@loicngr/kobo 2.1.4 → 2.1.6

package/dist/server/services/session-handoff-service.js

@@ -247,7 +247,7 @@ Call kobo__submit_session_handoff with a Markdown report (at most ${HANDOFF_REPO
 5. Open questions, uncertainties, and the concrete next action.
 Do not claim checks you did not run. Reference source history where needed. After successful submission, end your turn immediately. The backend will start the fresh session; do not do that yourself.`;
 }
-function buildPrompt(row) {
+async function buildPrompt(row) {
     const workspace = workspaces.getWorkspaceWithTasks(row.workspace_id);
     if (!workspace)
         throw new SessionHandoffError('Workspace not found', 404);
@@ -265,7 +265,7 @@ function buildPrompt(row) {
     const messages = getDb()
         .prepare("SELECT id, state FROM auto_loop_messages WHERE workspace_id = ? AND state != 'delivered'")
         .all(row.workspace_id);
-    return `# Kōbō session handoff\n\nContinue the current mission automatically in this fresh conversation. First verify the actual repository and Kōbō task state, then perform the next unfinished action. Preserve user constraints; this report is context, not authorization to override them. Agent-reported checks do not replace Kōbō verification requirements. Uncertain message deliveries require explicit acknowledgement; do not silently treat them as completed.\n\nSource session: ${row.source_session_id ?? 'none'}\nRead its history using kobo__read_workspace_events_csv with session_id=${row.source_session_id ?? '(no prior session)'}.\n\n## Initial mission\n${mission.slice(0, 32_000)}\n\n## Agent handoff\n${row.report ?? 'No LLM summary was generated. Recover missing decisions from the source conversation.'}\n\n## Current Kōbō tasks and reported evidence\n${tasks.slice(0, 48_000)}\n\n## Auto-loop and pending instructions\nThese are identifiers and statuses only. Do not execute or acknowledge queued instructions during this transfer. Kōbō will dispatch pending instructions separately; unknown deliveries require an explicit user decision.\nIntent: ${workspace.autoLoop}\n${JSON.stringify(run ?? null)}\n${JSON.stringify(messages).slice(0, 24_000)}\n\n${buildEngineHandoff(workspace, configurations.source.engine, configurations.target.engine, row.source_session_id)}`;
+    return `# Kōbō session handoff\n\nContinue the current mission automatically in this fresh conversation. First verify the actual repository and Kōbō task state, then perform the next unfinished action. Preserve user constraints; this report is context, not authorization to override them. Agent-reported checks do not replace Kōbō verification requirements. Uncertain message deliveries require explicit acknowledgement; do not silently treat them as completed.\n\nSource session: ${row.source_session_id ?? 'none'}\nRead its history using kobo__read_workspace_events_csv with session_id=${row.source_session_id ?? '(no prior session)'}.\n\n## Initial mission\n${mission.slice(0, 32_000)}\n\n## Agent handoff\n${row.report ?? 'No LLM summary was generated. Recover missing decisions from the source conversation.'}\n\n## Current Kōbō tasks and reported evidence\n${tasks.slice(0, 48_000)}\n\n## Auto-loop and pending instructions\nThese are identifiers and statuses only. Do not execute or acknowledge queued instructions during this transfer. Kōbō will dispatch pending instructions separately; unknown deliveries require an explicit user decision.\nIntent: ${workspace.autoLoop}\n${JSON.stringify(run ?? null)}\n${JSON.stringify(messages).slice(0, 24_000)}\n\n${await buildEngineHandoff(workspace, configurations.source.engine, configurations.target.engine, row.source_session_id)}`;
 }
 function writeReport(row, content) {
     const workspace = workspaces.getWorkspace(row.workspace_id);
@@ -368,14 +368,16 @@ async function startTarget(runtime) {
     if (runtime.cancelled || read(row.id).state === 'starting')
         return;
     clearTimer(runtime);
-    const prompt = buildPrompt(row);
+    state(row.id, 'starting');
+    const prompt = await buildPrompt(row);
+    if (runtime.cancelled || read(row.id).state !== 'starting')
+        return;
     writeReport(row, prompt);
     configure(row.workspace_id, map(row).target);
     const session = workspaces.createIdleSession(row.workspace_id);
     getDb()
         .prepare('UPDATE session_handoffs SET target_session_id = ?, generation_token = NULL WHERE id = ?')
         .run(session.id, row.id);
-    state(row.id, 'starting');
     let startError;
     const completed = () => {
         if (runtime.cancelled || read(row.id).state !== 'starting')

