libre-webui 0.21.3 → 0.22.1

package/backend/dist/services/workTaskService.js

@@ -15,11 +15,13 @@
  * limitations under the License.
  */
 import { v4 as uuidv4 } from 'uuid';
-import { getDatabase } from '../db.js';
+import { getWorkPersistence, replaceWorkTextNul, WorkPersistenceError, } from '../platform/workPersistence/index.js';
+import { transactionalWorkExecutionEnqueuer } from '../platform/jobs/workExecutionEnqueuer.js';
+import { WORK_EXECUTE_IDEMPOTENCY_SCOPE, WORK_EXECUTE_JOB_TYPE, } from '../platform/jobs/domainJobContracts.js';
+import { getDurableJobRuntime } from '../platform/jobs/durableJobRuntime.js';
 import { createLogger } from '../utils/logger.js';
+import { getCoordinator } from '../platform/coordination/service.js';
 const logger = createLogger('services:work-task');
-const ACTIVE_RUN_STATUSES = ['queued', 'preparing', 'running'];
-const ACTIVE_PREVIEW_STATUSES = ['starting', 'running'];
 export const WORK_MESSAGE_PAGE_SIZE = 200;
 export const WORK_MESSAGE_MAX_BYTES = 100000;
 export const WORK_MESSAGE_METADATA_MAX_BYTES = 100000;
@@ -45,100 +47,284 @@ export class WorkTaskService {
         this.retiringTasks = new Set();
         this.networkPolicyChanges = new Set();
     }
-    createTaskWithRun(userId, message, model, networkEnabled, provider = { providerType: 'ollama' }, hostPath, policyId) {
-        this.assertUserIsActive(userId);
+    async resolveExecutionPublication(expectedTask, expectedRun, expectedMessage, taskMayPreexist = false) {
+        try {
+            const persistence = getWorkPersistence();
+            const [task, run, messages, job] = await Promise.all([
+                persistence.findTask(expectedTask.id, expectedTask.user_id),
+                persistence.findRun(expectedRun.id),
+                persistence.listMessages({ taskId: expectedTask.id, mode: 'all' }),
+                getDurableJobRuntime().service.getByIdempotency(expectedTask.user_id, WORK_EXECUTE_IDEMPOTENCY_SCOPE, expectedRun.id),
+            ]);
+            const message = messages.find(row => row.id === expectedMessage.id);
+            if (!run && !message && !job && (taskMayPreexist || !task)) {
+                return 'absent';
+            }
+            const exactTask = task?.id === expectedTask.id &&
+                task.user_id === expectedTask.user_id &&
+                task.title === expectedTask.title &&
+                task.model === expectedTask.model &&
+                task.provider_type === expectedTask.provider_type &&
+                task.provider_id === expectedTask.provider_id &&
+                task.network_enabled === expectedTask.network_enabled &&
+                task.volume_name === expectedTask.volume_name &&
+                task.container_name === expectedTask.container_name &&
+                task.host_path === expectedTask.host_path &&
+                task.policy_id === expectedTask.policy_id &&
+                task.created_at === expectedTask.created_at;
+            const exactRun = run?.id === expectedRun.id &&
+                run.task_id === expectedRun.task_id &&
+                run.model === expectedRun.model &&
+                run.provider_type === expectedRun.provider_type &&
+                run.provider_id === expectedRun.provider_id &&
+                run.created_at === expectedRun.created_at;
+            const exactMessage = message?.id === expectedMessage.id &&
+                message.task_id === expectedMessage.task_id &&
+                message.run_id === expectedMessage.run_id &&
+                message.role === expectedMessage.role &&
+                message.kind === expectedMessage.kind &&
+                message.content === expectedMessage.content &&
+                message.metadata === expectedMessage.metadata &&
+                message.created_at === expectedMessage.created_at;
+            const exactJob = job?.jobType === WORK_EXECUTE_JOB_TYPE &&
+                job.actorUserId === expectedTask.user_id;
+            return exactTask && exactRun && exactMessage && exactJob
+                ? 'committed'
+                : 'ambiguous';
+        }
+        catch {
+            return 'ambiguous';
+        }
+    }
+    async withUserLifecycleLease(userId, operation) {
+        const coordinator = getCoordinator();
+        const deadline = Date.now() + 10000;
+        let lease = await coordinator.acquireLease(`work-user-lifecycle:${userId}`, 60000);
+        while (!lease && Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, 25));
+            lease = await coordinator.acquireLease(`work-user-lifecycle:${userId}`, 60000);
+        }
+        if (!lease) {
+            throw new WorkConflictError('This user already has a Work lifecycle operation in progress.');
+        }
+        let closed = false;
+        let leaseLost = false;
+        let renewalTimer;
+        const leaseLostError = () => new WorkConflictError('The shared Work lifecycle lease was lost.');
+        const markLost = () => {
+            leaseLost = true;
+        };
+        const assertHeld = async () => {
+            if (closed || leaseLost)
+                throw leaseLostError();
+            try {
+                if (await lease.extend(60000))
+                    return;
+            }
+            catch {
+                // Report expiry and coordination outages through one safe fence.
