cc-viewer 1.7.1 → 1.7.3

package/server/lib/v2/adapter.js

@@ -33,6 +33,8 @@ import { reportSwallowed } from '../error-report.js';
 import { isMainAgentRequest } from '../interceptor-core.js';
 import { readPromptsHead, collectPromptsFromEvents } from '../user-prompt-extract.js';
 import { readSession, readJsonlTolerant, listSessionIds } from './replay.js';
+import { iterateJsonlLines } from './jsonl-read.js';
+import { isDiscardableSession } from './session-select.js';
 import { blobPath, isSupportedWireFormat, dirSizeSync } from './layout.js';
 import { SingleFlight } from './singleflight.js';
 
@@ -59,16 +61,17 @@ export function isV2SessionDir(p) {
 function readResponsesRaw(sessionDir) {
   const bySeq = new Map();
   const p = join(sessionDir, 'responses.jsonl');
-  if (!existsSync(p)) return bySeq;
-  let raw = '';
-  try { raw = readFileSync(p, 'utf-8'); } catch { return bySeq; }
-  for (const line of raw.split('\n')) {
-    const t = line.trim();
-    if (!t) continue;
-    const m = t.match(/"seq":\s*(\d+)/);
-    if (!m) continue;
-    const seq = Number(m[1]);
-    if (!bySeq.has(seq)) bySeq.set(seq, t);
+  try {
+    // streamed line-by-line (issue #129): responses.jsonl is the most likely
+    // file to outgrow Node's string cap (full response bodies, one per request)
+    for (const t of iterateJsonlLines(p)) {
+      const m = t.match(/"seq":\s*(\d+)/);
+      if (!m) continue;
+      const seq = Number(m[1]);
+      if (!bySeq.has(seq)) bySeq.set(seq, t);
+    }
+  } catch (err) {
+    reportSwallowed('v2-read.responses-read-failed', err);
   }
   return bySeq;
 }
@@ -491,6 +494,14 @@ export class SessionSynthesizer {
       phase: 'placeholder',
       entry,
       isMain: isMainKind,
+      // Journal-truth request identity for the live row builder (live-feed
+      // _rowFrom): conv/evt are the V3.S5 assembler inputs the cold fold
+      // (meta-rows foldDir) already carries — without them on live rows the
+      // client rebuilds entries with EMPTY messages and the chat vanished at
+      // stream end until a cold reload (2026-07-16 live-render regression).
+      kind: req.kind,
+      ...(req.conv && { conv: req.conv }),
+      ...(req.evt && { evt: req.evt }),
       stateRef: conv ? conv.state : null,
     };
     this._await.set(seq, item);
@@ -563,7 +574,15 @@ export class SessionSynthesizer {
 function* iterateSessionItems(sessionDir, opts = {}) {
   const projectDir = dirname(dirname(sessionDir));
   const sessionId = basename(sessionDir);
-  const session = readSession(projectDir, sessionId);
+  let session;
+  try {
+    session = readSession(projectDir, sessionId);
+  } catch (err) {
+    // One unreadable session must degrade to "not rendered", never crash the
+    // whole scan (issue #129: an oversized file crash-looped every startup).
+    reportSwallowed('v2-read.session-read-failed', new Error(`${sessionId}: ${err.message}`));
+    return;
+  }
   if (session.unsupported) {
     reportSwallowed('v2-read.unsupported-wire-format', new Error(`${sessionId}: wireFormat=${session.wireFormat}`));
     return;
@@ -628,6 +647,12 @@ export function findTeammateSessionDirs(sessionDir, leaderUuid) {
         continue;
       }
       if (!l) {
+        // Discardable dirs (quota-probe orphans — no main/teammate req) must
+        // never act as leader candidates: a probe fires at process startup,
+        // so its startTs sits right next to the real leader's and can win the
+        // orphan tie-break below, stealing the teammate's traffic from the
+        // real leader's folded stream.
+        if (isDiscardableSession(dir, meta)) continue;
         leaderStarts.push({ sid: name, startTs: (meta && meta.startTs) || '' });
         continue;
       }
@@ -1081,8 +1106,12 @@ export function listV2Sessions(projectDir) {
       const reqKind = new Map();
       let turns = 0;
       let sentinelVersion = null;
+      let hasMainOrTeammate = false;
       for (const line of readJsonlTolerant(join(dir, 'journal.jsonl'))) {
-        if (line.ph === 'req') reqKind.set(line.seq, line.kind);
+        if (line.ph === 'req') {
+          reqKind.set(line.seq, line.kind);
+          if (line.kind === 'main' || line.kind === 'teammate') hasMainOrTeammate = true;
+        }
         else if (line.ph === 'done' && reqKind.get(line.seq) === 'main') {
           turns++;
           reqKind.delete(line.seq); // fold duplicate done lines (§14)
@@ -1117,6 +1146,17 @@ export function listV2Sessions(projectDir) {
         turns,
         size: dirSizeSync(dir),
         preview,
+        // Discardable-session verdict. KEEP IN SYNC: session-select.js
+        // isDiscardableSession is the canonical rule; this fold pre-computes
+        // it for free over the FULL journal (the canonical scan is 8MB-
+        // budgeted — intentional asymmetry, a first main sits at the head).
+        // When the fold says discard, the canonical predicate CONFIRMS it:
+        // readJsonlTolerant swallows an I/O error (Windows EBUSY/EPERM lock)
+        // into zero lines, which must KEEP the session, not hide it — the
+        // canonical path carries that error→keep direction (ioErrorResult).
+        // Main-bearing sessions never pay the extra read; probe journals are
+        // ~3 lines.
+        discard: !(meta && meta.leader) && !hasMainOrTeammate && isDiscardableSession(dir, meta),
       });
     } catch { /* one unreadable session must not break the list */ }
   }

