@shawnstack/quickforge 1.7.10 → 1.7.12

package/server/routes/storage.mjs

@@ -1,36 +1,28 @@
 import { sendJson, readJsonBody, decodeSegment } from '../utils/response.mjs'
 import { readStore, writeStore, atomicUpdate, getComparable, getStoreRevision, readSessionStoreScoped, readSessionValue, writeSessionValueWithMetadata, deleteSessionWithMetadata, applySessionBatch, ensureStorage, dataDir, configDir, storageDir, cacheDir, logsDir } from '../storage.mjs'
 import { AUTO_ARCHIVE_SETTINGS_KEY, archiveInactiveSessions, normalizeAutoArchiveSettings } from '../auto-archive.mjs'
-import { refreshAllSessionModels } from '../agent-manager.mjs'
+import { refreshAllSessionModels, destroyAgent } from '../agent-manager.mjs'
 import { logger } from '../utils/logger.mjs'
 import { directorySize } from '../utils/workspace.mjs'
 import { isAuthenticatedAppClient } from '../access-policy.mjs'
-import { getSessionIndexDiagnostics, markSessionIndexQueryFailure, querySessionIndexPage } from '../session-index-service.mjs'
-import { isSessionStateMaintenanceActive } from '../session-state-cutover.mjs'
+import { querySessionIndexPage } from '../session-index-service.mjs'
+import { isSessionStateMaintenanceActive } from '../session-state-maintenance.mjs'
+import { isSessionStateAuthoritative } from '../session-state-service.mjs'
+import { verifySessionStateIntegrityForMaintenance } from '../session-state-backup.mjs'
 
 const metadataIndexCache = new Map()
 const MAX_METADATA_INDEX_CACHE_ENTRIES = 50
 const METADATA_INDEX_CACHE_TTL_MS = 1000
 const SESSION_QUERY_INDEXES = new Set(['createdAt', 'lastModified', 'pinnedAt'])
-const shadowGenerationByShape = new Map()
-let shadowSampler = () => Math.random() < 0.01
 
-export function configureSessionIndexQueryShadow({ sample } = {}) {
-  if (sample !== undefined && typeof sample !== 'function') throw new TypeError('sample must be a function')
-  shadowSampler = sample ?? (() => Math.random() < 0.01)
-  shadowGenerationByShape.clear()
-}
-
-function canonicalJson(value) {
-  if (Array.isArray(value)) return value.map(canonicalJson)
-  if (!value || typeof value !== 'object') return value
-  return Object.fromEntries(Object.keys(value).sort().filter((key) => value[key] !== undefined).map((key) => [key, canonicalJson(value[key])]))
-}
+// In-memory agent disposal used when sessions are deleted from storage.
+// destroyAgent performs a final persist, so deletions must destroy the agent
+// BEFORE removing persisted state — otherwise the final persist resurrects
+// the deleted row. Tests inject a spy through configureStorageSessionAgentDisposal.
+let destroyAgentForSession = destroyAgent
 
-function sameShadowPage(sqlPage, jsonValues, limit, offset) {
-  const expected = jsonValues.slice(offset, offset + limit)
-  if (sqlPage.total !== jsonValues.length || sqlPage.values.length !== expected.length) return false
-  return JSON.stringify(sqlPage.values.map(canonicalJson)) === JSON.stringify(expected.map(canonicalJson))
+export function configureStorageSessionAgentDisposal({ destroy } = {}) {
+  destroyAgentForSession = destroy ?? destroyAgent
 }
 
 function parseSqlPagination(limitParam, offsetParam) {
@@ -67,19 +59,6 @@ function sqlSessionQueryOptions({ store, indexName, directionParam, scope, proje
   }
 }
 
