pi-roundtable-line 0.15.3 → 0.15.4

package/CHANGELOG.md

@@ -5,6 +5,19 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.15.4] - 2026-10-15
+
+### Added
+
+- `LineOutboxResultEvent.attempts`: how many tries the push took, the one that ended it included (1 for a push LINE refused at once, 2 after a `5xx` and then a refusal), so a subscriber no longer reads `line_outbox`.
+- Migration `outbox-requested` adds the nullable `line_outbox.requested_at`, set just before a push's request is made and cleared when the push is claimed again.
+
+### Fixed
+
+- A stop no longer gives back an attempt whose request may have reached LINE. A push interrupted by the worker stopping used to be put back with its attempt uncounted even when the request was already out, so the count (and `outbox.maxAttempts`) understated the tries; it is now given back only when the stop came before the request.
+
+The core peer range stays `>=0.15.0 <0.16.0`.
+
 ## [0.15.3] - 2026-10-15
 
 - Release in lockstep with pi-roundtable 0.15.3; no package-specific behavior changes. The core peer range stays `>=0.15.0 <0.16.0`.

package/README.md

@@ -184,7 +184,7 @@ The processor that serves it is the package's own; there is no way to read raw i
 | `joined` | `notice`: `"sent"`, `"failed"` or `"unconfirmed"`, truthfully (see [The join notice](#the-join-notice)) |
 | `left` | |
 | `memberJoined`, `memberLeft` | `userIds` |
-| `outboxResult` | `sourceKey`, `originRef`, `status` (`sent`, `dead`, `refused`) and `errorCode` (see [Sending](#sending)) |
+| `outboxResult` | `sourceKey`, `originRef`, `status` (`sent`, `dead`, `refused`), `errorCode` and `attempts` (see [Sending](#sending)) |
 
 Every event but `outboxResult` has `eventId` (LINE's `webhookEventId`, the same on every redelivery), `sourceKey` and `timestamp`; a push is not a webhook event, so `outboxResult` has none of the three.
 No event carries a reply token, a quote token or a URL.
@@ -277,7 +277,8 @@ Message objects hold what you send, so they live in `line_outbox.messages` until
 - **Pushes of at most five objects, per chat and sender.** Objects queued for the same chat and the same sender within `outbox.coalesceMs` (2 seconds, counted from the first object, not from the last) share one push, in the order they were queued; a sixth object starts the next push, and a push that holds five goes at once. Different senders never share a push, and a push is never joined if a later push of the chat exists (that would reorder the chat). The chat's pushes go out strictly in order: a push that is backing off holds the ones behind it (a dead or refused one does not).
 - **A retry key from the start.** Each push gets a UUID the moment its row exists, before any attempt, and every attempt and every retry after a crash sends it as `X-Line-Retry-Key`. LINE keeps a key for 24 hours (`outbox.retryKeyMs`): a push still unsent then is `dead` with `retry_key_expired` and is never sent under a new key.
 - **Outcomes.** `2xx` and `409` (LINE already has this key) are `sent`. `429`, `5xx` and no answer back off (5 seconds doubling to 1 hour, at least `Retry-After`) and retry, up to `outbox.maxAttempts` (12), then `dead` with the last code. Any other `4xx` is `dead` at once with a code: `sender_name_refused` or `sender_icon_refused` when LINE names that property of the request, else `http_<status>`; nothing else of LINE's answer is kept. A push the quota gate refuses is `refused` and is never sent. A push for a chat that stopped being allowed is `dead` with `source_not_allowed`.
-- **Results.** The subscriber hears an `outboxResult` for each push once it has ended, once per distinct `origin` the push carries (once with `originRef: null` when none was given), at least once: a result waits while no subscriber is attached and is told again later, up to 12 times, if the subscriber throws.
+- **Results.** The subscriber hears an `outboxResult` for each push once it has ended, once per distinct `origin` the push carries (once with `originRef: null` when none was given), at least once: a result waits while no subscriber is attached and is told again later, up to 12 times, if the subscriber throws. The event carries `attempts`, how many tries the push took, the one that ended it included (1 for a push LINE refused at once, 2 after a `5xx` and then a refusal), so there is no need to read `line_outbox`.
+- **What counts as a try.** An attempt is counted when a push is taken up and is given back only when the worker stops before the request was made; the migration `outbox-requested` adds `line_outbox.requested_at`, set just before the request goes out. A stop after it cannot say LINE did not take the request, so that try stays counted (and it counts towards `outbox.maxAttempts`).
 - **Crashes.** A push in hand when the process dies has a 2-minute lease; the worker puts it back and sends it again under the same key, which LINE answers with `409` if it had taken the first request.
 - **Service.** The `line-outbox` service runs the worker and counts as `busy` while a push is in flight, so the shutdown waits for it; a push still in flight when the host stops is put back as it was.
 - **Nothing sensitive in logs.** The worker logs push ids, attempt numbers, status words and codes; never message objects, sender names, retry keys or tokens.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-line",
-	"version": "0.15.3",
+	"version": "0.15.4",
 	"description": "A LINE Messaging API transport for pi-roundtable: a signed webhook that persists events before it answers, a durable inbox worker, and an allowlist of the groups and chats it mirrors",
 	"type": "module",
 	"license": "MIT",
@@ -40,7 +40,7 @@
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.15.3",
+		"pi-roundtable": "0.15.4",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/messages.ts

