dsh-conversation-recycle-bin 0.3.11 → 0.3.13

package/lib/host/api.js

@@ -55,6 +55,7 @@ import { createCatalogOps, createSessionLogOps } from './catalog.js'
 import { createLifecycleOps } from './lifecycle.js'
 import { createSessionGateway } from './gateway.js'
 import { createMemoryAdapters } from './memory.js'
+import { encodeSessionSegment, projectKey, readSessionLogCwd } from './paths.js'
 import { createFeedbackService } from './feedback.js'
 import { PLUGIN_VERSION } from '../version.js'
 import { SESSION_ID_PATTERN } from '../core/ids.js'
@@ -75,6 +76,21 @@ const MAX_BODY_BYTES = 256 * 1024
  */
 export const TRASH_LOCK_BUDGET_MS = 180_000
 
+/**
+ * Slack added on top of an operation's lock budget before a queued request is
+ * rejected. The Host publishes the resulting number (`queueTimeoutMs`) so the
+ * Client waits for the Host's answer instead of inventing a shorter deadline of
+ * its own — a client that gave up 60 s early used to report a timeout for an
+ * operation the Host then completed.
+ */
+export const QUEUE_GRACE_MS = 60_000
+
+/** The wait a caller should allow for `lockBudgetMs` plus queueing behind it. */
+export function queueBudgetFor(lockBudgetMs) {
+  const budget = Number(lockBudgetMs)
+  return (Number.isFinite(budget) && budget > 0 ? budget : 30_000) + QUEUE_GRACE_MS
+}
+
 function isLoopbackHostname(hostname) {
   const value = String(hostname ?? '').trim().toLowerCase().replace(/^\[|\]$/g, '')
   return value === 'localhost' || value === '::1' || value === '0:0:0:0:0:0:0:1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(value)
@@ -397,6 +413,25 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         return false
       }
     },
+    /**
+     * Reconstruct the original session-log location of an entry whose move
+     * completed but whose manifest did not record it (a crash between
+     * `moveDirectory` and `trash.update`). The log header still carries the
+     * session's cwd, which is the only durable input needed to rebuild the
+     * Host's project-directory path; a missing/unreadable header returns null
+     * and the caller keeps refusing instead of guessing.
+     */
+    recoverSessionLog: async (entry) => {
+      if (typeof entry?.sessionId !== 'string' || !SESSION_ID_PATTERN.test(entry.sessionId)) return null
+      if (typeof entry?.trashId !== 'string' || !isTrashId(entry.trashId)) return null
+      const sessionDir = join(trash.entryDir(entry.trashId), 'session')
+      if (!(await readdir(sessionDir).catch(() => null))) return null
+      const cwd = await readSessionLogCwd(sessionDir)
+      if (cwd === null) return null
+      const from = join(paths.sessionsRoot, projectKey(cwd), encodeSessionSegment(entry.sessionId))
+      if (!isPathInside(paths.sessionsRoot, from) || !isPathInside(paths.trashDir, sessionDir)) return null
+      return { sessionId: entry.sessionId, from, to: sessionDir }
+    },
     // Manifest paths are data, not truth: a hand-edited manifest must not turn
     // "restore" into a proxy for stat/move on arbitrary directories.
     isInsideSessionsRoot: (target) => typeof target === 'string' && target !== '' && isPathInside(paths.sessionsRoot, target),
@@ -451,9 +486,14 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
    *     finishes, and never waits forever either.
    */
   function serialize(operation, { lockTimeoutMs, shouldAbort } = {}) {
-    const graceMs = 60_000
-    const queueBudgetMs = lockTimeoutMs === undefined ? 30_000 + graceMs : lockTimeoutMs + graceMs
+    const queueBudgetMs = queueBudgetFor(lockTimeoutMs === undefined ? 30_000 : lockTimeoutMs)
     let abandoned = false
+    // Once the operation itself starts, the queue timer stops: from that moment
+    // the outcome belongs to the operation, and answering "not applied" would be
+    // a lie (the purge/restore may well have happened). The budget therefore
+    // covers the wait, which is the only part this function can honestly abort.
+    let started = false
+    let timer = null
     const aborted = () => typeof shouldAbort === 'function' && shouldAbort() === true
     const next = mutationChain.then(async () => {
       if (abandoned) {
@@ -479,6 +519,8 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         if (aborted()) {
           throw new DeleteError('E_ABANDONED', 'The client disconnected before this request ran; nothing was changed.', {})
         }
+        started = true
+        if (timer !== null) clearTimeout(timer)
         return await operation()
       } finally {
         await release()
@@ -486,7 +528,8 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     })
     mutationChain = next.then(() => undefined, () => undefined)
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
+      timer = setTimeout(() => {
+        if (started) return
         abandoned = true
         reject(
           new DeleteError(
@@ -688,6 +731,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         trashRetentionDays: config.trashRetentionDays,
         confirmTokenTtlMs: config.confirmTokenTtlMs,
         planTimeoutMs,
+        // How long the Client should wait for the answer: the plan's own lock
+        // budget plus the queueing grace. The Client used to derive a shorter
+        // number and give up 60 s before the Host finished.
+        queueTimeoutMs: queueBudgetFor(planTimeoutMs),
       },
     }
   }
@@ -782,7 +829,6 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         failures.push({ sessionId: session.id, error: rateError.toJSON() })
         continue
       }
-      if (!validated.record.used) markConfirmationUsed(validated)
       try {
         const outcome = await performSessionDelete({
           session,
@@ -817,6 +863,14 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     gateway.invalidate()
     invalidateTrashCache()
 