-function shadowShape(options) {
-  return JSON.stringify({
-    scopeMode: options.scopeMode,
-    hasProjectId: options.scopeMode === 'project',
-    archive: options.archive,
-    pinnedOnly: options.pinnedOnly,
-    sort: options.sort,
-    direction: options.direction,
-    limit: options.limit,
-    offset: options.offset,
-  })
-}
-
 function metadataIndexCacheKey({ scope, projectId, indexName, direction, archived, pinned }) {
   return JSON.stringify({ scope: scope || '', projectId: projectId || '', indexName, direction, archived: archived || '', pinned: pinned || '' })
 }
@@ -215,6 +194,17 @@ export async function handleStorageApi(req, res, url, context = { isLocalRequest
       throw error
     }
     try {
+      // Destroy in-memory agents for deleted sessions BEFORE removing the
+      // persisted state: destroyAgent's final persist would otherwise
+      // resurrect the deleted row right after the batch commit.
+      for (const operation of operations) {
+        if (operation?.type !== 'delete' || operation?.store !== 'sessions') continue
+        try {
+          await destroyAgentForSession(operation.key)
+        } catch (error) {
+          logger.warn(`Failed to destroy in-memory agent for deleted session ${operation.key}:`, error?.message || error)
+        }
+      }
       const result = await applySessionBatch(operations)
       sendJson(res, 200, { ok: true, saved: result?.saved ?? 0, deleted: result?.deleted ?? 0 })
     } catch (error) {
@@ -232,6 +222,34 @@ export async function handleStorageApi(req, res, url, context = { isLocalRequest
     return
   }
 
+  // Manual session state integrity verification (design review suggestion
+  // 9): startup only runs the lightweight SQL-level check, so per-row digest
+  // rot would stay invisible until an offline full verification. POST with
+  // { full: true } runs the complete per-row digest recomputation under the
+  // session state maintenance lock (same pattern as the authoritative backup
+  // export); the response carries only summary counters and the elapsed
+  // time, never row payloads.
+  if (req.method === 'POST' && parts.length === 4 && store === 'maintenance' && parts[3] === 'verify-session-integrity') {
+    if (!isSessionStateAuthoritative()) {
+      const error = new Error('Session state integrity verification requires authoritative SQLite storage')
+      error.statusCode = 409
+      error.errorCode = 'SESSION_STATE_NOT_AUTHORITATIVE'
+      throw error
+    }
+    if (isSessionStateMaintenanceActive()) {
+      const error = new Error('Session storage maintenance is in progress')
+      error.statusCode = 423
+      error.errorCode = 'SESSION_STORAGE_MAINTENANCE'
+      throw error
+    }
+    const body = await readJsonBody(req)
+    // forceQuickCheck: the manual endpoint always runs a real quick_check scan
+    // (never the startup process-cache/marker shortcut).
+    const result = await verifySessionStateIntegrityForMaintenance({ full: body?.full === true, forceQuickCheck: true, maintenance: true })
+    sendJson(res, 200, result)
+    return
+  }
+
   if (req.method === 'GET' && parts[3] === 'keys') {
     const prefix = url.searchParams.get('prefix') || ''
     const data = await readStore(store)
@@ -256,25 +274,14 @@ export async function handleStorageApi(req, res, url, context = { isLocalRequest
     const sqlOptions = sqlSessionQueryOptions({
       store, indexName, directionParam, scope, projectId, archived, pinned, limitParam, offsetParam,
     })
+    // Storage v2: sessions-metadata queries eligible for SQL LIMIT/OFFSET are
+    // served straight from the authoritative sessions table (no JSON shadow —
+    // the SQLite projection IS the store). Everything else keeps the legacy
+    // read+sort path (which also reads from SQLite through the facade).
     if (sqlOptions) {
       const sqlResult = await querySessionIndexPage(sqlOptions)
       if (sqlResult.ok) {
-        const diagnostics = getSessionIndexDiagnostics()
-        const shape = shadowShape(sqlOptions)
-        const lastGeneration = shadowGenerationByShape.get(shape)
-        const forced = lastGeneration !== diagnostics.rebuildGeneration
-        if (!forced && !shadowSampler({ shape, generation: diagnostics.rebuildGeneration })) {
-          sendJson(res, 200, { values: sqlResult.page.values, total: sqlResult.page.total })
-          return
-        }
-        const jsonValues = await readIndexedValues(store, indexName, direction, scope, projectId, archived, pinned)
-        shadowGenerationByShape.set(shape, diagnostics.rebuildGeneration)
-        if (sameShadowPage(sqlResult.page, jsonValues, sqlOptions.limit, sqlOptions.offset)) {
-          sendJson(res, 200, { values: sqlResult.page.values, total: sqlResult.page.total })
-          return
-        }
-        markSessionIndexQueryFailure('shadow_mismatch')
-        sendJson(res, 200, { values: jsonValues.slice(sqlOptions.offset, sqlOptions.offset + sqlOptions.limit), total: jsonValues.length })
+        sendJson(res, 200, { values: sqlResult.page.values, total: sqlResult.page.total })
         return
       }
     }
@@ -362,6 +369,13 @@ export async function handleStorageApi(req, res, url, context = { isLocalRequest
 
