@shawnstack/quickforge 1.7.7 → 1.7.8

package/server/share-service.mjs

@@ -0,0 +1,163 @@
+import { createShareRepository } from './sqlite/share-repository.mjs'
+import { getSqliteStorage } from './sqlite/database.mjs'
+import { materializeShareJsonEntry } from './share-json-file.mjs'
+
+// F10 share storage phases — the same state machine as F8 session state but in
+// its own storage domain (`share_storage_state`, independent maintenance lock).
+export const SHARE_STORAGE_PHASES = Object.freeze({
+  JSON_AUTHORITATIVE: 'json_authoritative',
+  CUTOVER_RUNNING: 'cutover_running',
+  JSON_PENDING: 'sqlite_authoritative_json_pending',
+  AUTHORITATIVE: 'authoritative',
+})
+
+let repositoryInstance = null
+let cachedPhase = SHARE_STORAGE_PHASES.JSON_AUTHORITATIVE
+let jsonAdapter = null
+let mirrorAdapter = null
+let drainPromise = null
+let mirrorTimer = null
+const MIRROR_DRAIN_INTERVAL_MS = 1000
+
+function storage() {
+  return getSqliteStorage()
+}
+
+function repository() {
+  if (!repositoryInstance) repositoryInstance = createShareRepository(storage())
+  return repositoryInstance
+}
+
+// JSON-authoritative read/write adapter slot (same pattern as
+// session-state-service). share-store keeps its legacy JSON path, so this is a
+// public extension point rather than an internal call site.
+export function requireShareJsonAdapter(method) {
+  if (typeof jsonAdapter?.[method] !== 'function') throw new Error(`JSON authoritative share adapter does not implement ${method}`)
+  return jsonAdapter[method].bind(jsonAdapter)
+}
+
+function sqliteReadable() {
+  return cachedPhase === SHARE_STORAGE_PHASES.JSON_PENDING || cachedPhase === SHARE_STORAGE_PHASES.AUTHORITATIVE
+}
+
+export function createDefaultShareMirror() {
+  return {
+    async upsert(record) {
+      await materializeShareJsonEntry({ operation: 'upsert', record })
+    },
+    async delete(shareId) {
+      await materializeShareJsonEntry({ operation: 'delete', shareId })
+    },
+  }
+}
+
+export function configureShareService({ repository: configuredRepository, mirror, phase, json } = {}) {
+  if (configuredRepository !== undefined) repositoryInstance = configuredRepository
+  if (json !== undefined) jsonAdapter = json
+  if (mirror !== undefined) mirrorAdapter = mirror
+  if (phase !== undefined) {
+    if (!Object.values(SHARE_STORAGE_PHASES).includes(phase)) throw new TypeError(`Invalid share storage phase: ${phase}`)
+    cachedPhase = phase
+  }
+}
+
+/**
+ * The active share repository (lazily created from the SQLite storage handle).
+ * Only callable while the share storage is SQLite-readable (pending or
+ * authoritative); JSON-authoritative phases keep the legacy JSON store path.
+ */
+export function getShareRepository() {
+  return repository()
+}
+
+export function setShareStoragePhase(phase, values = {}) {
+  if (!Object.values(SHARE_STORAGE_PHASES).includes(phase)) throw new TypeError(`Invalid share storage phase: ${phase}`)
+  const updatedAt = new Date().toISOString()
+  storage().prepare(`UPDATE share_storage_state SET phase = ?, share_count = ?, digest = ?, backup_file = ?, diagnostic_json = ?, updated_at = ? WHERE singleton = 1`)
+    .run(phase, values.shareCount ?? null, values.digest ?? null, values.backupFile ?? null, values.diagnostic ? JSON.stringify(values.diagnostic) : null, updatedAt)
+  cachedPhase = phase
+  return readShareStorageState()
+}
+
+export function readShareStorageState() {
+  const row = storage().prepare('SELECT * FROM share_storage_state WHERE singleton = 1').get()
+  if (!row) throw new Error('Share storage state is missing')
+  cachedPhase = row.phase
+  return {
+    phase: row.phase,
+    shareCount: row.share_count === null ? null : Number(row.share_count),
+    digest: row.digest,
+    backupFile: row.backup_file,
+    diagnostic: row.diagnostic_json ? JSON.parse(row.diagnostic_json) : null,
+    updatedAt: row.updated_at,
+  }
+}
+
+export function initializeShareService() {
+  return readShareStorageState()
+}
+
+export function getShareStoragePhase() {
+  return cachedPhase
+}
+
+export function isShareStorageAuthoritative() {
+  return sqliteReadable()
+}
+
+function scheduleShareJsonMirrorDrain() {
+  if (!sqliteReadable() || !mirrorAdapter || mirrorTimer) return
+  mirrorTimer = setTimeout(() => {
+    mirrorTimer = null
+    void drainShareJsonMirror().then(({ pending }) => {
+      if (pending > 0) scheduleShareJsonMirrorDrain()
+    }).catch(() => {
+      scheduleShareJsonMirrorDrain()
+    })
+  }, MIRROR_DRAIN_INTERVAL_MS)
+  mirrorTimer.unref?.()
+}
+
+export function requestShareJsonMirrorDrain() {
+  scheduleShareJsonMirrorDrain()
+}
+
+export function stopShareService() {
+  if (mirrorTimer) clearTimeout(mirrorTimer)
+  mirrorTimer = null
+}
+
+export async function drainShareJsonMirror() {
+  if (!sqliteReadable() || !mirrorAdapter) return { pending: 0, drained: 0, failed: 0 }
+  if (drainPromise) return drainPromise
+  drainPromise = (async () => {
+    let drained = 0
+    let failed = 0
+    for (;;) {
+      const entries = repository().listMirrorQueue()
+      if (entries.length === 0) break
+      let progressed = false
+      for (const entry of entries) {
+        try {
+          if (entry.operation === 'upsert') await mirrorAdapter.upsert(entry.record)
+          else await mirrorAdapter.delete(entry.shareId)
+          repository().acknowledgeMirror(entry)
+          drained += 1
+          progressed = true
+        } catch (error) {
+          repository().failMirror(entry, error)
+          failed += 1
+        }
+      }
+      if (!progressed) break
+    }
+    return { pending: repository().listMirrorQueue().length, drained, failed }
+  })().finally(() => {
+    drainPromise = null
+  })
+  return drainPromise
+}
+
+export function listShareMirrorQueue() {
+  return repository().listMirrorQueue()
+}