+            }
+            markLost();
+            throw leaseLostError();
+        };
+        const renew = async () => {
+            if (closed)
+                return;
+            try {
+                if (!(await lease.extend(60000)))
+                    markLost();
+            }
+            catch {
+                markLost();
+            }
+            if (!closed && !leaseLost)
+                renewalTimer = setTimeout(renew, 20000);
+        };
+        renewalTimer = setTimeout(renew, 20000);
+        try {
+            await assertHeld();
+            const result = await operation(assertHeld);
+            return result;
+        }
+        finally {
+            closed = true;
+            if (renewalTimer)
+                clearTimeout(renewalTimer);
+            await lease.release().catch(() => false);
+        }
+    }
+    async createTaskWithRun(userId, message, model, networkEnabled, provider = { providerType: 'ollama' }, hostPath, policyId) {
+        return this.withUserLifecycleLease(userId, assertHeld => this.createTaskWithRunWithLeaseHeld(userId, message, model, networkEnabled, provider, hostPath, policyId, assertHeld));
+    }
+    async createTaskWithRunWithLeaseHeld(userId, message, model, networkEnabled, provider, hostPath, policyId, assertHeld = async () => undefined) {
+        await this.assertUserIsActive(userId);
         const selectedProvider = normalizeProvider(provider);
-        const db = getDatabase();
         const taskId = uuidv4();
         const runId = uuidv4();
         const messageId = uuidv4();
         const compactId = taskId.replace(/-/g, '');
         const now = Date.now();
         const title = deriveTitle(message);
-        const transaction = db.transaction(() => {
-            this.assertTaskAdmission(userId);
-            this.assertRuntimeAdmission(userId);
-            db.prepare(`INSERT INTO work_tasks (
-          id, user_id, title, model, provider_type, provider_id, status,
-          network_enabled, volume_name, container_name, host_path, policy_id,
-          preview_status, created_at, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, 'preparing', ?, ?, ?, ?, ?, 'stopped', ?, ?)`).run(taskId, userId, title, model, selectedProvider.providerType, selectedProvider.providerId || null, networkEnabled ? 1 : 0, `libre-work-${compactId}`, `libre-work-${compactId}`, hostPath || null, policyId || null, now, now);
-            db.prepare(`INSERT INTO work_runs (
-          id, task_id, model, provider_type, provider_id, status, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'queued', ?)`).run(runId, taskId, model, selectedProvider.providerType, selectedProvider.providerId || null, now);
-            db.prepare(`INSERT INTO work_messages (
-          id, task_id, run_id, role, kind, content, message_index, created_at
-        ) VALUES (?, ?, ?, 'user', 'message', ?, 0, ?)`).run(messageId, taskId, runId, message, now);
-        });
-        transaction();
+        const selectedModel = cleanRequired(model);
+        const taskRow = {
+            id: taskId,
+            user_id: userId,
+            title,
+            model: selectedModel,
+            provider_type: selectedProvider.providerType,
+            provider_id: selectedProvider.providerId || null,
+            status: 'preparing',
+            network_enabled: networkEnabled ? 1 : 0,
+            volume_name: `libre-work-${compactId}`,
+            container_name: `libre-work-${compactId}`,
+            host_path: hostPath || null,
+            policy_id: policyId || null,
+            preview_url: null,
+            preview_status: 'stopped',
+            preview_upstream_host: null,
+            preview_upstream_port: null,
+            created_at: now,
+            updated_at: now,
+        };
+        const runRow = {
+            id: runId,
+            task_id: taskId,
+            model: selectedModel,
+            provider_type: selectedProvider.providerType,
+            provider_id: selectedProvider.providerId || null,
+            status: 'queued',
+            error: null,
+            created_at: now,
+            started_at: null,
+            finished_at: null,
+        };
+        const messageRow = {
+            id: messageId,
+            task_id: taskId,
+            run_id: runId,
+            role: 'user',
+            kind: 'message',
+            content: message,
+            metadata: null,
+            message_index: 0,
+            created_at: now,
+        };
+        try {
+            await assertHeld();
+            await getWorkPersistence().createTaskWithRun({
+                task: taskRow,
+                run: runRow,
+                message: messageRow,
+                limits: workAdmissionLimits,
+            }, transactionalWorkExecutionEnqueuer, assertHeld);
+        }
+        catch (error) {
+            const outcome = await this.resolveExecutionPublication(taskRow, runRow, messageRow);
+            if (outcome === 'committed') {
+                return this.requireTaskDetail(taskId, userId);
+            }
+            if (outcome === 'ambiguous') {
+                throw new WorkConflictError('The Work task publication outcome is ambiguous. Reload before retrying.');
+            }
+            throw translatePersistenceError(error);
+        }
         return this.requireTaskDetail(taskId, userId);
     }
-    createRun(taskId, userId, message, model, provider) {
-        const task = this.requireMutableTaskRecord(taskId, userId);
-        if (this.getActiveRun(taskId)) {
+    async createRun(taskId, userId, message, model, provider) {
+        return this.withUserLifecycleLease(userId, assertHeld => this.createRunWithLeaseHeld(taskId, userId, message, model, provider, assertHeld));
+    }
+    async createRunWithLeaseHeld(taskId, userId, message, model, provider, assertHeld = async () => undefined) {
+        const task = await this.requireMutableTaskRecord(taskId, userId);
+        if (await this.getActiveRun(taskId)) {
             throw new WorkConflictError('This Work task already has an active run.');
         }
-        const db = getDatabase();
         const runId = uuidv4();
         const messageId = uuidv4();
-        const selectedModel = model?.trim() || task.model;
+        const selectedModel = model === undefined ? task.model : cleanRequired(model);
         const selectedProvider = normalizeProvider(provider || {
             providerType: task.providerType,
             providerId: task.providerId,
         });
         const now = Date.now();
-        const transaction = db.transaction(() => {
-            if (this.getActiveRun(taskId)) {
-                throw new WorkConflictError('This Work task already has an active run.');
+        const runRow = {
+            id: runId,
+            task_id: taskId,
+            model: selectedModel,
+            provider_type: selectedProvider.providerType,
+            provider_id: selectedProvider.providerId || null,
+            status: 'queued',
