCommitsBehind(projectPath, branch, branch);
+    const [ahead, behind] = await Promise.all([
+        gitOps.getCommitCountAsync(projectPath, branch, branch),
+        gitOps.getCommitsBehindAsync(projectPath, branch, branch),
+    ]);
     if (ahead > 0 && behind > 0)
         return { state: 'diverged', ahead, behind };
     // Note: `hasCommonAncestor` below is what produces the `no-common-ancestor`
@@ -71,9 +90,9 @@ function diagnoseBranch(projectPath, branch) {
 }
 /** False when the local branch and its remote share no history at all — a name
  *  collision, not a divergence. Every realignment strategy is wrong for it. */
-function hasCommonAncestor(repoPath, branch) {
+async function hasCommonAncestor(repoPath, branch) {
     try {
-        git(repoPath, ['merge-base', branch, `origin/${branch}`]);
+        await readGitAsync(repoPath, ['merge-base', branch, `origin/${branch}`]);
         return true;
     }
     catch {
@@ -107,8 +126,8 @@ async function diagnoseWorktree(projectPath, branch, targetPath, attachedPaths)
     return { worktree: { state: 'none' }, blockers };
 }
 /** Count working-tree changes by category. */
-function diagnoseChanges(worktreePath) {
-    const status = gitOps.getWorkingTreeStatus(worktreePath);
+async function diagnoseChanges(worktreePath) {
+    const status = await gitOps.getWorkingTreeStatusAsync(worktreePath);
     const modified = status.modified ?? 0;
     const staged = status.staged ?? 0;
     const untracked = status.untracked ?? 0;
@@ -130,9 +149,9 @@ export function resolveWorkspaceState(workspaces, branch, projectPath) {
     return { state: 'active', id: match.id, name: match.name };
 }
 /** `git rev-parse <ref>`, or null when the ref does not resolve. */
-function safeRevParse(repoPath, ref) {
+async function safeRevParse(repoPath, ref) {
     try {
-        return git(repoPath, ['rev-parse', ref]);
+        return await readGitAsync(repoPath, ['rev-parse', ref]);
     }
     catch {
         return null;
@@ -140,8 +159,10 @@ function safeRevParse(repoPath, ref) {
 }
 /** Hash the observed state so `/resolve` can refuse a plan built on stale facts. */
 export async function computeFingerprint(report) {
-    const localHead = safeRevParse(report.projectPath, report.headBranch);
-    const remoteHead = safeRevParse(report.projectPath, `origin/${report.headBranch}`);
+    const [localHead, remoteHead] = await Promise.all([
+        safeRevParse(report.projectPath, report.headBranch),
+        safeRevParse(report.projectPath, `origin/${report.headBranch}`),
+    ]);
     const payload = JSON.stringify({
         contents: report.worktree.state === 'orphan' || report.worktree.state === 'attached'
             ? await fingerprintWorktree(report.worktree.path)
@@ -166,12 +187,15 @@ export async function computeFingerprint(report) {
 export async function diagnoseLocalState(projectPath, headBranch, worktreesPath, attachedPaths = new Map(), workspaces = []) {
     const targetWorktreePath = resolveWorkspaceWorktreePath(projectPath, headBranch, worktreesPath);
     const blockers = [];
-    const lockPath = gitOps.getIndexLockPath(projectPath);
+    const [lockPath, localExists, remoteBranches] = await Promise.all([
+        gitOps.getIndexLockPathAsync(projectPath),
+        gitOps.localBranchExistsAsync(projectPath, headBranch),
+        gitOps.listRemoteBranchesAsync(projectPath),
+    ]);
+    const remoteExists = remoteBranches.includes(`origin/${headBranch}`);
     if (lockPath)
         blockers.push({ kind: 'index-lock', lockPath });
-    if (gitOps.localBranchExists(projectPath, headBranch) &&
-        gitOps.listRemoteBranches(projectPath).includes(`origin/${headBranch}`) &&
-        !hasCommonAncestor(projectPath, headBranch)) {
+    if (localExists && remoteExists && !(await hasCommonAncestor(projectPath, headBranch))) {
         blockers.push({ kind: 'no-common-ancestor', branch: headBranch });
     }
     const { worktree, blockers: worktreeBlockers } = await diagnoseWorktree(projectPath, headBranch, targetWorktreePath, attachedPaths);
@@ -184,9 +208,9 @@ export async function diagnoseLocalState(projectPath, headBranch, worktreesPath,
         blockers,
         workspace: resolveWorkspaceState(workspaces, headBranch, projectPath),
         worktree,
-        localChanges: inspectPath ? diagnoseChanges(inspectPath) : EMPTY_CHANGES,
-        ongoingOperation: inspectPath ? gitOps.getOngoingGitOperation(inspectPath) : null,
-        branch: diagnoseBranch(projectPath, headBranch),
+        localChanges: inspectPath ? await diagnoseChanges(inspectPath) : EMPTY_CHANGES,
+        ongoingOperation: inspectPath ? await gitOps.getOngoingGitOperationAsync(inspectPath) : null,
+        branch: await diagnoseBranch(projectPath, headBranch, localExists, remoteExists),
     };
 }
 /**
@@ -198,18 +222,18 @@ export async function diagnoseLocalState(projectPath, headBranch, worktreesPath,
  * Operates on the repository's branch ref, so the caller must hold the repo lock
  * AND the branch must not be checked out anywhere (see the ordering note below).