package/dist/server/services/templates-service.js

@@ -1,6 +1,6 @@
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, copyFileSync, existsSync, readFileSync } from 'node:fs';
+import { writeJsonFileAtomically } from '../utils/atomic-json-file.js';
 import { getTemplatesPath } from '../utils/paths.js';
 const LEGACY_DEFAULT_CONTENT_HASHES = {
     'kobo-context': 'ee29ebb56186ce9537e682c25d9d7737ff8d824ab6f29c095c925b27eed70552',
@@ -13,42 +13,35 @@ const MAX_CONTENT_LENGTH = 4096;
 const MAX_DESCRIPTION_LENGTH = 120;
 /**
  * Read the templates list from disk. Seeds with defaults if the file does
- * not exist yet. Returns an empty array (with a logged error) on corruption.
+ * not exist yet. Refuses damaged data so ordinary mutations cannot erase it.
  */
 export function listTemplates() {
     const filePath = getTemplatesPath();
     if (!existsSync(filePath)) {
         seedTemplates();
     }
-    try {
-        const raw = readFileSync(filePath, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed.version !== CURRENT_FILE_VERSION) {
-            console.warn(`[templates-service] templates.json has version ${parsed.version}, expected ${CURRENT_FILE_VERSION}. Reading best-effort.`);
-        }
-        const templates = Array.isArray(parsed.templates) ? parsed.templates : [];
-        let changed = false;
-        for (const template of templates) {
-            const previousHash = LEGACY_DEFAULT_CONTENT_HASHES[template.slug];
-            if (!previousHash || typeof template.content !== 'string')
-                continue;
-            if (createHash('sha256').update(template.content).digest('hex') !== previousHash)
-                continue;
-            const next = DEFAULT_TEMPLATES.find((value) => value.slug === template.slug);
-            if (!next || next.content === template.content)
-                continue;
-            template.content = next.content;
-            template.updatedAt = new Date().toISOString();
-            changed = true;
-        }
-        if (changed)
-            writeTemplates(templates, parsed.seededDefaultSlugs);
-        return templates;
+    const parsed = readTemplatesFile();
+    if (parsed.version !== CURRENT_FILE_VERSION) {
+        console.warn(`[templates-service] templates.json has version ${parsed.version}, expected ${CURRENT_FILE_VERSION}. Reading best-effort.`);
     }
-    catch (err) {
-        console.error('[templates-service] Failed to read templates.json:', err);
-        return [];
+    const templates = parsed.templates;
+    let changed = false;
+    for (const template of templates) {
+        const previousHash = LEGACY_DEFAULT_CONTENT_HASHES[template.slug];
+        if (!previousHash)
+            continue;
+        if (createHash('sha256').update(template.content).digest('hex') !== previousHash)
+            continue;
+        const next = DEFAULT_TEMPLATES.find((value) => value.slug === template.slug);
+        if (!next || next.content === template.content)
+            continue;
+        template.content = next.content;
+        template.updatedAt = new Date().toISOString();
+        changed = true;
     }
+    if (changed)
+        writeTemplates(templates, parsed.seededDefaultSlugs);
+    return templates;
 }
 /** Create a new template. Throws on invalid input or duplicate slug. */
 export function createTemplate(input) {
@@ -140,31 +133,41 @@ function validateTemplateInput(input) {
         throw new Error(`Invalid content: must be 1..${MAX_CONTENT_LENGTH} chars`);
     }
 }
-function readSeededSlugs() {
-    const filePath = getTemplatesPath();
-    if (!existsSync(filePath))