+            error: null,
+            created_at: now,
+            started_at: null,
+            finished_at: null,
+        };
+        const messageRow = {
+            id: messageId,
+            task_id: taskId,
+            run_id: runId,
+            role: 'user',
+            kind: 'message',
+            content: message,
+            metadata: null,
+            message_index: 0,
+            created_at: now,
+        };
+        try {
+            await assertHeld();
+            await getWorkPersistence().createRun({
+                taskId,
+                userId,
+                run: runRow,
+                message: messageRow,
+                limits: workAdmissionLimits,
+            }, transactionalWorkExecutionEnqueuer, assertHeld);
+        }
+        catch (error) {
+            const expectedTask = {
+                id: task.id,
+                user_id: task.userId,
+                title: task.title,
+                model: selectedModel,
+                provider_type: selectedProvider.providerType,
+                provider_id: selectedProvider.providerId || null,
+                status: 'preparing',
+                network_enabled: task.networkEnabled ? 1 : 0,
+                volume_name: task.volumeName,
+                container_name: task.containerName,
+                host_path: task.hostPath || null,
+                policy_id: task.policyId || null,
+                preview_url: task.previewUrl || null,
+                preview_status: task.previewStatus,
+                preview_upstream_host: task.previewUpstreamHost || null,
+                preview_upstream_port: task.previewUpstreamPort || null,
+                created_at: task.createdAt,
+                updated_at: task.updatedAt,
+            };
+            const outcome = await this.resolveExecutionPublication(expectedTask, runRow, messageRow, true);
+            if (outcome === 'committed') {
+                return this.requireTaskDetail(taskId, userId);
             }
-            if (ACTIVE_PREVIEW_STATUSES.includes(task.previewStatus)) {
-                throw new WorkConflictError('Stop this Work task preview before starting another run.');
+            if (outcome === 'ambiguous') {
+                throw new WorkConflictError('The Work run publication outcome is ambiguous. Reload before retrying.');
             }
-            this.assertRuntimeAdmission(userId, taskId);
-            const nextIndex = this.nextMessageIndex(taskId);
-            db.prepare(`INSERT INTO work_runs (
-          id, task_id, model, provider_type, provider_id, status, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'queued', ?)`).run(runId, taskId, selectedModel, selectedProvider.providerType, selectedProvider.providerId || null, now);
-            db.prepare(`INSERT INTO work_messages (
-          id, task_id, run_id, role, kind, content, message_index, created_at
-        ) VALUES (?, ?, ?, 'user', 'message', ?, ?, ?)`).run(messageId, taskId, runId, message, nextIndex, now);
-            db.prepare(`UPDATE work_tasks
-         SET model = ?, provider_type = ?, provider_id = ?,
-             status = 'preparing', updated_at = ?
-         WHERE id = ?`).run(selectedModel, selectedProvider.providerType, selectedProvider.providerId || null, now, taskId);
-        });
-        transaction();
+            throw translatePersistenceError(error);
+        }
         return this.requireTaskDetail(taskId, userId);
     }
-    listTasks(userId) {
-        const rows = getDatabase()
-            .prepare(`SELECT * FROM work_tasks
-         WHERE user_id = ?
-         ORDER BY updated_at DESC`)
-            .all(userId);
-        return rows.map(row => this.summaryFromRow(row));
-    }
-    listTaskRecords(userId) {
-        const rows = getDatabase()
-            .prepare(`SELECT * FROM work_tasks
-         WHERE user_id = ?
-         ORDER BY created_at ASC`)
-            .all(userId);
+    async listTasks(userId) {
+        const rows = await getWorkPersistence().listTasks(userId);
+        return Promise.all(rows.map(row => this.summaryFromRow(row)));
+    }
+    async listTaskRecords(userId) {
+        const rows = await getWorkPersistence().listTaskRecords(userId);
         return rows.map(mapTaskRecord);
     }
-    listAllTaskRecords() {
-        return getDatabase()
-            .prepare('SELECT * FROM work_tasks ORDER BY created_at ASC')
-            .all().map(mapTaskRecord);
+    async listAllTaskRecords() {
+        return (await getWorkPersistence().listTaskRecords()).map(mapTaskRecord);
     }
     /** Every task with its owner's username, for the admin overview. */
-    listAllTasksWithOwner() {
-        const rows = getDatabase()
-            .prepare(`SELECT work_tasks.*, users.username AS owner_username
-         FROM work_tasks
-         JOIN users ON users.id = work_tasks.user_id
-         ORDER BY work_tasks.updated_at DESC`)
-            .all();
+    async listAllTasksWithOwner() {
+        const rows = await getWorkPersistence().listTasksWithOwners();
         return rows.map(row => ({
             record: mapTaskRecord(row),
             ownerUsername: row.owner_username,
@@ -153,11 +339,11 @@ export class WorkTaskService {
     releaseUserRetirement(userId) {
         this.retiringUsers.delete(userId);
     }
-    beginTaskRetirement(taskId, userId, allowRetiringUser = false) {
+    async beginTaskRetirement(taskId, userId, allowRetiringUser = false) {
         if (!allowRetiringUser) {
-            this.assertUserIsActive(userId);
+            await this.assertUserIsActive(userId);
         }
-        const task = this.requireTaskRecord(taskId, userId);
+        const task = await this.requireTaskRecord(taskId, userId);
         this.assertNetworkPolicyStable(taskId);
         if (this.retiringTasks.has(taskId)) {
             throw new WorkConflictError('This Work task is already being deleted.');
@@ -171,24 +357,21 @@ export class WorkTaskService {
     finalizeTaskRetirement(taskId) {
         this.retiringTasks.delete(taskId);
     }
-    requireMutableTaskRecord(taskId, userId) {
-        this.assertUserIsActive(userId);
-        const task = this.requireTaskRecord(taskId, userId);
+    async requireMutableTaskRecord(taskId, userId) {
+        await this.assertUserIsActive(userId);
+        const task = await this.requireTaskRecord(taskId, userId);
         this.assertTaskIsActive(taskId);
         this.assertNetworkPolicyStable(taskId);
         return task;
     }
-    assertTaskMutationAllowed(taskId, userId) {
-        this.requireMutableTaskRecord(taskId, userId);
+    async assertTaskMutationAllowed(taskId, userId) {
+        await this.requireMutableTaskRecord(taskId, userId);
     }
-    assertUserIsActive(userId) {
+    async assertUserIsActive(userId) {
         if (this.retiringUsers.has(userId)) {
             throw new WorkConflictError('This user is being deleted.');
         }
-        const current = getDatabase()
-            .prepare('SELECT role FROM users WHERE id = ?')