  */
-export function applyBranchStrategy(repoPath, branch, strategy) {
+export async function applyBranchStrategy(repoPath, branch, strategy) {
     const remoteRef = `origin/${branch}`;
     if (strategy === 'keep')
         return { strategy, backupBranch: null };
     if (strategy === 'fast-forward') {
-        git(repoPath, ['branch', '--force', branch, remoteRef]);
+        await runGitAsync(repoPath, ['branch', '--force', branch, remoteRef]);
         return { strategy, backupBranch: null };
     }
     if (strategy === 'reset-hard') {
         const backupBranch = `kobo-backup/${branch}-${Date.now()}`;
-        git(repoPath, ['branch', backupBranch, branch]);
-        git(repoPath, ['branch', '--force', branch, remoteRef]);
+        await runGitAsync(repoPath, ['branch', backupBranch, branch]);
+        await runGitAsync(repoPath, ['branch', '--force', branch, remoteRef]);
         return { strategy, backupBranch };
     }
     // strategy === 'rebase': `git rebase <upstream> <branch>` is shorthand for
@@ -219,14 +243,14 @@ export function applyBranchStrategy(repoPath, branch, strategy) {
     // can restore it once the rebase completes cleanly. If HEAD is detached,
     // `--abbrev-ref` returns the literal string "HEAD", which isn't a valid ref
     // to check back out — fall back to the SHA in that case.
-    const currentRef = git(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
-    const originalCheckout = currentRef === 'HEAD' ? git(repoPath, ['rev-parse', 'HEAD']) : currentRef;
+    const currentRef = await readGitAsync(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    const originalCheckout = currentRef === 'HEAD' ? await readGitAsync(repoPath, ['rev-parse', 'HEAD']) : currentRef;
     try {
-        git(repoPath, ['rebase', remoteRef, branch]);
+        await runGitAsync(repoPath, ['rebase', remoteRef, branch]);
     }
     catch (err) {
-        const conflicted = gitOps.getConflictedFiles(repoPath);
-        if (conflicted.length > 0 || gitOps.getOngoingGitOperation(repoPath) === 'rebase') {
+        const conflicted = await conflictedFilesAsync(repoPath);
+        if (conflicted.length > 0 || (await gitOps.getOngoingGitOperationAsync(repoPath)) === 'rebase') {
             // Leave the rebase in progress on `branch` so the caller can abort or
             // request agent-assisted resolution — do NOT restore the original checkout.
             throw new GitConflictError('rebase', conflicted);
@@ -235,7 +259,7 @@ export function applyBranchStrategy(repoPath, branch, strategy) {
         throw new Error(`Rebase of '${branch}' onto '${remoteRef}' failed: ${message}`);
     }
     // Clean rebase: restore the working copy to exactly what was checked out before.
-    git(repoPath, ['checkout', originalCheckout]);
+    await runGitAsync(repoPath, ['checkout', originalCheckout]);
     return { strategy, backupBranch: null };
 }
 /** The repository moved between diagnosis and resolution. */
@@ -272,7 +296,7 @@ function resolvePrCheckoutLocked(input, owner) {
             throw new Error('Stop the workspace agent before changing its checkout');
         const applied = [];
         // 1. Refresh, then refuse a plan built on facts that no longer hold.