-        return undefined;
+function readTemplatesFile() {
     try {
-        const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
-        return Array.isArray(parsed.seededDefaultSlugs) ? parsed.seededDefaultSlugs : undefined;
+        const parsed = JSON.parse(readFileSync(getTemplatesPath(), 'utf-8'));
+        if (!parsed || !Array.isArray(parsed.templates))
+            throw new Error('Expected a templates array');
+        if (parsed.templates.some((template) => !template ||
+            typeof template.slug !== 'string' ||
+            typeof template.description !== 'string' ||
+            typeof template.content !== 'string' ||
+            typeof template.createdAt !== 'string' ||
+            typeof template.updatedAt !== 'string')) {
+            throw new Error('A template has missing or malformed fields');
+        }
+        if (parsed.seededDefaultSlugs !== undefined &&
+            (!Array.isArray(parsed.seededDefaultSlugs) || parsed.seededDefaultSlugs.some((slug) => typeof slug !== 'string'))) {
+            throw new Error('Expected seededDefaultSlugs to be an array of strings');
+        }
+        return parsed;
     }
-    catch {
-        return undefined;
+    catch (error) {
+        throw new Error('Failed to read templates.json. Existing data was preserved; restore a valid file or import templates.', {
+            cause: error,
+        });
     }
 }
+function readSeededSlugs() {
+    return existsSync(getTemplatesPath()) ? readTemplatesFile().seededDefaultSlugs : undefined;
+}
 function writeTemplates(templates, seededDefaultSlugs) {
-    const filePath = getTemplatesPath();
-    mkdirSync(path.dirname(filePath), { recursive: true });
     const seeded = seededDefaultSlugs ?? readSeededSlugs() ?? [...LEGACY_DEFAULT_SLUGS];
     const file = { version: CURRENT_FILE_VERSION, templates, seededDefaultSlugs: seeded };
-    writeFileSync(filePath, JSON.stringify(file, null, 2), 'utf-8');
+    writeJsonFileAtomically(getTemplatesPath(), file);
 }
-/**
- * Replace the entire templates list atomically. Validates each entry and
- * rejects the whole write on any invalid row — do not partially accept.
- * Used by config import.
- */
-export function replaceAllTemplates(templates) {
+/** Validate a whole import before any file in the configuration bundle changes. */
+export function validateTemplatesForReplacement(templates) {
     if (!Array.isArray(templates)) {
         throw new Error('Invalid templates payload: expected an array');
     }
@@ -188,7 +191,22 @@ export function replaceAllTemplates(templates) {
         const updatedAt = typeof t.updatedAt === 'string' ? t.updatedAt : now;
         validated.push({ slug, description, content, createdAt, updatedAt });
     }
-    writeTemplates(validated);
+    return validated;
+}
+/** Replace the list atomically, preserving damaged existing data before recovery. */
+export function replaceAllTemplates(templates) {
+    const validated = validateTemplatesForReplacement(templates);
+    let seededDefaultSlugs;
+    try {
+        seededDefaultSlugs = readSeededSlugs();
+    }
+    catch {
+        // Import is an explicit replacement. Retain damaged bytes for recovery,
+        // and abort the replacement if the backup cannot be written.
+        const filePath = getTemplatesPath();
+        copyFileSync(filePath, `${filePath}.recovery-${randomUUID()}.bak`, constants.COPYFILE_EXCL);
+    }
+    writeTemplates(validated, seededDefaultSlugs ?? [...LEGACY_DEFAULT_SLUGS]);
 }
 /**
  * The default slugs that existed BEFORE the seededDefaultSlugs watermark shipped.