+    // The token is burned only once the whole plan went through. It used to be
+    // marked used before the first item, so a batch that failed halfway left the
+    // user holding a dead token: the remaining sessions could not be retried
+    // without previewing again and retyping the confirmation phrase. The token
+    // is bound to (ids, mode, includeMemory), so a retry can only replay this
+    // same plan — already-deleted sessions answer E_NOT_FOUND, never a second
+    // deletion.
+    if (failures.length === 0) markConfirmationUsed(validated)
     if (results.length === 0 && failures.length > 0) {
       const first = failures[0].error
       throw new DeleteError(first.code, first.message, { ...(first.details ?? {}), failures })
@@ -902,6 +956,10 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     return {
       enabled: config.enabled,
       version: PLUGIN_VERSION,
+      // The Client cannot tell a broken deployment from a broken permission
+      // otherwise: with `requireConnection` on and no service mounted, every
+      // route answers 401 and the panel just looked empty.
+      connectionFence: connectionFencePresent(),
       defaultMode: config.defaultMode,
       memory: {
         enabled: config.memory.enabled,
@@ -915,6 +973,9 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         rate: limiter.status(),
         trashRetentionDays: config.trashRetentionDays,
         confirmTokenTtlMs: config.confirmTokenTtlMs,
+        // Trash mutations take the fixed trash budget; the Client waits for it
+        // instead of using its generic request timeout.
+        queueTimeoutMs: queueBudgetFor(TRASH_LOCK_BUDGET_MS),
       },
       ui: config.ui,
       feedback: feedbackService.status(),
@@ -953,13 +1014,45 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     })
   }
 
-  function serializeEntry(entry) {
+  /** Ordered map with at most `limit` filesystem probes in flight. */
+  async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length)
+    let next = 0
+    const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
+      while (true) {
+        const index = next
+        next += 1
+        if (index >= items.length) return
+        out[index] = await fn(items[index], index)
+      }
+    })
+    await Promise.all(workers)
+    return out
+  }
+
+  /** Disk payload of one entry, for the capability flags the Client renders. */
+  async function entryDisk(trashId) {
+    if (!isTrashId(trashId)) return { hasLogFiles: false, hasMemoryFiles: false }
+    let dir
+    try {
+      dir = trash.entryDir(trashId)
+    } catch {
+      return { hasLogFiles: false, hasMemoryFiles: false }
+    }
+    return {
+      hasLogFiles: await ops.pathExists(join(dir, 'session')),
+      hasMemoryFiles: await ops.hasFiles(join(dir, 'memory')),
+    }
+  }
+
+  async function serializeEntry(entry) {
     const retentionDays = config.trashRetentionDays
     // The Client must not recompute the window from `deletedAt`: a browser clock
     // that is a day off would shift the promise the Host actually keeps. The
     // countdown is therefore decided here, once, by the same predicate the sweep
     // uses (`daysUntilExpiry`), and `expiresAt` carries the absolute deadline.
     const daysLeft = daysUntilExpiry(entry, { retentionDays, now: now() })
+    const disk = await entryDisk(entry.trashId)
     return {
       trashId: entry.trashId,
       sessionId: entry.sessionId,
@@ -974,13 +1067,38 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
       memoryAdapters: Array.isArray(entry.memory?.adapters) ? entry.memory.adapters : [],
       hasSessionLog: entry.sessionLog !== null && entry.sessionLog !== undefined,
       status: entry.status,
-      // The UI renders buttons from the same predicate the routes enforce, so a
-      // row can no longer offer an action that will be refused.
-      capabilities: entryCapabilities(entry),
+      // The UI renders buttons from the same predicate the routes enforce. Disk
+      // payload is part of that predicate: a manifest can be empty while the
+      // moved log/memory copy is still on disk, and a status-only answer
+      // advertised actions the routes refused.
+      capabilities: entryCapabilities(entry, { ...disk, requirePayload: true }),
       error: entry.error ?? null,
     }
   }
 