package/server/share-store.mjs

@@ -4,6 +4,8 @@ import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { ensureStorage, storageDir } from './storage.mjs'
 import { hashPassword, safeHashEqual, sha256Base64Url, verifyPassword } from './utils/password-auth.mjs'
+import { getShareRepository, isShareStorageAuthoritative, requestShareJsonMirrorDrain } from './share-service.mjs'
+import { isShareMaintenanceActive } from './share-cutover.mjs'
 const SHARE_ID_PREFIX = 'qfs_'
 const SHARE_TOKEN_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000
 const MAX_SHARE_TOKENS = 50
@@ -23,6 +25,24 @@ function emitConversationShareInvalidated(shareId, reason) {
   shareLifecycleEvents.emit('invalidated', { shareId, reason })
 }
 
+// F10 Phase 2: share writes are SQLite-authoritative once the share storage is
+// pending/authoritative. The JSON file degrades to a best-effort mirror fed by
+// the share mirror queue; json_authoritative/cutover_running keep the legacy
+// JSON read/write path below.
+function repositoryActive() {
+  return isShareStorageAuthoritative()
+}
+
+function assertShareWritesAllowed() {
+  if (!repositoryActive()) return
+  if (isShareMaintenanceActive()) {
+    const error = new Error('Share storage is under maintenance')
+    error.statusCode = 423
+    error.errorCode = 'SHARE_MAINTENANCE_ACTIVE'
+    throw error
+  }
+}
+
 function clearShareTokens(record) {
   record.authVersion = (record.authVersion || 1) + 1
   record.tokens = []
@@ -137,7 +157,7 @@ export function createShareToken(shareId) {
   }
 }
 