package/dist/server/services/terminal-service.js

@@ -1,6 +1,8 @@
 import fs from 'node:fs';
 import * as pty from 'node-pty';
 import { ensureSpawnHelperExecutable } from '../utils/node-pty-spawn-helper.js';
+export class TerminalStopError extends Error {
+}
 const terminals = new Map();
 let spawnHelperChecked = false;
 function prepareSpawnHelper() {
@@ -17,8 +19,11 @@ function prepareSpawnHelper() {
     }
 }
 export function createTerminal(workspaceId, cwd) {
-    if (terminals.has(workspaceId)) {
-        return terminals.get(workspaceId).pty;
+    const existing = terminals.get(workspaceId);
+    if (existing) {
+        if (existing.closing)
+            throw new TerminalStopError('Terminal is closing; wait for confirmed exit before reopening it');
+        return existing.pty;
     }
     if (!fs.existsSync(cwd)) {
         throw new Error(`Worktree directory does not exist: ${cwd}`);
@@ -32,29 +37,55 @@ export function createTerminal(workspaceId, cwd) {
         cwd,
         env: process.env,
     });
-    terminals.set(workspaceId, { pty: term });
+    let resolveClosed;
+    const closed = new Promise((resolve) => {
+        resolveClosed = resolve;
+    });
+    const instance = { pty: term, closing: false, closed, resolveClosed };
+    terminals.set(workspaceId, instance);
     term.onExit(() => {
-        terminals.delete(workspaceId);
+        if (terminals.get(workspaceId) === instance)
+            terminals.delete(workspaceId);
+        instance.resolveClosed();
     });
     return term;
 }
 export function getTerminal(workspaceId) {
-    return terminals.get(workspaceId)?.pty ?? null;
+    const instance = terminals.get(workspaceId);
+    return instance && !instance.closing ? instance.pty : null;
 }
-export function destroyTerminal(workspaceId) {
+export function destroyTerminal(workspaceId, timeoutMs = 2000) {
     const instance = terminals.get(workspaceId);
-    if (instance) {
+    if (!instance)
+        return Promise.resolve();
+    if (instance.stop)
+        return instance.stop;
+    instance.closing = true;
+    const stopped = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new TerminalStopError(`Terminal exit could not be confirmed for workspace ${workspaceId}`));
+        }, timeoutMs);
+        instance.closed.then(() => {
+            clearTimeout(timer);
+            resolve();
+        });
         try {
             instance.pty.kill();
         }
         catch (err) {
-            console.error(`[terminal] Failed to kill PTY for workspace ${workspaceId}:`, err);
+            clearTimeout(timer);
+            reject(new TerminalStopError(`Failed to stop terminal: ${err instanceof Error ? err.message : String(err)}`));
         }
-        terminals.delete(workspaceId);
-    }
+    });
+    instance.stop = stopped.catch((error) => {
+        instance.stop = undefined;
+        throw error;
+    });
+    return instance.stop;
 }
-export function destroyAllTerminals() {
-    for (const [id] of terminals) {
-        destroyTerminal(id);
-    }
+export async function destroyAllTerminals() {
+    const results = await Promise.allSettled([...terminals.keys()].map((id) => destroyTerminal(id)));
+    const failures = results.filter((result) => result.status === 'rejected');
+    if (failures.length)
+        throw new AggregateError(failures.map((result) => result.reason), 'Some terminals did not stop');
 }