     if (req.method === 'DELETE') {
       if (store === 'sessions') {
+        // Destroy the in-memory agent first: its final persist would
+        // otherwise resurrect the row right after the delete.
+        try {
+          await destroyAgentForSession(key)
+        } catch (error) {
+          logger.warn(`Failed to destroy in-memory agent for deleted session ${key}:`, error?.message || error)
+        }
         await deleteSessionWithMetadata(key)
         sendJson(res, 200, { ok: true })
         return

package/server/scheduled-runs-cutover.mjs

@@ -241,8 +241,9 @@ export function acquireScheduledRunsMaintenanceLock(storage, {
       return { owner: identity.id, ownerPid: identity.pid, fencing, expiresAt }
     }
     if (current) {
+      const expired = Date.parse(current.expires_at) <= nowMs
       const stalePid = ownerPidFromRow(current)
-      if (stalePid === null || pidAlive(stalePid)) return null
+      if (!expired || stalePid === null || pidAlive(stalePid)) return null
     }
     const fencing = Number(current?.fencing || 0) + 1
     database.prepare(`
@@ -341,6 +342,10 @@ export async function runScheduledRunsMaintenance(operation, options = {}) {
     throw error
   } finally {
     if (retainedMaintenance?.lease !== lease) {
+      // Reset any stale retained flag from an earlier retain: this branch
+      // releases the lock normally, so retainedMaintenance must only stay set
+      // while a retained lease is genuinely still held.
+      retainedMaintenance = null
       clearInterval(timer)
       releaseScheduledRunsMaintenanceLock(storage, lease)
       localMaintenanceCount = Math.max(0, localMaintenanceCount - 1)
@@ -424,9 +429,18 @@ export async function initializeScheduledRunsCutover(options = {}) {
     }
 
     if (state.phase === SCHEDULED_RUNS_PHASES.AUTHORITATIVE) {
+      // The JSON file is only a non-authoritative mirror in this phase: a
+      // corrupt or unslimmable mirror degrades (diagnostic + warn) without
+      // blocking startup, while the authoritative SQLite health check stays
+      // fail-closed.
       try {
         const snapshot = splitScheduledTasksRuns(await readTasks())
         if (snapshot.count > 0) await slimJson(readTasks, writeTasks, snapshot.metadata)
+      } catch (error) {
+        recordScheduledRunsDiagnostic('authoritative_validation', error, {}, storage)
+        log.warn('Scheduled runs authoritative JSON mirror is invalid; continuing startup', { errorName: error?.name || 'Error' })
+      }
+      try {
         storage.health({ quickCheck: true })
       } catch (error) {
         recordScheduledRunsDiagnostic('authoritative_validation', error, {}, storage)