-            .get(userId);
-        if (current?.role !== 'admin') {
+        if (!(await getWorkPersistence().userCanUseWork(userId))) {
             throw new WorkForbiddenError();
         }
     }
@@ -202,9 +385,9 @@ export class WorkTaskService {
             throw new WorkConflictError('This Work task network policy is being changed.');
         }
     }
-    beginNetworkPolicyChange(taskId, userId) {
-        const task = this.requireMutableTaskRecord(taskId, userId);
-        if (this.getActiveRun(taskId)) {
+    async beginNetworkPolicyChange(taskId, userId) {
+        const task = await this.requireMutableTaskRecord(taskId, userId);
+        if (await this.getActiveRun(taskId)) {
             throw new WorkConflictError('Network access cannot be changed during an active run.');
         }
         this.networkPolicyChanges.add(taskId);
@@ -213,47 +396,48 @@ export class WorkTaskService {
     releaseNetworkPolicyChange(taskId) {
         this.networkPolicyChanges.delete(taskId);
     }
-    beginPreview(taskId, userId, allowActiveRun = false) {
-        const transaction = getDatabase().transaction(() => {
-            const task = this.requireMutableTaskRecord(taskId, userId);
-            const activeRun = this.getActiveRun(taskId);
-            if (activeRun && !allowActiveRun) {
-                throw new WorkConflictError('Wait for the active Work run to finish before starting a preview.');
-            }
-            this.assertRuntimeAdmission(userId, taskId);
-            if (!ACTIVE_PREVIEW_STATUSES.includes(task.previewStatus)) {
-                this.updatePreview(taskId, 'starting');
-            }
-        });
-        transaction();
+    async beginPreview(taskId, userId, allowActiveRun = false) {
+        await this.requireMutableTaskRecord(taskId, userId);
+        try {
+            await getWorkPersistence().beginPreview({
+                taskId,
+                userId,
+                allowActiveRun,
+                limits: workAdmissionLimits,
+                updatedAt: Date.now(),
+            });
+        }
+        catch (error) {
+            throw translatePersistenceError(error, true);
+        }
     }
-    getTaskDetail(taskId, userId) {
-        const row = this.getTaskRow(taskId, userId);
+    async getTaskDetail(taskId, userId) {
+        const row = await getWorkPersistence().findTask(taskId, userId);
         return row ? this.detailFromRow(row) : undefined;
     }
-    requireTaskDetail(taskId, userId) {
-        const task = this.getTaskDetail(taskId, userId);
+    async requireTaskDetail(taskId, userId) {
+        const task = await this.getTaskDetail(taskId, userId);
         if (!task) {
             throw new WorkNotFoundError();
         }
         return task;
     }
-    getTaskRecord(taskId, userId) {
-        const row = this.getTaskRow(taskId, userId);
+    async getTaskRecord(taskId, userId) {
+        const row = await getWorkPersistence().findTask(taskId, userId);
         return row ? mapTaskRecord(row) : undefined;
     }
-    requireTaskRecord(taskId, userId) {
-        const task = this.getTaskRecord(taskId, userId);
+    async requireTaskRecord(taskId, userId) {
+        const task = await this.getTaskRecord(taskId, userId);
         if (!task) {
             throw new WorkNotFoundError();
         }
         return task;
     }
-    updateTask(taskId, userId, updates) {
-        const task = this.requireMutableTaskRecord(taskId, userId);
+    async updateTask(taskId, userId, updates) {
+        const task = await this.requireMutableTaskRecord(taskId, userId);
         if (updates.networkEnabled !== undefined &&
             updates.networkEnabled !== task.networkEnabled &&
-            this.getActiveRun(taskId)) {
+            (await this.getActiveRun(taskId))) {
             throw new WorkConflictError('Network access cannot be changed during an active run.');
         }
         const title = updates.title === undefined ? task.title : cleanTitle(updates.title);
@@ -267,23 +451,32 @@ export class WorkTaskService {
                     : updates.providerId,
         });
         const networkEnabled = updates.networkEnabled ?? task.networkEnabled;
-        getDatabase()
-            .prepare(`UPDATE work_tasks
-         SET title = ?, model = ?, provider_type = ?, provider_id = ?,
-             network_enabled = ?, updated_at = ?