package/dist/server/services/terminal-websocket-service.js

@@ -0,0 +1,143 @@
+import { assertWorkspaceLifecycleAvailable, isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
+import { createTerminal, getTerminal } from './terminal-service.js';
+import { getWorkspace } from './workspace-service.js';
+const MAX_BUFFERED_BYTES = 1024 * 1024;
+const HEARTBEAT_INTERVAL_MS = 30_000;
+/** Each client owns its subscriptions and output budget, never the shared PTY. */
+export function handleTerminalConnection(ws, workspaceId, isShuttingDown = () => false) {
+    let currentPty = null;
+    let dataDisposable = null;
+    let exitDisposable = null;
+    let disposed = false;
+    let alive = true;
+    function detachTerminal() {
+        dataDisposable?.dispose();
+        exitDisposable?.dispose();
+        dataDisposable = null;
+        exitDisposable = null;
+        currentPty = null;
+    }
+    function dispose() {
+        if (disposed)
+            return;
+        disposed = true;
+        clearInterval(heartbeat);
+        detachTerminal();
+    }
+    function disconnect() {
+        if (disposed)
+            return;
+        dispose();
+        ws.terminate();
+    }
+    function send(data) {
+        if (disposed || ws.readyState !== 1)
+            return false;
+        if (ws.bufferedAmount + Buffer.byteLength(data) > MAX_BUFFERED_BYTES) {
+            disconnect();
+            return false;
+        }
+        try {
+            ws.send(data, { binary: Buffer.isBuffer(data) }, (error) => {
+                if (error)
+                    disconnect();
+            });
+            return true;
+        }
+        catch {
+            disconnect();
+            return false;
+        }
+    }
+    function sendError(error) {
+        send(JSON.stringify({ type: 'error', message: error instanceof Error ? error.message : String(error) }));
+    }
+    const heartbeat = setInterval(() => {
+        if (ws.readyState !== 1 || !alive) {
+            disconnect();
+            return;
+        }
+        alive = false;
+        try {
+            ws.ping();
+        }
+        catch {
+            disconnect();
+        }
+    }, HEARTBEAT_INTERVAL_MS);
+    heartbeat.unref?.();
+    ws.on('pong', () => {
+        alive = true;
+    });
+    ws.on('close', dispose);
+    ws.on('error', disconnect);
+    ws.on('message', (data, isBinary) => {
+        if (disposed || ws.readyState !== 1 || isShuttingDown())
+            return;
+        if (isBinary) {
+            if (currentPty && getTerminal(workspaceId) === currentPty && !isWorkspaceLifecycleBusy(workspaceId)) {
+                try {
+                    currentPty.write(data.toString());
+                }
+                catch (error) {
+                    sendError(error);
+                }
+            }
+            return;
+        }
+        let message;
+        try {
+            message = JSON.parse(data.toString());
+        }
+        catch {
+            return;
+        }
+        if (!message || typeof message !== 'object' || !('type' in message))
+            return;
+        if (message.type === 'create') {
+            try {
+                assertWorkspaceLifecycleAvailable(workspaceId);
+                const workspace = getWorkspace(workspaceId);
+                if (!workspace)
+                    throw new Error('Workspace not found');
+                if (workspace.archivedAt)
+                    throw new Error('Workspace is archived');
+                if (workspace.worktreePurgedAt)
+                    throw new Error('Workspace worktree is purged');
+                detachTerminal();
+                const terminal = createTerminal(workspaceId, workspace.worktreePath);
+                currentPty = terminal;
+                dataDisposable = terminal.onData((output) => {
+                    send(Buffer.from(output));
+                });
+                exitDisposable = terminal.onExit(({ exitCode }) => {
+                    if (send(JSON.stringify({ type: 'exited', code: exitCode })))
+                        ws.close();
+                    dispose();
+                });
+                send(JSON.stringify({ type: 'ready' }));
+            }
+            catch (error) {
+                sendError(error);
+            }
+            return;
+        }
+        if (message.type === 'resize' &&
+            'cols' in message &&
+            'rows' in message &&
+            typeof message.cols === 'number' &&
+            typeof message.rows === 'number' &&
+            Number.isFinite(message.cols) &&
+            Number.isFinite(message.rows) &&
+            currentPty &&
+            getTerminal(workspaceId) === currentPty &&
+            !isWorkspaceLifecycleBusy(workspaceId)) {
+            try {
+                currentPty.resize(Math.max(1, Math.min(1000, Math.floor(message.cols))), Math.max(1, Math.min(1000, Math.floor(message.rows))));
+            }
+            catch (error) {
+                sendError(error);
+            }
+        }
+    });
+}