+  /** A folder whose manifest cannot be read still has a reliable disk payload. */
+  async function serializeUnreadable(item) {
+    const disk = await entryDisk(item.trashId)
+    return {
+      trashId: item.trashId,
+      sessionId: null,
+      title: null,
+      mode: null,
+      includeMemory: false,
+      deletedAt: 0,
+      updatedAt: 0,
+      memory: 0,
+      memoryAdapters: [],
+      hasSessionLog: false,
+      status: 'unreadable',
+      capabilities: entryCapabilities({ status: 'unreadable' }, disk),
+      error: {
+        code: item.reason,
+        message: 'The manifest could not be read; discard this folder only after confirming it holds no log or memory files.',
+      },
+    }
+  }
+
   async function trashList() {
     // The retention sweep is kicked off, not awaited: it needs the mutation lock
     // (a purge in flight can hold it for minutes), and a GET must never block on
@@ -994,28 +1112,16 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     // is missing/corrupt are surfaced as `unreadable` so they are not stranded
     // on disk; the Client renders both groups separately.
     const { entries: all, unreadable } = await trash.scanAll()
+    const trashed = all.filter((entry) => entry.status === 'trashed')
+    const incompleteEntries = all.filter((entry) => entry.status !== 'trashed')
+    const [entries, incomplete, unreadableRows] = await Promise.all([
+      mapLimit(trashed, 8, serializeEntry),
+      mapLimit(incompleteEntries, 8, serializeEntry),
+      mapLimit(unreadable, 8, serializeUnreadable),
+    ])
     const result = {
-      entries: all.filter((entry) => entry.status === 'trashed').map(serializeEntry),
-      incomplete: [
-        ...all.filter((entry) => entry.status !== 'trashed').map(serializeEntry),
-        ...unreadable.map((item) => ({
-          trashId: item.trashId,
-          sessionId: null,
-          title: null,
-          mode: null,
-          includeMemory: false,
-          deletedAt: 0,
-          updatedAt: 0,
-          memory: 0,
-          memoryAdapters: [],
-          hasSessionLog: false,
-          status: 'unreadable',
-          error: {
-            code: item.reason,
-            message: 'The manifest could not be read; discard this folder only after confirming it holds no log or memory files.',
-          },
-        })),
-      ],
+      entries,
+      incomplete: [...incomplete, ...unreadableRows],
       // What the background sweep did last time, so entries that vanished can be
       // explained instead of looking like a bug. `null` until the first sweep.
       lastSweep: lastRetentionResult,
@@ -1069,11 +1175,15 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
         for (const candidate of expired) {
           const entry = await trash.read(candidate.trashId)
           if (entry === null || !entryCapabilities(entry).canPurge) continue
-          // A `trashed` soft entry whose conversation is resolvable again (the
-          // user re-created it, or unarchived it outside this plugin) must not be
-          // purged unattended: `performPurge` would quiesce and hard-delete the
-          // conversation the user is working in. Retention is a janitor, not a
-          // killer — the entry stays for the next run and for the user.
+          // A soft entry's log stays on disk, so "the session can still be
+          // inspected" is its NORMAL state and must not block retention. Only a
+          // conversation the user actually revived (unarchived) or one that is
+          // running is left alone: purging it unattended would quiesce and
+          // hard-delete the conversation the user is working in. Retention is a
+          // janitor, not a killer.
+          //
+          // `archived` unknown (older Host shape, unreadable workspace state)
+          // stays conservative: skip and let the user decide.
           if (entry.mode === 'soft' && typeof entry.sessionId === 'string' && entry.sessionId !== '') {
             let session = null
             try {
@@ -1084,8 +1194,12 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
               session = { unreadable: true }
             }
             if (session !== null && session !== undefined) {
-              failed.push({ trashId: candidate.trashId, code: 'E_SESSION_ALIVE' })
-              continue
+              const revived = session.archived === false
+              const running = session.running === true || session.live === true || session.unreadable === true
+              if (revived || running || session.archived !== true) {
+                failed.push({ trashId: candidate.trashId, code: 'E_SESSION_ALIVE' })
+                continue
+              }
             }
           }
           try {
@@ -1161,6 +1275,23 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
     }
   }
 
