ework-web 0.1.1 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -78,6 +78,12 @@ export const configSchema = z.object({
   daemonBotLogin: z.string().default(""),
   daemonWebhookUrl: z.string().default(""),
   daemonWebhookSecret: z.string().default(""),
+  autowireActive: z.coerce.boolean().default(true),
+  webhookMaxConcurrent: z.preprocess((v) => {
+    const n = typeof v === "number" ? v : Number(v);
+    if (!Number.isFinite(n) || n < 1 || n > 64) return 6;
+    return Math.floor(n);
+  }, z.number().int().min(1).max(64)),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -160,6 +166,8 @@ export function loadConfig(): Config {
     daemonBotLogin: process.env.WORK_DAEMON_BOT_LOGIN ?? "",
     daemonWebhookUrl: process.env.WORK_DAEMON_WEBHOOK_URL ?? "",
     daemonWebhookSecret: process.env.WORK_DAEMON_WEBHOOK_SECRET ?? "",
+    autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
+    webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),
   });
 }
 

package/src/db.ts

@@ -57,6 +57,14 @@ function migrateProjectsTable(db: Database): void {
   }
 }
 
+function migrateIssuesTable(db: Database): void {
+  const have = tableColumns(db, "issues");
+  if (have.size === 0) return;
+  if (!have.has("closed_at")) {
+    db.exec("ALTER TABLE issues ADD COLUMN closed_at TEXT");
+  }
+}
+
 function db(): Database {
   if (_db) return _db;
   mkdirSync(dirname(DB_PATH), { recursive: true });
@@ -72,6 +80,7 @@ function db(): Database {
   migrateUsersTable(_db);
   migratePatTable(_db);
   migrateProjectsTable(_db);
+  migrateIssuesTable(_db);
   _db.exec(readFileSync(join(import.meta.dir, "schema.sql"), "utf8"));
   return _db;
 }

package/src/giteaApi.ts

@@ -160,8 +160,16 @@ export async function handleGiteaApi(
       const title = asString(body.title);
       if (!title) return giteaError(400, "title required");
       const text = asString(body.body) ?? "";
-      const created = createIssue(project.id, title, text, user.login);
+      const created = createIssue(project.id, title, text, user.login, {
+        createdAt: asString(body.created_at),
+        updatedAt: asString(body.updated_at),
+        state: asIssueState(body.state) ?? "open",
+        closedAt: asString(body.closed_at) || undefined,
+      });
       emitIssueEvent(project.id, created.id, "opened", origin);
+      if (created.state === "closed") {
+        emitIssueEvent(project.id, created.id, "closed", origin);
+      }
       return { status: 201, body: buildIssuePayload(created, project, 0, origin) };
     } catch (e) {
       return giteaError(e instanceof StoreError ? e.status : 500, e instanceof Error ? e.message : "error");
@@ -190,6 +198,8 @@ export async function handleGiteaApi(
           title: asString(body.title),
           body: asString(body.body),
           state: asIssueState(body.state),
+          closedAt: asString(body.closed_at) || undefined,
+          updatedAt: asString(body.updated_at),
         });
         const after = getIssueById(issue.id);
         if (!after) return giteaError(404, "issue vanished mid-edit");
@@ -229,7 +239,10 @@ export async function handleGiteaApi(
         const body = await readJson(req);
         const text = asString(body.body);
         if (text === undefined) return giteaError(400, "body required");
-        const created = postComment(issue.id, text, user.login);
+        const created = postComment(issue.id, text, user.login, {
+          createdAt: asString(body.created_at),
+          updatedAt: asString(body.updated_at),
+        });
         emitCommentEvent(project.id, issue.id, created.id, origin);
         return { status: 201, body: buildCommentPayload(issue, created, project, origin) };
       }

package/src/index.ts

@@ -89,6 +89,10 @@ const cfg: Config = loadConfig();
 const opencode = new OpencodeClient(cfg);
 
 function autoWireDaemon(projectId: number, origin: string): void {
+  if (!cfg.autowireActive) {
+    log.info("autoWireDaemon: skipped (WORK_AUTOWIRE_ACTIVE=false)", { projectId });
+    return;
+  }
   const botLogin = cfg.daemonBotLogin.trim();
   const hookUrl = cfg.daemonWebhookUrl.trim();
   if (botLogin) {