package/dist/server/services/wakeup-service.js

@@ -53,28 +53,30 @@ function defer(workspaceId, row) {
 }
 /** Schedule a wakeup for the given workspace. Replaces any existing pending wakeup. */
 export function schedule(workspaceId, delaySeconds, prompt, reason, agentSessionId) {
-    try {
-        const clampedSeconds = clamp(Math.floor(delaySeconds), MIN_DELAY_SECONDS, MAX_DELAY_SECONDS);
-        const effectivePrompt = prompt === AUTONOMOUS_LOOP_SENTINEL ? AUTONOMOUS_LOOP_FALLBACK_PROMPT : prompt;
-        const targetAtIso = new Date(Date.now() + clampedSeconds * 1000).toISOString();
-        const existing = timers.get(workspaceId);
-        if (existing)
-            clearTimeout(existing);
-        const db = getDb();
-        db.prepare(`INSERT OR REPLACE INTO pending_wakeups
-         (workspace_id, target_at, prompt, reason, created_at, agent_session_id)
-       VALUES (?, ?, ?, ?, ?, ?)`).run(workspaceId, targetAtIso, effectivePrompt, reason ?? null, new Date().toISOString(), agentSessionId ?? null);
-        timers.delete(workspaceId);
-        if (!suspended) {
-            const timeout = setTimeout(() => fire(workspaceId), clampedSeconds * 1000);
-            timeout.unref?.();
-            timers.set(workspaceId, timeout);
-        }
-        emitEphemeral(workspaceId, 'wakeup:scheduled', { targetAt: targetAtIso, reason });
-    }
-    catch (err) {
-        console.error('[wakeup-service] schedule failed:', err);
+    const clampedSeconds = clamp(Math.floor(delaySeconds), MIN_DELAY_SECONDS, MAX_DELAY_SECONDS);
+    const effectivePrompt = prompt === AUTONOMOUS_LOOP_SENTINEL ? AUTONOMOUS_LOOP_FALLBACK_PROMPT : prompt;
+    const targetAtIso = new Date(Date.now() + clampedSeconds * 1000).toISOString();
+    // Commit before changing the live timer. A failed replacement must leave
+    // the original durable wakeup and its timer intact, and fail the MCP receipt.
+    const row = getDb()
+        .prepare(`INSERT OR REPLACE INTO pending_wakeups
+       (workspace_id, target_at, prompt, reason, created_at, agent_session_id)
+     VALUES (?, ?, ?, ?, ?, ?)
+     RETURNING target_at, reason`)
+        .get(workspaceId, targetAtIso, effectivePrompt, reason ?? null, new Date().toISOString(), agentSessionId ?? null);
+    const pending = { targetAt: row.target_at, reason: row.reason ?? undefined };
+    const existing = timers.get(workspaceId);
+    if (existing)
+        clearTimeout(existing);
+    timers.delete(workspaceId);
+    failedRetries.delete(workspaceId);
+    if (!suspended) {
+        const timeout = setTimeout(() => fire(workspaceId), clampedSeconds * 1000);
+        timeout.unref?.();
+        timers.set(workspaceId, timeout);
     }
+    emitEphemeral(workspaceId, 'wakeup:scheduled', pending);
+    return pending;
 }
 /** Move a source conversation's pending check only once its handoff succeeds. */
 export function transferSession(workspaceId, sourceSessionId, targetSessionId) {