-         WHERE id = ? AND user_id = ?`)
-            .run(title, model, provider.providerType, provider.providerId || null, networkEnabled ? 1 : 0, Date.now(), taskId, userId);
+        try {
+            await getWorkPersistence().updateTask({
+                taskId,
+                userId,
+                title,
+                model,
+                providerType: provider.providerType,
+                providerId: provider.providerId || null,
+                networkEnabled,
+                updatedAt: Date.now(),
+            });
+        }
+        catch (error) {
+            throw translatePersistenceError(error);
+        }
         return this.requireTaskDetail(taskId, userId);
     }
-    commitNetworkChange(taskId, userId, updates) {
-        this.assertUserIsActive(userId);
-        const task = this.requireTaskRecord(taskId, userId);
+    async commitNetworkChange(taskId, userId, updates) {
+        await this.assertUserIsActive(userId);
+        const task = await this.requireTaskRecord(taskId, userId);
         this.assertTaskIsActive(taskId);
         if (!this.networkPolicyChanges.has(taskId)) {
             throw new WorkConflictError('This Work task has no active network policy change.');
         }
         if (updates.networkEnabled !== task.networkEnabled &&
-            this.getActiveRun(taskId)) {
+            (await this.getActiveRun(taskId))) {
             throw new WorkConflictError('Network access cannot be changed during an active run.');
         }
         const title = updates.title === undefined ? task.title : cleanTitle(updates.title);
@@ -296,86 +489,45 @@ export class WorkTaskService {
                     ? task.providerId
                     : updates.providerId,
         });
-        const networkChanged = updates.networkEnabled !== task.networkEnabled;
-        getDatabase()
-            .prepare(`UPDATE work_tasks
-         SET title = ?, model = ?, provider_type = ?, provider_id = ?,
-             network_enabled = ?,
-             preview_status = CASE
-               WHEN ? = 1 THEN 'stopped'
-               ELSE preview_status
-             END,
-             preview_url = CASE
-               WHEN ? = 1 THEN NULL
-               ELSE preview_url
-             END,
-             updated_at = ?
-         WHERE id = ? AND user_id = ?`)
-            .run(title, model, provider.providerType, provider.providerId || null, updates.networkEnabled ? 1 : 0, networkChanged ? 1 : 0, networkChanged ? 1 : 0, Date.now(), taskId, userId);
-    }
-    assertTaskAdmission(userId) {
-        const counts = getDatabase()
-            .prepare(`SELECT
-           COUNT(*) AS total,
-           COALESCE(SUM(CASE WHEN user_id = ? THEN 1 ELSE 0 END), 0) AS per_user
-         FROM work_tasks`)
-            .get(userId);
-        if (counts.per_user >= workAdmissionLimits.maxTasksPerUser) {
-            throw new WorkAdmissionError(`This administrator already has the maximum of ${workAdmissionLimits.maxTasksPerUser} Work tasks.`, 'WORK_USER_TASK_LIMIT');
-        }
-        if (counts.total >= workAdmissionLimits.maxTasksGlobal) {
-            throw new WorkAdmissionError(`This Libre WebUI instance already has the maximum of ${workAdmissionLimits.maxTasksGlobal} Work tasks.`, 'WORK_GLOBAL_TASK_LIMIT');
-        }
-    }
-    assertRuntimeAdmission(userId, taskId) {
-        const activeRunPlaceholders = ACTIVE_RUN_STATUSES.map(() => '?').join(', ');
-        const activePreviewPlaceholders = ACTIVE_PREVIEW_STATUSES.map(() => '?').join(', ');
-        const counts = getDatabase()
-            .prepare(`WITH active_tasks AS (
-           SELECT DISTINCT work_tasks.id AS task_id, work_tasks.user_id
-           FROM work_tasks
-           JOIN work_runs ON work_runs.task_id = work_tasks.id
-           WHERE work_runs.status IN (${activeRunPlaceholders})
-           UNION
-           SELECT id AS task_id, user_id
-           FROM work_tasks
-           WHERE preview_status IN (${activePreviewPlaceholders})
-         )
-         SELECT
-           COUNT(*) AS total,
-           COALESCE(SUM(CASE WHEN user_id = ? THEN 1 ELSE 0 END), 0) AS per_user
-         FROM active_tasks
-         WHERE ? IS NULL OR task_id != ?`)
-            .get(...ACTIVE_RUN_STATUSES, ...ACTIVE_PREVIEW_STATUSES, userId, taskId || null, taskId || null);
-        if (counts.per_user >= workAdmissionLimits.maxActiveRuntimesPerUser) {
-            throw new WorkAdmissionError(`This administrator already has ${workAdmissionLimits.maxActiveRuntimesPerUser} active Work runtime(s). Wait for a run or preview to stop.`, 'WORK_USER_RUNTIME_LIMIT');
-        }
-        if (counts.total >= workAdmissionLimits.maxActiveRuntimesGlobal) {
-            throw new WorkAdmissionError(`This Libre WebUI instance already has ${workAdmissionLimits.maxActiveRuntimesGlobal} active Work runtime(s). Wait for a run or preview to stop.`, 'WORK_GLOBAL_RUNTIME_LIMIT');
-        }
-    }
-    deleteTask(taskId, userId) {
-        const task = this.requireTaskRecord(taskId, userId);
-        const result = getDatabase()
-            .prepare('DELETE FROM work_tasks WHERE id = ? AND user_id = ?')