-        gitOps.fetchSourceBranch(input.projectPath, input.headBranch);
+        await gitOps.fetchSourceBranchOrThrowAsync(input.projectPath, input.headBranch);
         applied.push({ kind: 'fetch', detail: `origin/${input.headBranch}` });
         const fresh = await diagnoseLocalState(input.projectPath, input.headBranch, input.worktreesPath, input.attachedPaths ?? new Map(), input.workspaces ?? []);
         if ((await computeFingerprint(fresh)) !== input.fingerprint)
@@ -288,7 +312,7 @@ function resolvePrCheckoutLocked(input, owner) {
         }
         // 2. Clear stale worktree metadata before anything needs the path.
         if (fresh.worktree.state === 'stale-metadata') {
-            git(input.projectPath, ['worktree', 'prune']);
+            await runGitAsync(input.projectPath, ['worktree', 'prune']);
             applied.push({ kind: 'prune-stale-worktree', detail: fresh.worktree.path });
         }
         const reuse = (fresh.worktree.state === 'orphan' || fresh.worktree.state === 'attached') &&
@@ -297,7 +321,7 @@ function resolvePrCheckoutLocked(input, owner) {
         // 3. In a reused worktree, settle the working tree before touching history.
         if (existingPath) {
             if (fresh.ongoingOperation && input.decisions.ongoingOperation === 'abort') {
-                gitOps.abortOngoingGitOperation(existingPath);
+                await runGitAsync(existingPath, [fresh.ongoingOperation, '--abort']);
                 applied.push({ kind: 'abort-operation', detail: fresh.ongoingOperation });
             }
             if (fresh.ongoingOperation && input.decisions.ongoingOperation !== 'abort') {
@@ -306,16 +330,29 @@ function resolvePrCheckoutLocked(input, owner) {
             if (fresh.localChanges.present) {
                 const choice = input.decisions.localChanges ?? 'keep';
                 if (choice === 'stash') {
-                    gitOps.stashPush(existingPath, `kobo-pr-checkout-${input.headBranch}`);
+                    await runGitAsync(existingPath, [
+                        'stash',
+                        'push',
+                        '--include-untracked',
+                        '-m',
+                        `kobo-pr-checkout-${input.headBranch}`,
+                    ]);
                     applied.push({ kind: 'stash-changes' });
                 }
                 else if (choice === 'commit') {
-                    gitOps.commitAllChanges(existingPath, `chore: save work before checking out ${input.headBranch}`);
+                    await runGitAsync(existingPath, ['add', '-A']);
+                    await runGitAsync(existingPath, ['commit', '-m', `chore: save work before checking out ${input.headBranch}`]);
                     applied.push({ kind: 'commit-changes' });
                 }
                 else if (choice === 'discard') {
                     // Deliberately a labelled stash, not `checkout -- .`: recoverable.
-                    gitOps.stashPush(existingPath, `kobo-pr-checkout-discard-${input.headBranch}`);
+                    await runGitAsync(existingPath, [
+                        'stash',
+                        'push',
+                        '--include-untracked',
+                        '-m',
+                        `kobo-pr-checkout-discard-${input.headBranch}`,
+                    ]);
                     applied.push({ kind: 'discard-changes', detail: 'kept as a labelled stash' });
                 }
             }
@@ -325,10 +362,10 @@ function resolvePrCheckoutLocked(input, owner) {
         const strategy = input.decisions.divergence ?? 'keep';
         if (strategy !== 'keep') {
             if (existingPath) {
-                alignInsideWorktree(input.projectPath, existingPath, input.headBranch, strategy, applied);
+                await alignInsideWorktree(input.projectPath, existingPath, input.headBranch, strategy, applied);
             }
             else {
-                const outcome = applyBranchStrategy(input.projectPath, input.headBranch, strategy);
+                const outcome = await applyBranchStrategy(input.projectPath, input.headBranch, strategy);
                 applied.push({ kind: 'align-branch', detail: outcome.backupBranch ?? strategy });
             }
         }
@@ -343,7 +380,7 @@ function resolvePrCheckoutLocked(input, owner) {
