pixivflow 3.4.0 → 3.4.1

package/dist/commands/SchedulerCommand.js

@@ -12,6 +12,7 @@ const ScheduleTriggerServer_1 = require("../scheduler/ScheduleTriggerServer");
 const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
 const ManualJobAdmission_1 = require("../scheduler/ManualJobAdmission");
 const ManualJobService_1 = require("../scheduler/ManualJobService");
+const JobCancellation_1 = require("../scheduler/JobCancellation");
 const ManualRefetchAdapter_1 = require("../scheduler/ManualRefetchAdapter");
 const schedules_1 = require("../scheduler/schedules");
 const targetRoutes_1 = require("../delivery/targetRoutes");
@@ -100,6 +101,13 @@ class SchedulerCommand extends Command_1.BaseCommand {
                     database: runtime.database,
                     config: resolveConfig,
                     admission,
+                    // A consumer cancel must bite the WORK, not only the ledger: the ledger
+                    // write already happened inside `cancelJob`, so this only stops the
+                    // in-flight download loop (and the `Scheduler.running` it holds, which
+                    // otherwise refuses every later admission for the same schedule).
+                    onCancel: (slotId) => {
+                        runtime.cancelSlot(slotId, JobCancellation_1.CANCELLED_BY_CONSUMER_MESSAGE);
+                    },
                 });
                 // Durable dispatch. The trigger endpoint records the occurrence FIRST,
                 // then hands it to the shared scheduler and answers immediately. It must

package/dist/commands/scheduler-runtime.d.ts

@@ -62,8 +62,14 @@ export declare function withDeliveryMode<T extends {
  *  - `shutdown`: the process is going away. The Slot is deliberately left
  *    non-terminal so recovery resumes the same occurrence after restart; no
  *    worker survives to duplicate it.
+ *  - `consumer`: an operator/consumer cancelled THIS job through the protocol
+ *    `POST /jobs/{job_id}/cancel`. The ledger already took the Slot terminal in
+ *    one transaction (`cancelConsumerJob`, reason `cancelled_by_consumer`), so
+ *    the abort path must not roll it up a second time — doing so would overwrite
+ *    the cancel verdict with a generic failure and flip the protocol status from
+ *    `cancelled` back to `failed`.
  */
-export type CancelOrigin = 'timeout' | 'shutdown';
+export type CancelOrigin = 'timeout' | 'shutdown' | 'consumer';
 /**
  * Decide a scheduled run's Slot fate when `runAllTargets()` aborts abnormally
  * instead of reporting per-target failures.
@@ -90,6 +96,21 @@ export interface SchedulerRuntime {
      * (`shutdown`: leave the Slot non-terminal so recovery resumes it).
      */
     cancelActive(reason: string, origin?: CancelOrigin): void;
+    /**
+     * Cancel the in-flight run **only if it is the one owning `slotId`**.
+     *
+     * This is what makes a protocol consumer cancel bite: `cancelConsumerJob`
+     * terminalises the ledger in one transaction, but the work itself is an
+     * in-process download loop that knows nothing about the ledger. Without this
+     * call the cancelled job keeps consuming until it finishes on its own, and the
+     * holding `Scheduler.running` keeps refusing every later admission for that
+     * schedule (`scheduler_busy`) for the whole remaining run.
+     *
+     * Returns true when this call cancelled that Slot's live run. A slot another
+     * run owns (or a job that is only queued) is untouched — its ledger terminal is
+     * all there is to do.
+     */
+    cancelSlot(slotId: string, reason: string): boolean;
     /**
      * The active run never settled after its timeout and drain window. Stop
      * renewing its lease and take its Slot terminal so recovery cannot re-dispatch