-            .run(taskId, userId);
-        if (!result.changes) {
+        try {
+            await getWorkPersistence().updateTask({
+                taskId,
+                userId,
+                title,
+                model,
+                providerType: provider.providerType,
+                providerId: provider.providerId || null,
+                networkEnabled: updates.networkEnabled,
+                updatedAt: Date.now(),
+                requireNetworkChangeLease: true,
+            });
+        }
+        catch (error) {
+            throw translatePersistenceError(error);
+        }
+    }
+    async deleteTask(taskId, userId) {
+        const task = await this.requireTaskRecord(taskId, userId);
+        if (!(await getWorkPersistence().deleteTask(taskId, userId))) {
             throw new WorkNotFoundError();
         }
         return task;
     }
-    addMessage(taskId, runId, role, kind, content, metadata) {
-        const db = getDatabase();
+    async addMessage(taskId, runId, role, kind, content, metadata) {
         const id = uuidv4();
         const createdAt = Date.now();
-        const messageIndex = this.nextMessageIndex(taskId);
         const boundedContent = boundUtf8(content, WORK_MESSAGE_MAX_BYTES);
         const serializedMetadata = serializeMetadata(metadata);
-        db.prepare(`INSERT INTO work_messages (
-        id, task_id, run_id, role, kind, content, metadata,
-        message_index, created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, taskId, runId || null, role, kind, boundedContent, serializedMetadata || null, messageIndex, createdAt);
-        this.touchTask(taskId);
+        const messageIndex = await getWorkPersistence().insertMessage({
+            id,
+            task_id: taskId,
+            run_id: runId || null,
+            role,
+            kind,
+            content: boundedContent,
+            metadata: serializedMetadata || null,
+            created_at: createdAt,
+        });
         return {
             id,
             taskId,
@@ -388,28 +540,20 @@ export class WorkTaskService {
             createdAt,
         };
     }
-    getMessages(taskId) {
-        const rows = getDatabase()
-            .prepare(`SELECT id, task_id, run_id, message_index, role, kind, content,
-                metadata, created_at
-         FROM work_messages
-         WHERE task_id = ? AND kind <> 'provider_state'
-         ORDER BY message_index ASC`)
-            .all(taskId);
+    async getMessages(taskId) {
+        const rows = await getWorkPersistence().listMessages({
+            taskId,
+            mode: 'all',
+        });
         return rows.map(mapMessage);
     }
-    getRecentConversationMessages(taskId, limit = 30) {
+    async getRecentConversationMessages(taskId, limit = 30) {
         const boundedLimit = Math.min(30, Math.max(1, Math.trunc(limit)));
-        const rows = getDatabase()
-            .prepare(`SELECT id, task_id, run_id, message_index, role, kind, content,
-                metadata, created_at
-         FROM work_messages
-         WHERE task_id = ?
-           AND kind = 'message'
-           AND role IN ('user', 'assistant')
-         ORDER BY message_index DESC
-         LIMIT ?`)
-            .all(taskId, boundedLimit);
+        const rows = await getWorkPersistence().listMessages({
+            taskId,
+            mode: 'conversation',
+            limit: boundedLimit,
+        });
         const selected = [];
         let selectedBytes = 0;
         for (const row of rows) {
@@ -425,22 +569,14 @@ export class WorkTaskService {
         }
         return selected.reverse().map(mapMessage);
     }
-    getRecentModelContextMessages(taskId, limit = 30) {
+    async getRecentModelContextMessages(taskId, limit = 30) {
         const boundedLimit = Math.min(30, Math.max(1, Math.trunc(limit)));
         const rowLimit = boundedLimit * 6;
-        const rows = getDatabase()
-            .prepare(`SELECT id, task_id, run_id, message_index, role, kind, content,
-                metadata, created_at
-         FROM work_messages
-         WHERE task_id = ?
-           AND (
-             (kind = 'message' AND role IN ('user', 'assistant'))
-             OR (kind = 'provider_state' AND role = 'assistant')
-             OR (kind = 'tool_result' AND role = 'tool')
-           )
-         ORDER BY message_index DESC
-         LIMIT ?`)
-            .all(taskId, rowLimit);
+        const rows = await getWorkPersistence().listMessages({
+            taskId,
+            mode: 'model-context',
+            limit: rowLimit,
+        });
         const selected = [];
         let selectedBytes = 0;
         for (const row of rows) {
@@ -461,26 +597,14 @@ export class WorkTaskService {
         }
         return chronological.map(mapMessage);
     }
-    getMessagePage(taskId, before, limit = WORK_MESSAGE_PAGE_SIZE) {
+    async getMessagePage(taskId, before, limit = WORK_MESSAGE_PAGE_SIZE) {
         const pageSize = Math.min(WORK_MESSAGE_PAGE_SIZE, Math.max(1, Math.trunc(limit)));
-        const rows = (before === undefined
-            ? getDatabase()
-                .prepare(`SELECT id, task_id, run_id, message_index, role, kind, content,
-                      metadata, created_at
-               FROM work_messages
-               WHERE task_id = ? AND kind <> 'provider_state'
-               ORDER BY message_index DESC
-               LIMIT ?`)
-                .all(taskId, pageSize + 1)
-            : getDatabase()
-                .prepare(`SELECT id, task_id, run_id, message_index, role, kind, content,
-                      metadata, created_at
-               FROM work_messages
-               WHERE task_id = ? AND message_index < ?