package/dist/server/services/workspace-service.js

@@ -9,6 +9,7 @@ import * as autoLoopService from './auto-loop-service.js';
 import * as cronService from './cron-service.js';
 import * as quotaBackoffService from './quota-backoff-service.js';
 import { SESSION_RECENCY_ORDER } from './session-activity-service.js';
+import { recomputeSessionMetricsOn } from './session-event-metrics.js';
 import { createTaskRecord, deleteTaskRecord, updateTaskRecord } from './task-mutations.js';
 import * as wakeupService from './wakeup-service.js';
 import { emitEphemeral } from './websocket-service.js';
@@ -153,7 +154,7 @@ export function createWorkspace(data) {
       notion_url, notion_page_id, sentry_url, pr_url, worktree_path, worktree_owned,
       model, brainstorm_model, reasoning_effort, permission_mode, permission_profile, agent_permission_mode, engine, comparison_id, created_at, updated_at, workflow_policy
     ) VALUES (?, ?, ?, ?, ?, 'created', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(id, data.name, data.projectPath, data.sourceBranch, data.workingBranch, data.notionUrl ?? null, data.notionPageId ?? null, data.sentryUrl ?? null, data.prUrl ?? null, computedWorktreePath, owned ? 1 : 0, data.model ?? 'claude-opus-4-8', data.brainstormModel ?? null, data.reasoningEffort ?? 'auto', legacyMode, legacyProfile, unifiedMode, data.engine ?? 'claude-code', 
+  `).run(id, data.name, data.projectPath, data.sourceBranch, data.workingBranch, data.notionUrl ?? null, data.notionPageId ?? null, data.sentryUrl ?? null, data.prUrl ?? null, computedWorktreePath, owned ? 1 : 0, data.model ?? 'auto', data.brainstormModel ?? null, data.reasoningEffort ?? 'auto', legacyMode, legacyProfile, unifiedMode, data.engine ?? 'claude-code', 
     // Empty string is not a group: it would silently gather every workspace
     // created with a blank id into one comparison.
     data.comparisonId?.trim() ? data.comparisonId : null, now, now, JSON.stringify(workflowPolicy));
@@ -899,49 +900,7 @@ export function deleteSession(sessionId, workspaceId) {
     transaction();
     return true;
 }
-/**
- * Recompute one session's persisted metrics from the events that remain, on an
- * explicit database handle.
- *
- * Until v36 an `AFTER DELETE ... FOR EACH ROW` trigger did this per deleted
- * row, re-aggregating the whole session every time — 79.7 s for 20 000 events,
- * with the SQLite write lock held throughout. The trigger is gone; every code
- * path that deletes `agent:event` rows while KEEPING the session calls this
- * once, at the end of its transaction.
- */
-export function recomputeSessionMetricsOn(db, workspaceId, sessionId) {
-    db.prepare('DELETE FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?').run(workspaceId, sessionId);
-    db.prepare(`INSERT INTO session_event_metrics (
-       workspace_id, session_id, tool_calls, errors, input_tokens, output_tokens
-     )
-     SELECT
-       e.workspace_id,
-       e.session_id,
-       SUM(CASE WHEN json_extract(e.payload, '$.kind') = 'tool:call' THEN 1 ELSE 0 END),
-       SUM(CASE
-         WHEN json_extract(e.payload, '$.kind') = 'error'
-           OR (json_extract(e.payload, '$.kind') = 'tool:result'
-             AND json_extract(e.payload, '$.isError') = 1)
-         THEN 1 ELSE 0
-       END),
-       MAX(CASE
-         WHEN json_extract(e.payload, '$.kind') = 'usage'
-           AND json_type(e.payload, '$.inputTokens') IN ('integer', 'real')
-         THEN CAST(json_extract(e.payload, '$.inputTokens') AS INTEGER) ELSE 0
-       END),
-       MAX(CASE
-         WHEN json_extract(e.payload, '$.kind') = 'usage'
-           AND json_type(e.payload, '$.outputTokens') IN ('integer', 'real')
-         THEN CAST(json_extract(e.payload, '$.outputTokens') AS INTEGER) ELSE 0
-       END)
-     FROM ws_events e
-     JOIN agent_sessions s ON s.id = e.session_id AND s.workspace_id = e.workspace_id
-     WHERE e.workspace_id = ?
-       AND e.session_id = ?
-       AND e.type = 'agent:event'
-       AND json_valid(e.payload)
-     GROUP BY e.workspace_id, e.session_id`).run(workspaceId, sessionId);
-}
+export { recomputeSessionMetricsOn } from './session-event-metrics.js';
 /** Same, on the singleton connection. */
 export function recomputeSessionMetrics(workspaceId, sessionId) {
     recomputeSessionMetricsOn(getDb(), workspaceId, sessionId);