package/server/lib/v2/journal.js

@@ -8,7 +8,7 @@
 // The reader folds the two phases by seq; a req without a done is in-flight
 // (or the process died) — that IS the v1 placeholder, minus the duplicated body.
 
-import { existsSync, readFileSync } from 'node:fs';
+import { iterateJsonlLines } from './jsonl-read.js';
 
 export class Journal {
   /**
@@ -29,11 +29,15 @@ export class Journal {
 
   static _maxSeqIn(journalPath) {
     try {
-      if (!existsSync(journalPath)) return 0;
       let max = 0;
-      // Regex scan instead of per-line JSON.parse: tolerant of a truncated
-      // tail line and ~10x cheaper on large journals.
-      for (const m of readFileSync(journalPath, 'utf-8').matchAll(/"seq":\s*(\d+)/g)) {
+      // Per-line regex instead of JSON.parse: tolerant of a truncated tail
+      // line and ~10x cheaper on large journals. Streamed line-by-line
+      // (issue #129): a whole-file read past Node's string cap would land in
+      // the catch below and silently RESET seq to 0 — colliding with every
+      // existing line, which the reader folds into corrupted sessions.
+      for (const line of iterateJsonlLines(journalPath)) {
+        const m = /"seq":\s*(\d+)/.exec(line);
+        if (!m) continue;
         const n = Number(m[1]);
         if (n > max) max = n;
       }