             const explicitPath = input.decisions.pathCollision?.worktreePath ?? null;
             if (explicitPath)
                 assertSafeExplicitWorktreePath(explicitPath);
-            const baseRef = gitOps.localBranchExists(input.projectPath, input.headBranch)
+            const baseRef = (await gitOps.localBranchExistsAsync(input.projectPath, input.headBranch))
                 ? input.headBranch
                 : `origin/${input.headBranch}`;
             const target = await createWorktreeUnlocked(input.projectPath, input.headBranch, baseRef, input.worktreesPath, undefined, explicitPath);
@@ -376,20 +413,20 @@ function resolvePrCheckoutLocked(input, owner) {
     });
 }
 /** Realign a branch from inside its own worktree, where ref surgery is refused. */
-function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied) {
+async function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied) {
     const remoteRef = `origin/${branch}`;
     if (strategy === 'fast-forward') {
-        git(worktreePath, ['merge', '--ff-only', remoteRef]);
+        await runGitAsync(worktreePath, ['merge', '--ff-only', remoteRef]);
         applied.push({ kind: 'align-branch', detail: 'fast-forward' });
         return;
     }
     if (strategy === 'rebase') {
         try {
-            git(worktreePath, ['rebase', remoteRef]);
+            await runGitAsync(worktreePath, ['rebase', remoteRef]);
         }
         catch (err) {
-            const conflicted = gitOps.getConflictedFiles(worktreePath);
-            if (conflicted.length > 0 || gitOps.getOngoingGitOperation(worktreePath) === 'rebase') {
+            const conflicted = await conflictedFilesAsync(worktreePath);
+            if (conflicted.length > 0 || (await gitOps.getOngoingGitOperationAsync(worktreePath)) === 'rebase') {
                 // Leave the rebase in progress so the caller can abort or request
                 // agent-assisted resolution — mirrors applyBranchStrategy's own rebase
                 // conflict handling and git-ops.ts's rebaseBranch.
@@ -403,7 +440,7 @@ function alignInsideWorktree(repoPath, worktreePath, branch, strategy, applied)
     }
     // reset-hard
     const backupBranch = `kobo-backup/${branch}-${Date.now()}`;
-    git(repoPath, ['branch', backupBranch, branch]);
-    git(worktreePath, ['reset', '--hard', remoteRef]);
+    await runGitAsync(repoPath, ['branch', backupBranch, branch]);
+    await runGitAsync(worktreePath, ['reset', '--hard', remoteRef]);
     applied.push({ kind: 'align-branch', detail: backupBranch });
 }

package/dist/server/services/pr-watcher-service.js

@@ -261,13 +261,19 @@ export async function checkPrStatuses() {
                     ['extracting', 'brainstorming', 'executing', 'compacting'].includes(current.status) ||
                     hasController(ws.id))
                     return;
-                try {
-                    destroyTerminal(ws.id);
-                }
-                catch {
-                    // Terminal may not exist — ignore
-                }
-                const archived = archiveWorkspace(ws.id);
+                const archived = await withWorkspaceLifecycleGuard(ws.id, async () => {
+                    await destroyTerminal(ws.id);
+                    const latest = getWorkspace(ws.id);
+                    if (!latest ||
+                        check.invalidated ||
+                        latest.archivedAt ||
+                        hasController(ws.id) ||
+                        ['extracting', 'brainstorming', 'executing', 'compacting'].includes(latest.status))
+                        return null;
+                    return archiveWorkspace(ws.id);
+                });
+                if (!archived)
+                    return;
                 lastKnownPr.delete(ws.id);
                 emitEphemeral(ws.id, 'workspace:archived', {
                     reason: `PR ${pr.state.toLowerCase()}`,

package/dist/server/services/retention/worker.js

@@ -0,0 +1,40 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import Database from 'better-sqlite3';
+import { countPrunableWsEvents, pruneWsEventsInBatches } from '../ws-events-retention-service.js';
+const port = parentPort;
+// The parent supplies the already-open database path, never a second home.