-function pruneShareTokens(tokens, now = Date.now()) {
+function pruneTokenRecords(tokens, now = Date.now()) {
   return (Array.isArray(tokens) ? tokens : [])
     .filter((tokenRecord) => {
       if (!tokenRecord?.tokenHash) return false
@@ -149,11 +169,12 @@ function pruneShareTokens(tokens, now = Date.now()) {
 
 export function verifyShareToken(record, token) {
   if (!record || !token || typeof token !== 'string') return false
+  if (repositoryActive()) return getShareRepository().verifyToken(record, token)
   const [tokenShareId, secret] = token.split('.')
   if (tokenShareId !== record.id || !secret) return false
   const actualHash = sha256Base64Url(secret)
   const authVersion = record.authVersion || 1
-  const tokenRecords = pruneShareTokens(record.tokens)
+  const tokenRecords = pruneTokenRecords(record.tokens)
 
   if (record.tokenHash) {
     tokenRecords.push({ tokenHash: record.tokenHash, authVersion: record.authVersion || 1 })
@@ -238,6 +259,59 @@ export async function createConversationShare({
   const normalizedPassword = passwordProvided ? password.trim() : undefined
   const passwordInfo = passwordProvided ? await hashSharePassword(normalizedPassword) : {}
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const repository = getShareRepository()
+      const existingShares = repository.list({ sessionId, includeRevoked: true })
+      const current = existingShares.find((record) => !record.supersededAt)
+
+      if (permission === 'operate') {
+        const willHavePassword = passwordProvided ? Boolean(normalizedPassword) : Boolean(current?.passwordHash)
+        if (!willHavePassword) {
+          const error = new Error('Editable shares require a non-empty password')
+          error.statusCode = 400
+          throw error
+        }
+      }
+
+      const timestamp = new Date().toISOString()
+      // Preserve the existing password when the client did not send a new one
+      // (matching the legacy JSON create), and keep access counters intact.
+      const existingPassword = current?.passwordHash
+        ? { passwordHash: current.passwordHash, passwordSalt: current.passwordSalt, passwordVersion: current.passwordVersion }
+        : {}
+      const created = repository.create({
+        id: current?.id || generateShareId(),
+        sessionId,
+        permission,
+        titleSnapshot: titleSnapshot || current?.titleSnapshot || 'New chat',
+        scope: scope === 'project' ? 'project' : 'global',
+        projectId: scope === 'project' ? projectId : undefined,
+        allowCloudUsage: permission === 'operate' && allowCloudUsage === true,
+        expiresAt: expiresAt || undefined,
+        createdAt: current?.createdAt || timestamp,
+        updatedAt: timestamp,
+        accessCount: current?.accessCount ?? 0,
+        lastAccessedAt: current?.lastAccessedAt,
+        createdFromHost,
+        lastUpdatedFromHost: createdFromHost,
+        ...(passwordProvided ? passwordInfo : existingPassword),
+      })
+
+      for (const record of existingShares) {
+        if (record.id !== current?.id && !record.supersededAt) emitConversationShareInvalidated(record.id, 'superseded')
+      }
+      if (current) {
+        const lifecycleChanged = Boolean(current.revokedAt)
+          || String(current.expiresAt || '') !== String(created.expiresAt || '')
+          || current.allowCloudUsage === true !== (created.allowCloudUsage === true)
+          || (passwordProvided && (current.authVersion || 1) !== (created.authVersion || 1))
+        if (lifecycleChanged) emitConversationShareInvalidated(current.id, 'updated')
+      }
+      requestShareJsonMirrorDrain()
+      return publicShareRecord(created)
+    }
+
     const data = await readShareStoreFile()
     const now = new Date().toISOString()
     const existingRecords = Object.values(data)
@@ -336,11 +410,16 @@ export async function createConversationShare({
 
 export async function readConversationShare(shareId) {
   assertSafeShareId(shareId)
+  if (repositoryActive()) return getShareRepository().get(shareId)
   const data = await readShareStoreFile()
   return data[shareId] || null
 }
 