package/src/opencode.ts

@@ -170,11 +170,16 @@ export class OpencodeClient {
     }
     const text = stdout.trim();
     if (!text) return null;
-    try {
-      return JSON.parse(text);
-    } catch {
+    const jsonText = stripNonJsonPreamble(text);
+    if (jsonText === null) {
       throw new OpencodeError(`opencode ${args.join(" ")}: non-JSON output`, 502);
     }
+    try {
+      return JSON.parse(jsonText);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new OpencodeError(`opencode ${args.join(" ")}: malformed JSON (${msg})`, 502);
+    }
   }
 
   private async run(args: string[]): Promise<{ stdout: string; stderr: string; code: number | null }> {
@@ -239,6 +244,36 @@ function asString(v: unknown): string {
   return typeof v === "string" ? v : "";
 }
 
+// `opencode export` (and other opencode subcommands that emit JSON) write
+// status lines to stdout BEFORE the JSON payload:
+//   • plugin banners via console.log: "[omo-stable] Downloading comment-checker binary..."
+//   • plugin registration via console.log: "[omo-stable] ast-grep binary ready."
+//   • CLI status: "Exporting session: ses_..."
+//   • any other stdout-side logging from plugins
+// These break JSON.parse(). Find the first line that starts a JSON object
+// or array and slice from there. Returns null if no JSON-looking content.
+//
+// We try JSON.parse at each candidate (line starting with '{' or '[') and
+// return the first one that parses — necessary because plugin banners like
+// "[omo-stable] ..." also start with '[' but aren't JSON.
+export function stripNonJsonPreamble(s: string): string | null {
+  const lines = s.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const trimmed = line.trimStart();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) continue;
+    const candidate = lines.slice(i).join("\n");
+    try {
+      JSON.parse(candidate);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
 function parseSessionExport(v: unknown): SessionExport | null {
   if (!v || typeof v !== "object") return null;
   const o = v as Record<string, unknown>;

package/src/schema.sql

@@ -42,6 +42,9 @@ CREATE TABLE IF NOT EXISTS issues (
   author     TEXT NOT NULL REFERENCES users(login),
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL,
+  -- NULL when open; stamped on close, cleared on reopen. Backfill-safe because
+  -- migrateIssuesTable ADDs the column idempotently for legacy DBs.
+  closed_at  TEXT,
   UNIQUE (project_id, number)
 );
 CREATE INDEX IF NOT EXISTS issues_project_state_updated

package/src/store.ts

@@ -49,6 +49,7 @@ export interface IssueRow {
   author: string;
   created_at: string;
   updated_at: string;
+  closed_at: string | null;
 }
 
 export interface IssueWithMeta extends IssueRow {
@@ -308,18 +309,36 @@ export function listAllIssues(opts: ListIssuesOpts = {}): IssueWithMeta[] {
   return rawDB().query(sql).all(...args) as IssueWithMeta[];
 }
 
+export interface CreateIssueOpts {
+  createdAt?: string;
+  updatedAt?: string;
+  state?: "open" | "closed";
+  closedAt?: string | null;
+}
+
+function isoOr(value: string | undefined, fallback: string): string {
+  if (value === undefined || value === "") return fallback;
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) throw new StoreError(400, "非法 ISO8601 时间戳");
+  return new Date(parsed).toISOString();
+}
+
 export function createIssue(
   projectId: number,
   title: string,
   body: string,
-  author: string
+  author: string,
+  opts: CreateIssueOpts = {}
 ): IssueRow {
   title = title.trim();
   if (!title) throw new StoreError(400, "标题不能为空");
   if (title.length > 255) throw new StoreError(400, "标题过长（≤255）");
   if (body.length > 65536) throw new StoreError(413, "正文过长（≤65536）");
   ensureUser(author);
-  const ts = now();
+  const createdAt = isoOr(opts.createdAt, now());
+  const updatedAt = opts.updatedAt ? isoOr(opts.updatedAt, createdAt) : createdAt;
+  const state: "open" | "closed" = opts.state ?? "open";
+  const closedAt = state === "closed" ? isoOr(opts.closedAt ?? undefined, updatedAt) : null;
   const db = rawDB();
   return tx(db, () => {
     const next = (
@@ -329,19 +348,29 @@ export function createIssue(
     ).n;
     const info = db
       .query(
-        "INSERT INTO issues (project_id, number, title, body, state, author, created_at, updated_at) VALUES (?, ?, ?, ?, 'open', ?, ?, ?)"
+        "INSERT INTO issues (project_id, number, title, body, state, author, created_at, updated_at, closed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
       )
-      .run(projectId, next, title, body, author, ts, ts);
-    db.query("UPDATE projects SET updated_at = ? WHERE id = ?").run(ts, projectId);
+      .run(projectId, next, title, body, state, author, createdAt, updatedAt, closedAt);
+    db.query("UPDATE projects SET updated_at = ? WHERE id = ?").run(updatedAt, projectId);
     return getIssueById(Number(info.lastInsertRowid))!;
   });
 }
 