package/server/lib/v2/jsonl-read.js

@@ -0,0 +1,127 @@
+// Wire Format v2 — streaming JSONL line reader (issue #129).
+//
+// `readFileSync(path, 'utf-8')` materializes the WHOLE file as one JS string
+// and throws ERR_STRING_TOO_LONG past Node's ~512MiB string cap — a single
+// oversized session file (giant conv epoch / journal / responses.jsonl, seen
+// in the wild after migrating very large v1 logs) crash-looped the server on
+// every startup scan. This reader never builds a whole-file string: it reads
+// fixed-size chunks and splits lines at the BYTE level (scanning for 0x0A
+// before decoding), so multi-byte UTF-8 characters straddling a chunk
+// boundary are never torn, and only one line at a time ever becomes a string.
+//
+// A single line at/above the string cap can never be decoded at all — it is
+// skipped (reported once per file via reportSwallowed) instead of throwing,
+// mirroring readJsonlTolerant's torn-tail tolerance (spec §14).
+
+import { existsSync, openSync, readSync, closeSync, statSync } from 'node:fs';
+import { reportSwallowed } from '../error-report.js';
+
+const DEFAULT_CHUNK_BYTES = 8 * 1024 * 1024;
+// Node's max string length is 0x1fffffe8 (~512MiB) — a line this long can
+// never become a JS string, so it is unreadable by construction.
+const DEFAULT_MAX_LINE_BYTES = 0x1fffffe8;
+
+/**
+ * Iterate a JSONL file's lines as trimmed strings (blank lines skipped),
+ * without ever holding the whole file in one string.
+ *
+ * @param {string} path
+ * @param {{maxLineBytes?: number, chunkBytes?: number}} [opts] - test seams;
+ *   production callers use the defaults.
+ * @yields {string} one trimmed non-empty line
+ */
+export function* iterateJsonlLines(path, opts = {}) {
+  const maxLineBytes = opts.maxLineBytes || DEFAULT_MAX_LINE_BYTES;
+  const chunkBytes = opts.chunkBytes || DEFAULT_CHUNK_BYTES;
+  if (!existsSync(path)) return;
+  let fd;
+  try {
+    fd = openSync(path, 'r');
+  } catch (err) {
+    // ENOENT = vanished mid-scan (benign TOCTOU); anything else (EBUSY/EPERM
+    // Windows locks, EMFILE) silently rendering a session empty is
+    // diagnostic-worthy — CLAUDE.md swallow rule.
+    if (err && err.code !== 'ENOENT') reportSwallowed('v2-read.open-failed', err);
+    return;
+  }
+  try {
+    // Cap the chunk to the file's actual size (like the sibling readers):
+    // a fixed 8MB zero-filled alloc per call is a ~2600x regression over the
+    // old readFileSync for the KB-scale journals startup scans walk.
+    let capBytes = chunkBytes;
+    try { capBytes = Math.min(chunkBytes, Math.max(statSync(path).size, 1)); }
+    catch { /* stat raced a delete — keep the full chunk; the read loop decides */ }
+    const chunk = Buffer.alloc(capBytes);
+    let carry = [];       // Buffer fragments of the current (incomplete) line
+    let carryBytes = 0;
+    let skipping = false; // inside an oversized line — drop bytes until \n
+    let reported = false; // one report per file, not per oversized line
+    let pos = 0;
+    const reportOnce = (err) => {
+      if (reported) return;
+      reported = true;
+      reportSwallowed('v2-read.jsonl-line-too-long', err);
+    };
+    while (true) {
+      const n = readSync(fd, chunk, 0, chunk.length, pos);
+      if (n === 0) break;
+      pos += n;
+      const view = chunk.subarray(0, n);
+      let from = 0;
+      while (from < n) {
+        const nl = view.indexOf(10, from);
+        if (nl === -1) {
+          // no newline in the rest of this chunk — carry (or keep skipping)
+          if (!skipping) {
+            const restLen = n - from;
+            if (carryBytes + restLen > maxLineBytes) {
+              skipping = true;
+              carry = [];
+              carryBytes = 0;
+              reportOnce(new Error(`${path}: line exceeds ${maxLineBytes} bytes — skipped`));
+            } else {
+              // chunk is reused by the next readSync — the carried slice must own its bytes
+              carry.push(Buffer.from(view.subarray(from)));
+              carryBytes += restLen;
+            }
+          }
+          break;
+        }
+        if (skipping) {
+          skipping = false; // the oversized line ends at this newline
+        } else {
+          const seg = view.subarray(from, nl);
+          let text = null;
+          try {
+            if (carry.length > 0) {
+              carry.push(seg);
+              text = Buffer.concat(carry).toString('utf-8');
+            } else {
+              text = seg.toString('utf-8');
+            }
+          } catch (err) {
+            reportOnce(err); // decode failed (line at the string cap) — skip it
+          }
+          carry = [];
+          carryBytes = 0;
+          if (text !== null) {
+            const t = text.trim();
+            if (t) yield t;
+          }
+        }
+        from = nl + 1;
+      }
+    }
+    // trailing line without a final newline (torn tail is the caller's concern)
+    if (!skipping && carry.length > 0) {
+      let text = null;
+      try { text = Buffer.concat(carry).toString('utf-8'); } catch (err) { reportOnce(err); }
+      if (text !== null) {
+        const t = text.trim();
+        if (t) yield t;
+      }
+    }
+  } finally {
+    closeSync(fd);
+  }
+}