-                 AND kind <> 'provider_state'
-               ORDER BY message_index DESC
-               LIMIT ?`)
-                .all(taskId, before, pageSize + 1));
+        const rows = await getWorkPersistence().listMessages({
+            taskId,
+            mode: 'page',
+            before,
+            limit: pageSize + 1,
+        });
         const selectedRows = [];
         let selectedBytes = 0;
         let examinedRows = 0;
@@ -508,57 +632,40 @@ export class WorkTaskService {
             hasMore,
         };
     }
-    getRun(runId) {
-        const row = getDatabase()
-            .prepare('SELECT * FROM work_runs WHERE id = ?')
-            .get(runId);
+    async getRun(runId) {
+        const row = await getWorkPersistence().findRun(runId);
         return row ? mapRun(row) : undefined;
     }
-    getActiveRun(taskId) {
-        const placeholders = ACTIVE_RUN_STATUSES.map(() => '?').join(', ');
-        const row = getDatabase()
-            .prepare(`SELECT * FROM work_runs
-         WHERE task_id = ? AND status IN (${placeholders})
-         ORDER BY created_at DESC LIMIT 1`)
-            .get(taskId, ...ACTIVE_RUN_STATUSES);
+    async getActiveRun(taskId) {
+        const row = await getWorkPersistence().findActiveRun(taskId);
         return row ? mapRun(row) : undefined;
     }
-    updateRun(runId, status, options = {}) {
+    async updateRun(runId, status, options = {}) {
         const now = Date.now();
-        getDatabase()
-            .prepare(`UPDATE work_runs
-         SET status = ?,
-             error = ?,
-             started_at = CASE WHEN ? = 1 THEN COALESCE(started_at, ?) ELSE started_at END,
-             finished_at = CASE WHEN ? = 1 THEN ? ELSE finished_at END
-         WHERE id = ?`)
-            .run(status, options.error || null, options.started ? 1 : 0, now, options.finished ? 1 : 0, now, runId);
-        const run = this.getRun(runId);
+        await getWorkPersistence().updateRun({
+            runId,
+            status,
+            error: options.error ? replaceWorkTextNul(options.error) : null,
+            started: Boolean(options.started),
+            finished: Boolean(options.finished),
+            now,
+        });
+        const run = await this.getRun(runId);
         if (!run) {
             throw new WorkNotFoundError('Work run not found.');
         }
         return run;
     }
-    updateTaskStatus(taskId, status) {
-        getDatabase()
-            .prepare(`UPDATE work_tasks
-         SET status = ?, updated_at = ?
-         WHERE id = ?`)
-            .run(status, Date.now(), taskId);
-    }
-    updatePreview(taskId, status, previewUrl) {
-        getDatabase()
-            .prepare(`UPDATE work_tasks
-         SET preview_status = ?, preview_url = ?, updated_at = ?
-         WHERE id = ?`)
-            .run(status, previewUrl || null, Date.now(), taskId);
-    }
-    recoverOnStartup() {
-        let db;
-        let taskRows;
+    async updateTaskStatus(taskId, status) {
+        await getWorkPersistence().updateTaskStatus(taskId, status, Date.now());
+    }
+    async updatePreview(taskId, status, previewUrl, upstream) {
+        await getWorkPersistence().updatePreview(taskId, status, previewUrl || null, upstream?.host ?? null, upstream?.port ?? null, Date.now());
+    }
+    async recoverOnStartup() {
+        let recovered;
         try {
-            db = getDatabase();
-            taskRows = db.prepare('SELECT * FROM work_tasks').all();
+            recovered = await getWorkPersistence().recoverOnStartup(Date.now());
         }
         catch (error) {
             logger.error('Failed to read Work tasks for startup recovery:', error);
@@ -567,69 +674,28 @@ export class WorkTaskService {
             // startup instead of allowing Work to run without supervision.
             throw error;
         }
-        let interruptedRuns = 0;
-        let activePreviews = 0;
-        try {
-            interruptedRuns = db
-                .prepare(`SELECT COUNT(*) AS count FROM work_runs
-             WHERE status IN ('queued', 'preparing', 'running')`)
-                .get().count;
-            activePreviews = db
-                .prepare(`SELECT COUNT(*) AS count FROM work_tasks
-             WHERE preview_status IN ('starting', 'running')`)
-                .get().count;
-        }
-        catch (error) {
-            logger.error('Failed to count interrupted Work state:', error);
-        }
-        try {
-            const now = Date.now();
-            const transaction = db.transaction(() => {
-                db.prepare(`UPDATE work_tasks
-           SET status = 'failed', updated_at = ?
-           WHERE status IN ('preparing', 'running')
-              OR id IN (
-                SELECT task_id FROM work_runs
-                WHERE status IN ('queued', 'preparing', 'running')
-              )`).run(now);
-                db.prepare(`UPDATE work_tasks
-           SET preview_status = 'stopped', preview_url = NULL, updated_at = ?
-           WHERE preview_status != 'stopped' OR preview_url IS NOT NULL`).run(now);
-                db.prepare(`UPDATE work_runs
-           SET status = 'failed',
-               error = 'Backend restarted while this run was active.',
-               finished_at = ?
-           WHERE status IN ('queued', 'preparing', 'running')`).run(now);
-            });
-            transaction();
-        }
-        catch (error) {
+        if (recovered.persistenceError) {
             // Container teardown is the security-critical half of recovery. Return
             // the rows already read even if SQLite cannot persist terminal states,
             // so startup can still stop every known command and preview process.