-export function setIssueState(issueId: number, state: "open" | "closed"): void {
-  const ts = now();
+export function setIssueState(
+  issueId: number,
+  state: "open" | "closed",
+  opts: { closedAt?: string; updatedAt?: string } = {}
+): void {
+  const ts = opts.updatedAt ? isoOr(opts.updatedAt, now()) : now();
+  const closedAt = state === "closed" ? isoOr(opts.closedAt ?? undefined, ts) : null;
   const db = rawDB();
   tx(db, () => {
-    db.query("UPDATE issues SET state = ?, updated_at = ? WHERE id = ?").run(state, ts, issueId);
+    db.query("UPDATE issues SET state = ?, updated_at = ?, closed_at = ? WHERE id = ?").run(
+      state,
+      ts,
+      closedAt,
+      issueId
+    );
     const row = db.query("SELECT project_id FROM issues WHERE id = ?").get(issueId) as { project_id: number };
     db.query("UPDATE projects SET updated_at = ? WHERE id = ?").run(ts, row.project_id);
   });
@@ -351,11 +380,13 @@ export interface IssuePatch {
   title?: string;
   body?: string;
   state?: "open" | "closed";
+  closedAt?: string | null;
+  updatedAt?: string;
 }
 
 export function editIssue(issueId: number, patch: IssuePatch): void {
   const sets: string[] = [];
-  const args: (string | number)[] = [];
+  const args: (string | number | null)[] = [];
   if (patch.title !== undefined) {
     const t = patch.title.trim();
     if (!t) throw new StoreError(400, "标题不能为空");
@@ -374,10 +405,20 @@ export function editIssue(issueId: number, patch: IssuePatch): void {
     }
     sets.push("state = ?");
     args.push(patch.state);
+    const ts = patch.updatedAt ? isoOr(patch.updatedAt, now()) : now();
+    sets.push("updated_at = ?");
+    args.push(ts);
+    sets.push("closed_at = ?");
+    args.push(patch.state === "closed" ? isoOr(patch.closedAt ?? undefined, ts) : null);
+  } else if (patch.updatedAt !== undefined) {
+    sets.push("updated_at = ?");
+    args.push(isoOr(patch.updatedAt, now()));
   }
   if (sets.length === 0) return;
-  sets.push("updated_at = ?");
-  args.push(now());
+  if (!patch.state && !patch.updatedAt) {
+    sets.push("updated_at = ?");
+    args.push(now());
+  }
   args.push(issueId);
   const db = rawDB();
   tx(db, () => {
@@ -434,19 +475,30 @@ export function listCommentsForIssue(issueId: number): CommentRow[] {
     .all(issueId) as CommentRow[];
 }
 
-export function postComment(issueId: number, body: string, author: string): CommentRow {
+export interface CreateCommentOpts {
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+export function postComment(
+  issueId: number,
+  body: string,
+  author: string,
+  opts: CreateCommentOpts = {}
+): CommentRow {
   if (!body || !body.trim()) throw new StoreError(400, "评论不能为空");
   if (body.length > 65536) throw new StoreError(413, "评论过长（≤65536）");
   ensureUser(author);
-  const ts = now();
+  const createdAt = isoOr(opts.createdAt, now());
+  const updatedAt = opts.updatedAt ? isoOr(opts.updatedAt, createdAt) : createdAt;
   const db = rawDB();
   return tx(db, () => {
     const info = db
       .query("INSERT INTO comments (issue_id, author, body, created_at, updated_at) VALUES (?, ?, ?, ?, ?)")
-      .run(issueId, author, body, ts, ts);
-    db.query("UPDATE issues SET updated_at = ? WHERE id = ?").run(ts, issueId);
+      .run(issueId, author, body, createdAt, updatedAt);
+    db.query("UPDATE issues SET updated_at = ? WHERE id = ?").run(updatedAt, issueId);
     const row = db.query("SELECT project_id FROM issues WHERE id = ?").get(issueId) as { project_id: number };
-    db.query("UPDATE projects SET updated_at = ? WHERE id = ?").run(ts, row.project_id);
+    db.query("UPDATE projects SET updated_at = ? WHERE id = ?").run(updatedAt, row.project_id);
     return db.query(
       `SELECT c.*, u.kind AS author_kind
        FROM comments c LEFT JOIN users u ON u.login = c.author