 export async function listConversationShares(sessionId) {
+  if (repositoryActive()) {
+    const records = getShareRepository().list({ sessionId: sessionId || undefined, includeRevoked: true })
+    return records.map(publicShareRecord)
+  }
   const data = await readShareStoreFile()
   return Object.values(data)
     .filter((record) => !sessionId || record.sessionId === sessionId)
@@ -352,6 +431,21 @@ export async function listConversationShares(sessionId) {
 export async function revokeConversationShare(shareId) {
   assertSafeShareId(shareId)
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const repository = getShareRepository()
+      const record = repository.get(shareId)
+      if (!record) {
+        const error = new Error('Share not found')
+        error.statusCode = 404
+        throw error
+      }
+      const wasActive = !record.revokedAt
+      const revoked = repository.revoke(shareId, {})
+      requestShareJsonMirrorDrain()
+      if (wasActive) emitConversationShareInvalidated(shareId, 'revoked')
+      return publicShareRecord(revoked)
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     if (!record) {
@@ -378,6 +472,12 @@ export async function restoreConversationShare(shareId, expiresAt) {
     throw error
   }
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const restored = getShareRepository().restore(shareId, { expiresAt })
+      requestShareJsonMirrorDrain()
+      return publicShareRecord(restored)
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     if (!record) {
@@ -408,6 +508,13 @@ export async function updateConversationShareExpiration(shareId, expiresAt) {
     throw error
   }
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const updated = getShareRepository().update(shareId, { expiresAt: expiresAt || null })
+      requestShareJsonMirrorDrain()
+      emitConversationShareInvalidated(shareId, 'updated')
+      return publicShareRecord(updated)
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     if (!record) {
@@ -441,6 +548,29 @@ export async function updateConversationShare(shareId, { permission, password, e
   }
   const passwordInfo = passwordProvided ? await hashSharePassword(normalizedPassword) : {}
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const repository = getShareRepository()
+      const existing = repository.get(shareId)
+      if (!existing) {
+        const error = new Error('Share not found')
+        error.statusCode = 404
+        throw error
+      }
+      const updated = repository.update(shareId, {
+        permission,
+        allowCloudUsage,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...passwordInfo,
+      })
+      requestShareJsonMirrorDrain()
+      const lifecycleChanged = (permission !== undefined && permission !== existing.permission)
+        || (expiresAt !== undefined && String(existing.expiresAt || '') !== String(expiresAt || ''))
+        || (allowCloudUsage !== undefined && (existing.allowCloudUsage === true) !== (allowCloudUsage === true))
+        || passwordProvided
+      if (lifecycleChanged) emitConversationShareInvalidated(shareId, 'updated')
+      return publicShareRecord(updated)
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     if (!record) {
@@ -488,6 +618,20 @@ export async function updateConversationShare(shareId, { permission, password, e
 export async function deleteConversationShare(shareId) {
   assertSafeShareId(shareId)
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const repository = getShareRepository()
+      const record = repository.get(shareId)
+      if (!record) {
+        const error = new Error('Share not found')
+        error.statusCode = 404
+        throw error
+      }
+      repository.delete(shareId, {})
+      requestShareJsonMirrorDrain()
+      emitConversationShareInvalidated(shareId, 'deleted')
+      return publicShareRecord(record)
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     if (!record) {
@@ -505,13 +649,19 @@ export async function deleteConversationShare(shareId) {
 export async function issueConversationShareToken(shareId) {
   assertSafeShareId(shareId)
   return enqueueWrite(writeQueueName, async () => {
+    assertShareWritesAllowed()
+    if (repositoryActive()) {
+      const result = getShareRepository().issueToken(shareId, {})
+      requestShareJsonMirrorDrain()
+      return { token: result.token, share: publicShareRecord(result.share) }
+    }
     const data = await readShareStoreFile()
     const record = data[shareId]
     assertShareActive(record)
     const { token, tokenHash } = createShareToken(shareId)
     const issuedAt = new Date().toISOString()
     const expiresAt = new Date(Date.now() + SHARE_TOKEN_MAX_AGE_MS).toISOString()
-    record.tokens = pruneShareTokens(record.tokens)
+    record.tokens = pruneTokenRecords(record.tokens)
     record.tokens.push({ tokenHash, issuedAt, expiresAt, authVersion: record.authVersion || 1 })
     record.tokens = record.tokens.slice(-MAX_SHARE_TOKENS)
     record.tokenHash = undefined
@@ -525,6 +675,35 @@ export async function issueConversationShareToken(shareId) {
   })
 }
 