+const db = new Database(workerData.dbPath);
+db.pragma('journal_mode=WAL');
+db.pragma('foreign_keys=ON');
+db.pragma('busy_timeout=5000');
+let stopped = false;
+let queue = Promise.resolve();
+port.on('message', (message) => {
+    if (message.stop) {
+        stopped = true;
+        void queue.finally(() => {
+            db.close();
+            port.close();
+        });
+        return;
+    }
+    queue = queue.then(async () => {
+        if (stopped)
+            return;
+        try {
+            if (message.preview) {
+                const total = db.prepare('SELECT COUNT(*) AS count FROM ws_events').get().count;
+                const deletable = countPrunableWsEvents(db, message.config, message.nowMs);
+                port.postMessage({ id: message.id, result: { deletable, total } });
+            }
+            else {
+                const result = await pruneWsEventsInBatches(db, message.config, message.nowMs, () => stopped);
+                if (!stopped)
+                    port.postMessage({ id: message.id, result });
+            }
+        }
+        catch (error) {
+            port.postMessage({ id: message.id, error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+});

package/dist/server/services/review-service.js

@@ -88,7 +88,7 @@ export async function startWorkspaceReview(id, input) {
             throw new ReviewRequestError('The current session cannot be resumed; start it before requesting an automatic return', 400);
         const worktreePath = workspace.worktreePath;
         try {
-            await execFileAsync('git', ['fetch', 'origin', workspace.sourceBranch], { cwd: worktreePath });
+            await gitOps.fetchSourceBranchOrThrowAsync(worktreePath, workspace.sourceBranch);
         }
         catch (err) {
             console.warn(`[start-review] git fetch failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -97,15 +97,19 @@ export async function startWorkspaceReview(id, input) {
         try {
             const { stdout } = await execFileAsync('git', ['rev-parse', `origin/${workspace.sourceBranch}`], {
                 cwd: worktreePath,
+                timeout: 15_000,
+                env: gitOps.buildNonInteractiveGitEnv(),
             });
             baseCommit = stdout.trim();
         }
         catch (err) {
             throw new Error(`Cannot resolve base commit for branch ${workspace.sourceBranch}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        const commits = gitOps.getCommitsBetween(worktreePath, workspace.sourceBranch, workspace.workingBranch);
-        const committedStats = gitOps.getDiffStatsBetween(worktreePath, workspace.sourceBranch, workspace.workingBranch);
-        const workingTreeStats = gitOps.getWorkingTreeDiffStats(worktreePath);
+        const [commits, committedStats, workingTreeStats] = await Promise.all([
+            gitOps.getCommitsBetweenAsync(worktreePath, workspace.sourceBranch, workspace.workingBranch),
+            gitOps.getDiffStatsBetweenAsync(worktreePath, workspace.sourceBranch, workspace.workingBranch),
+            gitOps.getWorkingTreeDiffStatsAsync(worktreePath),
+        ]);
         const diffStats = workingTreeStats.trim()
             ? `${committedStats}\n\n— Working tree (uncommitted) —\n${workingTreeStats}`
             : committedStats;

package/dist/server/services/session-event-metrics.js

@@ -0,0 +1,43 @@
+/**
+ * Recompute one session's persisted metrics from the events that remain, on an
+ * explicit database handle.
+ *
+ * Until v36 an `AFTER DELETE ... FOR EACH ROW` trigger did this per deleted
+ * row, re-aggregating the whole session every time — 79.7 s for 20 000 events,
+ * with the SQLite write lock held throughout. The trigger is gone; every code
+ * path that deletes `agent:event` rows while KEEPING the session calls this
+ * once, at the end of its transaction.
+ */
+export function recomputeSessionMetricsOn(db, workspaceId, sessionId) {
+    db.prepare('DELETE FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?').run(workspaceId, sessionId);
+    db.prepare(`INSERT INTO session_event_metrics (
+       workspace_id, session_id, tool_calls, errors, input_tokens, output_tokens
+     )
+     SELECT
+       e.workspace_id,
+       e.session_id,
+       SUM(CASE WHEN json_extract(e.payload, '$.kind') = 'tool:call' THEN 1 ELSE 0 END),
+       SUM(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'error'
+           OR (json_extract(e.payload, '$.kind') = 'tool:result'
+             AND json_extract(e.payload, '$.isError') = 1)
+         THEN 1 ELSE 0
+       END),
+       MAX(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.inputTokens') IN ('integer', 'real')
+         THEN CAST(json_extract(e.payload, '$.inputTokens') AS INTEGER) ELSE 0
+       END),
+       MAX(CASE
+         WHEN json_extract(e.payload, '$.kind') = 'usage'
+           AND json_type(e.payload, '$.outputTokens') IN ('integer', 'real')
+         THEN CAST(json_extract(e.payload, '$.outputTokens') AS INTEGER) ELSE 0
+       END)
+     FROM ws_events e
+     JOIN agent_sessions s ON s.id = e.session_id AND s.workspace_id = e.workspace_id
+     WHERE e.workspace_id = ?
+       AND e.session_id = ?
+       AND e.type = 'agent:event'
+       AND json_valid(e.payload)
+     GROUP BY e.workspace_id, e.session_id`).run(workspaceId, sessionId);
+}