package/src/webhooks.ts

@@ -62,6 +62,44 @@ const MAX_RESPONSE_LOG_BYTES = 8192;
 const HTTP_TIMEOUT_MS = 10_000;
 const RETRY_DELAYS_MS = [0, 2_000, 8_000];
 
+// Global cap on concurrent in-flight webhook HTTP deliveries. Without this, a
+// flood of events against dead targets (e.g. daemon down during migration)
+// kicks off unbounded concurrent fetches — each waits HTTP_TIMEOUT_MS, so the
+// Bun event loop saturates and ework-web stops serving user traffic. The cap
+// queues surplus deliveries; releaseSlot() drains the queue FIFO.
+const MAX_CONCURRENT_DELIVERIES = clampPositiveInt(
+  Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),
+  1,
+  64,
+  6
+);
+let inFlightDeliveries = 0;
+const deliveryQueue: Array<() => void> = [];
+
+function clampPositiveInt(v: number, lo: number, hi: number, fallback: number): number {
+  if (!Number.isFinite(v) || v < lo || v > hi) return fallback;
+  return Math.floor(v);
+}
+
+function acquireDeliverySlot(): Promise<void> {
+  if (inFlightDeliveries < MAX_CONCURRENT_DELIVERIES) {
+    inFlightDeliveries++;
+    return Promise.resolve();
+  }
+  return new Promise<void>((resolve) => {
+    deliveryQueue.push(() => {
+      inFlightDeliveries++;
+      resolve();
+    });
+  });
+}
+
+function releaseDeliverySlot(): void {
+  inFlightDeliveries--;
+  const next = deliveryQueue.shift();
+  if (next) next();
+}
+
 function now(): string {
   return new Date().toISOString();
 }
@@ -323,7 +361,7 @@ function buildIssue(
     comments: commentCount,
     created_at: issue.created_at,
     updated_at: issue.updated_at,
-    closed_at: issue.state === "closed" ? issue.updated_at : null,
+    closed_at: issue.closed_at,
     due_date: null,
     pull_request: null,
     repository: buildRepository(project, origin),
@@ -488,23 +526,28 @@ async function deliver(
   event: WebhookEventName,
   rawBody: string
 ): Promise<void> {
-  for (const attempt of RETRY_DELAYS_MS) {
-    if (attempt > 0) await Bun.sleep(attempt);
-    const deliveryUuid = randomUUID();
-    const headers = buildHeaders(event, deliveryUuid, rawBody, webhook.secret);
-    const result = await postWithTimeout(webhook.url, rawBody, headers);
-    const success = result.status !== null && result.status >= 200 && result.status < 300;
-    recordDelivery(webhook.id, event, deliveryUuid, rawBody, result);
-    if (success) return;
-    // 410 Gone: receiver explicitly says "stop sending" — honor it, no retry.
-    if (result.status === 410) return;
+  await acquireDeliverySlot();
+  try {
+    for (const attempt of RETRY_DELAYS_MS) {
+      if (attempt > 0) await Bun.sleep(attempt);
+      const deliveryUuid = randomUUID();
+      const headers = buildHeaders(event, deliveryUuid, rawBody, webhook.secret);
+      const result = await postWithTimeout(webhook.url, rawBody, headers);
+      const success = result.status !== null && result.status >= 200 && result.status < 300;
+      recordDelivery(webhook.id, event, deliveryUuid, rawBody, result);
+      if (success) return;
+      // 410 Gone: receiver explicitly says "stop sending" — honor it, no retry.
+      if (result.status === 410) return;
+    }
+    log.warn("webhook: gave up after retries", {
+      attempts: RETRY_DELAYS_MS.length,
+      webhookId: webhook.id,
+      url: webhook.url,
+      event,
+    });
+  } finally {
+    releaseDeliverySlot();
   }
-  log.warn("webhook: gave up after retries", {
-    attempts: RETRY_DELAYS_MS.length,
-    webhookId: webhook.id,
-    url: webhook.url,
-    event,
-  });
 }
 
 function fanOut(