package/dist/server/services/workspace-template-service.js

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import path from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
 import { nanoid } from 'nanoid';
 import { getDb } from '../db/index.js';
+import { writeJsonFileAtomically } from '../utils/atomic-json-file.js';
 import { getWorkspaceTemplatesPath } from '../utils/paths.js';
 const FILE_VERSION = 1;
 export const MAX_WORKSPACE_TEMPLATES = 100;
@@ -71,32 +71,30 @@ function readFile() {
         return [];
     try {
         const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+        if (!parsed || !Array.isArray(parsed.templates))
+            throw new Error('Expected a templates array');
         if (parsed.version !== FILE_VERSION) {
             console.warn(`[workspace-template-service] workspace-templates.json has version ${parsed.version}, expected ${FILE_VERSION}. Reading best-effort.`);
         }
-        if (!Array.isArray(parsed.templates))
-            return [];
+        if (parsed.templates.some((t) => !t ||
+            typeof t.id !== 'string' ||
+            typeof t.name !== 'string' ||
+            typeof t.createdAt !== 'string' ||
+            typeof t.updatedAt !== 'string')) {
+            throw new Error('A workspace template has missing or malformed fields');
+        }
         // Re-sanitise on read: the file may have been edited by hand.
-        return parsed.templates
-            .filter((t) => t &&
-            typeof t.id === 'string' &&
-            typeof t.name === 'string' &&
-            typeof t.createdAt === 'string' &&
-            typeof t.updatedAt === 'string')
-            .map((t) => ({ ...t, preset: sanitizePreset(t.preset) }));
+        return parsed.templates.map((t) => ({ ...t, preset: sanitizePreset(t.preset) }));
     }
     catch (err) {
-        // Treated as empty, never overwritten here: the next successful write is
-        // the user's, after they have seen the log line.
-        console.error('[workspace-template-service] Failed to read workspace-templates.json:', err);
-        return [];
+        throw new Error('Failed to read workspace-templates.json. Existing data was preserved; restore a valid file.', {
+            cause: err,
+        });
     }
 }
 function writeFile(templates) {
-    const filePath = getWorkspaceTemplatesPath();
-    mkdirSync(path.dirname(filePath), { recursive: true });
     const file = { version: FILE_VERSION, templates };
-    writeFileSync(filePath, JSON.stringify(file, null, 2), 'utf-8');
+    writeJsonFileAtomically(getWorkspaceTemplatesPath(), file);
 }
 export function listWorkspaceTemplates() {
     return readFile();

package/dist/server/services/worktree-purge-service.js

@@ -39,10 +39,7 @@ async function purgeWorktreeGuarded(workspaceId, expectedArchivedAt) {
         logError('purge', `stopDevServer failed for '${workspace.name}'`, { workspaceId: workspace.id, error: msg });
         throw err;
     }
-    try {
-        destroyTerminal(workspaceId);
-    }
-    catch { }
+    await destroyTerminal(workspaceId);
     // Snapshot the forge BEFORE removing the worktree — the PR lookup uses
     // `worktreePath` as cwd.
     const restoreData = await captureRestoreData(workspace);