+  /**
+   * True when a real `connection` service is mounted. Probed rather than
+   * injected: a composition without it must still load.
+   */
+  function connectionFencePresent() {
+    const connection = connectionService()
+    return connection !== undefined && typeof connection.requestRejection === 'function'
+  }
+
+  /** `/state` (or the bare prefix) as a GET — the only route readable without a connection fence. */
+  function isStateProbe(req) {
+    if (String(req.method ?? 'GET').toUpperCase() !== 'GET') return false
+    const pathname = new URL(req.url ?? '/', 'http://host.invalid').pathname
+    const path = pathname.startsWith(ROUTE_PREFIX) ? pathname.slice(ROUTE_PREFIX.length) : pathname
+    return path === '' || path === '/state'
+  }
+
   /** One request → one response. Route matching stays here, not in `apply`. */
   const handleRequest = async (req, res) => {
     const method = String(req.method ?? 'GET').toUpperCase()
@@ -1298,8 +1429,22 @@ export function createDeleteApi({ ctx, config, paths, now = Date.now, logger = c
   const handler = (req, res) => {
     void (async () => {
       const connection = connectionService()
-      const hasConnectionFence = connection !== undefined && typeof connection.requestRejection === 'function'
+      const hasConnectionFence = connectionFencePresent()
       if (!hasConnectionFence && config.requireConnection !== false) {
+        // `/state` stays readable: it carries no conversation data (limits,
+        // adapters, switches) and it is how the panel explains why everything
+        // else is refused. Every other route — including the session list and
+        // the trash — stays 401, because the remaining fence cannot tell one
+        // local process from another.
+        if (isStateProbe(req)) {
+          const origin = transportVerdict(req)
+          if (!origin.ok) {
+            sendJson(res, origin.error.httpStatus, toWireError(origin.error))
+            return
+          }
+          sendJson(res, 200, { ok: true, state: await state() })
+          return
+        }
         logger.error?.('[conversation-recycle-bin] no connection service; refusing request because requireConnection is enabled')
         sendJson(res, 401, toWireError(new DeleteError('E_UNAUTHORIZED', 'This Host has no connection layer to authenticate the request; set requireConnection: false to allow it.', {})))
         return

package/lib/host/catalog.js

@@ -96,21 +96,28 @@ export function createSessionLogOps({ gateway, paths, config, now = Date.now, de
   return {
     /**
      * Move `<sessions>/<slug>/<sessionId>/` into the recycle-bin entry.
+     *
+     * `beforeMove` receives the `{ from, to }` mapping after every check has
+     * passed but before the rename. The caller persists that mapping first, so
+     * a crash between the move and the later manifest write cannot leave a log
+     * in `session/` that the manifest no longer knows how to put back.
      * @returns {Promise<{ sessionId: string, from: string, to: string }>}
      */
-    async moveToTrash(session, entryDir) {
+    async moveToTrash(session, entryDir, { beforeMove } = {}) {
       const from = await gateway.findSessionDir(session.id)
       if (from === null) {
         throw new DeleteError('E_NOT_FOUND', 'The conversation log was not found on disk.', { sessionId: session.id })
       }
       await assertNoForeignWriter(session, from)
       const to = join(entryDir, 'session')
+      const moved = { sessionId: session.id, from, to }
+      if (typeof beforeMove === 'function') await beforeMove(moved)
       await moveDirectory(from, to)
       // Derived cache only: safe to lose, and removing it here prevents a stale
       // projection row for a session that no longer exists. Best-effort by
       // design — the cache self-heals, so this must not fail the transaction.
       if (paths !== undefined) await removeProjectionCheckpoint(paths.storagesDir, session.id)
-      return { sessionId: session.id, from, to }
+      return moved
     },
 
     async restoreEntry(moved) {