+// Prune expired share tokens. Authoritative: a repository transaction that
+// deletes expired rows and bumps the share revision/mirror when anything was
+// removed. JSON: best-effort in-place prune of the legacy store.
+export async function pruneShareTokens(shareId) {
+  assertSafeShareId(shareId)
+  if (repositoryActive()) {
+    return enqueueWrite(writeQueueName, async () => {
+      assertShareWritesAllowed()
+      const removed = getShareRepository().pruneTokens(shareId, {})
+      requestShareJsonMirrorDrain()
+      return removed
+    })
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) return 0
+    const pruned = pruneTokenRecords(record.tokens)
+    const removed = (Array.isArray(record.tokens) ? record.tokens.length : 0) - pruned.length
+    if (removed > 0) {
+      record.tokens = pruned
+      record.updatedAt = new Date().toISOString()
+      data[shareId] = record
+      await writeShareStoreFile(data)
+    }
+    return removed
+  })
+}
+
 function messageTimestampMs(message) {
   const timestamp = message?.timestamp
   if (typeof timestamp === 'number' && Number.isFinite(timestamp)) return timestamp
@@ -549,7 +728,7 @@ function lastModifiedFromMessages(messages, fallback) {
 }
 
 export async function rollbackSharedSessionMessages(record, rollbackMessageIndex) {
-  const { readSessionValue, writeSessionValue, atomicUpdate } = await import('./storage.mjs')
+  const { readSessionValue, atomicSessionRecordUpdate } = await import('./storage.mjs')
   const { rollbackSessionMessages, rollbackStartIndexFromMessage } = await import('./agent-manager.mjs')
   const session = await readSessionValue(record.sessionId)
   if (!session) {
@@ -573,23 +752,21 @@ export async function rollbackSharedSessionMessages(record, rollbackMessageIndex
 
   const nextMessages = messages.slice(0, rollbackIndex)
   const lastModified = lastModifiedFromMessages(nextMessages, session.createdAt || session.lastModified)
-  await writeSessionValue(record.sessionId, {
-    ...session,
-    messages: nextMessages,
-    lastModified,
-  })
-  await atomicUpdate('sessions-metadata', (metadata) => {
-    const existing = metadata[record.sessionId]
-    if (existing) {
-      metadata[record.sessionId] = {
-        ...existing,
-        messageCount: nextMessages.length,
-        lastModified,
-        preview: previewFromMessages(nextMessages),
-      }
+  // Body + metadata roll back as one atomic session record update (single
+  // SQLite transaction when authoritative), so the shared page never observes
+  // a body rolled back while metadata still counts the removed messages.
+  const updated = await atomicSessionRecordUpdate(record.sessionId, ({ state, metadata }) => {
+    if (state.archivedAt) return null
+    return {
+      state: { ...state, messages: nextMessages, lastModified },
+      metadata: { ...metadata, messageCount: nextMessages.length, lastModified, preview: previewFromMessages(nextMessages) },
     }
-    return metadata
   })
+  if (!updated) {
+    const error = new Error('Session not found')
+    error.statusCode = 404
+    throw error
+  }
   return { session: { ...session, messages: nextMessages, lastModified }, rollbackIndex }
 }
 

package/server/skills.mjs

@@ -256,7 +256,6 @@ function skillFromStandardMarkdown(rootDir, source, text) {
   const name = normalizeSkillName(rawManifest.name)
   const description = normalizeString(rawManifest.description)
   if (!name || !isValidSkillName(name)) return null
-  if (name !== normalizeSkillName(path.basename(rootDir))) return null
   if (!description || description.length > 1024) return null
 
   const metadata = normalizeMetadata(rawManifest.metadata)