-            logger.error('Failed to persist recovered Work state on startup:', error);
+            logger.error('Failed to persist recovered Work state on startup:', recovered.persistenceError);
         }
         return {
-            tasks: taskRows.map(mapTaskRecord),
-            interruptedRuns,
-            activePreviews,
+            tasks: recovered.tasks.map(mapTaskRecord),
+            interruptedRuns: recovered.interruptedRuns,
+            activePreviews: recovered.activePreviews,
         };
     }
-    getTaskRow(taskId, userId) {
-        return getDatabase()
-            .prepare('SELECT * FROM work_tasks WHERE id = ? AND user_id = ?')
-            .get(taskId, userId);
-    }
-    detailFromRow(row) {
-        const messagePage = this.getMessagePage(row.id);
+    async detailFromRow(row) {
+        const messagePage = await this.getMessagePage(row.id);
         return {
-            ...this.summaryFromRow(row),
+            ...(await this.summaryFromRow(row)),
             messages: messagePage.messages,
             messageCursor: messagePage.cursor,
             hasMoreMessages: messagePage.hasMore,
         };
     }
-    summaryFromRow(row) {
+    async summaryFromRow(row) {
         return {
             id: row.id,
             title: row.title,
@@ -640,7 +706,7 @@ export class WorkTaskService {
             networkEnabled: Boolean(row.network_enabled),
             createdAt: row.created_at,
             updatedAt: row.updated_at,
-            activeRun: this.getActiveRun(row.id),
+            activeRun: await this.getActiveRun(row.id),
             previewUrl: row.preview_url || undefined,
             previewStatus: row.preview_status,
             workspacePath: '/workspace',
@@ -648,18 +714,6 @@ export class WorkTaskService {
             policyId: row.policy_id || undefined,
         };
     }
-    nextMessageIndex(taskId) {
-        const row = getDatabase()
-            .prepare(`SELECT COALESCE(MAX(message_index), -1) + 1 AS next_index
-         FROM work_messages WHERE task_id = ?`)
-            .get(taskId);
-        return row.next_index;
-    }
-    touchTask(taskId) {
-        getDatabase()
-            .prepare('UPDATE work_tasks SET updated_at = ? WHERE id = ?')
-            .run(Date.now(), taskId);
-    }
 }
 export class WorkNotFoundError extends Error {
     constructor(message = 'Work task not found.') {
@@ -690,6 +744,39 @@ export class WorkAdmissionError extends Error {
         this.code = code;
     }
 }
+export class WorkInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.status = 400;
+        this.name = 'WorkInputError';
+    }
+}
+const translatePersistenceError = (error, previewContext = false) => {
+    if (!(error instanceof WorkPersistenceError))
+        return error;
+    switch (error.code) {
+        case 'WORK_USER_FORBIDDEN':
+            return new WorkForbiddenError();
+        case 'WORK_USER_TASK_LIMIT':
+            return new WorkAdmissionError(`This administrator already has the maximum of ${workAdmissionLimits.maxTasksPerUser} Work tasks.`, error.code);
+        case 'WORK_GLOBAL_TASK_LIMIT':
+            return new WorkAdmissionError(`This Libre WebUI instance already has the maximum of ${workAdmissionLimits.maxTasksGlobal} Work tasks.`, error.code);
+        case 'WORK_USER_RUNTIME_LIMIT':
+            return new WorkAdmissionError(`This administrator already has ${workAdmissionLimits.maxActiveRuntimesPerUser} active Work runtime(s). Wait for a run or preview to stop.`, error.code);
+        case 'WORK_GLOBAL_RUNTIME_LIMIT':
+            return new WorkAdmissionError(`This Libre WebUI instance already has ${workAdmissionLimits.maxActiveRuntimesGlobal} active Work runtime(s). Wait for a run or preview to stop.`, error.code);
+        case 'WORK_ACTIVE_RUN':
+            return new WorkConflictError(previewContext
+                ? 'Wait for the active Work run to finish before starting a preview.'
+                : 'This Work task already has an active run.');
+        case 'WORK_PREVIEW_ACTIVE':
+            return new WorkConflictError('Stop this Work task preview before starting another run.');
+        case 'WORK_TASK_NOT_FOUND':
+            return new WorkNotFoundError();
+        default:
+            return error;
+    }
+};
 const mapTaskRecord = (row) => ({
     id: row.id,
     userId: row.user_id,
@@ -705,6 +792,8 @@ const mapTaskRecord = (row) => ({
     policyId: row.policy_id || undefined,
     previewUrl: row.preview_url || undefined,
     previewStatus: row.preview_status,
+    previewUpstreamHost: row.preview_upstream_host || undefined,
+    previewUpstreamPort: row.preview_upstream_port || undefined,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
 });
@@ -774,9 +863,15 @@ const deriveTitle = (message) => {
     const firstLine = message.trim().split(/\r?\n/, 1)[0] || 'New Work';
     return cleanTitle(firstLine.slice(0, 80));
 };
-const cleanTitle = (value) => value.trim().slice(0, 120) || 'New Work';
+const rejectWorkTextNul = (value, field) => {
+    if (value.includes('\u0000')) {
+        throw new WorkInputError(`${field} cannot contain U+0000.`);
+    }
+    return value;
+};
+const cleanTitle = (value) => replaceWorkTextNul(value).trim().slice(0, 120) || 'New Work';
 const cleanRequired = (value) => {
-    const cleaned = value.trim();
+    const cleaned = rejectWorkTextNul(value, 'Work model').trim();
     if (!cleaned) {
         throw new Error('Model cannot be empty.');
     }