@@ -115,6 +115,13 @@ export interface LineOutboxResultEvent {
 	 * `source_not_allowed`); null when it was sent.
 	 */
 	errorCode: string | null;
+	/**
+	 * How many tries the push took, the one that ended it included: 1 for a push LINE refused at once,
+	 * 2 after a `5xx` and then a refusal. A try counts once its request has been made to LINE, also
+	 * when a stop cut it short, and once the worker took the push up only to end it without a request
+	 * (`refused`, `source_not_allowed`); a stop before the request does not count.
+	 */
+	attempts: number;
 }
 
 export type LineEvent =

package/src/migrations.ts

@@ -136,9 +136,21 @@ export const OUTBOX_MIGRATION: Migration = {
 	},
 };
 
+/**
+ * When the request of the push's current attempt was handed to the network. A stop that comes after
+ * it cannot say LINE did not take the request, so the attempt stays counted.
+ */
+export const OUTBOX_REQUESTED_MIGRATION: Migration = {
+	name: "outbox-requested",
+	up: async (sql) => {
+		await sql`ALTER TABLE line_outbox ADD COLUMN IF NOT EXISTS requested_at TIMESTAMPTZ`;
+	},
+};
+
 /** Every migration of the package, in the order they run. */
 export const MIGRATIONS: Migration[] = [
 	INBOX_MIGRATION,
 	MESSAGES_MIGRATION,
 	OUTBOX_MIGRATION,
+	OUTBOX_REQUESTED_MIGRATION,
 ];

package/src/outbox-worker.ts

@@ -138,7 +138,7 @@ export class OutboxWorker {
 				ORDER BY id LIMIT 1`) as { id: string | number }[];
 			if (!head) return undefined;
 			const [claimed] = (await tx`UPDATE line_outbox
-				SET status = 'sending', claimed_at = ${now}, attempts = attempts + 1,
+				SET status = 'sending', claimed_at = ${now}, requested_at = NULL, attempts = attempts + 1,
 					first_attempt_at = COALESCE(first_attempt_at, ${now})
 				WHERE id = (SELECT id FROM line_outbox WHERE id = ${head.id} AND status = 'queued' FOR UPDATE SKIP LOCKED)
 				RETURNING id, source_key, sender_name, sender_icon_url, messages, retry_key, attempts,
@@ -214,6 +214,11 @@ export class OutboxWorker {
 				const messages = row.messages.map((message) =>
 					Object.keys(sender).length > 0 ? { ...message, sender } : message,
 				);
+				// A stop that comes before this leaves the attempt uncounted; one after it cannot say LINE
+				// did not take the request.
+				controller.signal.throwIfAborted();
+				await this.#sql`UPDATE line_outbox SET requested_at = ${this.#now()}
+					WHERE id = ${row.id} AND status = 'sending' AND claimed_at = ${row.claimed_at}`;
 				const pushed = await this.#api.push(
 					source.id,
 					messages,
@@ -245,7 +250,8 @@ export class OutboxWorker {
 				this.#quota.settle(reserved.reservation, sent);
 			}
 		} catch (error) {
-			// Giving up because the worker stops is the restart's doing: the push goes back as it was.
+			// Giving up because the worker stops is the restart's doing: the push goes back as it was,
+			// unless its request had already been made.
 			if (this.#stopping && controller.signal.aborted) {
 				await this.#later(row, 0, "worker_stopped", false);
 				return;
@@ -307,7 +313,8 @@ export class OutboxWorker {
 		counted: boolean,
 	): Promise<void> {
 		await this.#sql`UPDATE line_outbox
-			SET status = 'queued', claimed_at = NULL, attempts = attempts - ${counted ? 0 : 1},
+			SET status = 'queued', claimed_at = NULL,
+				attempts = attempts - CASE WHEN ${counted ? 1 : 0}::int = 0 AND requested_at IS NULL THEN 1 ELSE 0 END,
 				next_attempt_at = ${new Date(this.#now().getTime() + delayMs)}, last_error_code = ${code}
 			WHERE id = ${row.id} AND status = 'sending' AND claimed_at = ${row.claimed_at}`;
 	}
@@ -332,8 +339,9 @@ export class OutboxWorker {
 			last_error_code: string | null;
 			origin_refs: (string | null)[];
 			notify_attempts: number;
+			attempts: number;
 		}[] = await this
-			.#sql`SELECT id, source_key, status, last_error_code, origin_refs, notify_attempts
+			.#sql`SELECT id, source_key, status, last_error_code, origin_refs, notify_attempts, attempts
 			FROM line_outbox
 			WHERE notified_at IS NULL AND status IN ('sent', 'dead', 'refused')
 				AND (notify_after IS NULL OR notify_after <= ${now})
@@ -356,6 +364,7 @@ export class OutboxWorker {
 								originRef,
 								status: row.status,
 								errorCode: row.last_error_code,
+								attempts: row.attempts,
 							},
 							controller.signal,
 						);