package/dist/commands/scheduler-runtime.js

@@ -98,6 +98,11 @@ function shouldTerminaliseAbortedSlot(origin, slotAbandoned) {
     // only overwrite it when the wedged job finally settles.
     if (slotAbandoned)
         return false;
+    // A consumer cancel is already terminal in the ledger (`cancelled_by_consumer`,
+    // written by cancelConsumerJob in one transaction). Finishing it again would
+    // replace that verdict with a generic failure.
+    if (origin === 'consumer')
+        return false;
     // Shutdown is not a failure: recovery is meant to resume this occurrence.
     return origin !== 'shutdown';
 }
@@ -291,6 +296,12 @@ async function createSchedulerRuntime(configPathArg) {
      * `null` while no cancellation has been requested for the current run.
      */
     let activeAbortOrigin = null;
+    /**
+     * The Slot the in-flight run owns, if any. Set where the lease is claimed and
+     * cleared where it is released, so `cancelSlot()` can tell "this job is the one
+     * running right now" from "this job is merely queued behind another run".
+     */
+    let activeSlotId = null;
     // Independently-pumped durable outbox (content + notifications). Started in
     // the long-running scheduler daemon; run-once drains explicitly before exit.
     const deliveryDispatcher = new DeliveryDispatcher_1.DeliveryDispatcher(config.delivery, buildProxyUrl(config.network));
@@ -452,6 +463,7 @@ async function createSchedulerRuntime(configPathArg) {
             // This run owns the Slot now: any cancellation recorded against a previous
             // run must not decide how THIS run's abort is handled.
             activeAbortOrigin = null;
+            activeSlotId = activeSlot.slotId;
             let cancelled = false;
             const heartbeat = setInterval(() => {
                 // A cancelled/timed-out run must stop renewing its lease. An infinitely
@@ -468,6 +480,7 @@ async function createSchedulerRuntime(configPathArg) {
             varReleaseLease = () => {
                 clearInterval(heartbeat);
                 activeLeaseHooks = null;
+                activeSlotId = null;
                 coordinator.releaseRunLease(activeSlot.slotId, runOwner);
             };
             activeLeaseHooks = {
@@ -497,6 +510,7 @@ async function createSchedulerRuntime(configPathArg) {
                     database.slots.markSlotStatus(activeSlot.slotId, 'failed', `abandoned after scheduler timeout; no delivery (${reason})`);
                     coordinator.releaseRunLease(activeSlot.slotId, runOwner);
                     activeLeaseHooks = null;
+                    activeSlotId = null;
                 },
             };
         }
@@ -778,6 +792,15 @@ async function createSchedulerRuntime(configPathArg) {
         // or left recoverable is decided by `origin` in the abort path of runJob.
         activeLeaseHooks?.stopHeartbeat();
     };
+    const cancelSlot = (slotId, reason) => {
+        // A cancellation is only meaningful for the run that owns THIS Slot. Every
+        // other case (queued behind another run, or already terminal) has nothing to
+        // abort: the durable ledger write is the whole effect.
+        if (!activeSlotId || activeSlotId !== slotId)
+            return false;
+        cancelActive(reason, 'consumer');
+        return true;
+    };
     const abandonActiveRun = (reason) => {
         // Cancellation did not take effect inside the drain window — a request that
         // ignores the abort. This run will never settle, so finish the lease
@@ -800,6 +823,7 @@ async function createSchedulerRuntime(configPathArg) {
         tokenMaintenance,
         runJob,
         cancelActive,
+        cancelSlot,
         abandonActiveRun,
         activeExecutionCount: () => activeExecutions,
         startOutboxWorker: () => outboxWorker.start(),

package/dist/delivery/DeliveryService.d.ts

@@ -47,6 +47,13 @@ export interface RefetchOutcomePayload {
     requestId: string;
     /** 'no_alternative' | 'failed' (replacement success rides the submission). */
     disposition: 'no_alternative' | 'failed';
+    /**
+     * The cross-boundary, closed-vocabulary protocol error code (protocol/v1
+     * `$defs/Error.code`). The consumer writes it into its `failure_code` CODE
+     * column, so raw upstream text must never appear here.
+     */
+    reasonCode?: string;
+    /** Bounded, single-line, human-readable business message (never a raw body). */
     reason?: string;
     workId?: string;
     /** Bounded candidate-scan bookkeeping for diagnostics (spec-compatible). */

package/dist/delivery/HttpMultipartDelivery.js

@@ -173,6 +173,11 @@ class HttpMultipartDelivery {
             ? {
                 request_id: outcome.requestId,
                 disposition: outcome.disposition,
+                // The closed-vocabulary code goes to TelePost's `failure_code` CODE
+                // column; `reason` is only the bounded human business message it
+                // sanitizes into `terminal_reason`. Raw upstream text (an nginx 502
+                // HTML page) must never appear on the wire.
+                reason_code: outcome.reasonCode,
                 reason: outcome.reason,
                 work_id: outcome.workId,
                 scanned: outcome.scanned,

package/dist/delivery/types.d.ts

@@ -154,6 +154,12 @@ export interface DeliveryNotificationRequest {
     refetchOutcome?: {
         requestId: string;
         disposition: 'no_alternative' | 'failed';
+        /**
+         * The cross-boundary, closed-vocabulary protocol error code (protocol/v1
+         * `$defs/Error.code`); raw upstream text never crosses the boundary.
+         */
+        reasonCode?: string;
+        /** Bounded, single-line, human-readable business message (never a raw body). */
         reason?: string;
         workId?: string;
         scanned?: number;

package/dist/notification/NotificationPolicy.js

@@ -239,12 +239,22 @@ class NotificationPolicy {
             });
             return;
         }
+        // Translate the internal outcome ONCE, through the existing classifier:
+        // the wire carries the closed-vocabulary protocol code plus the short
+        // Chinese business message. The raw technical text (`outcome.error` /
+        // `outcome.reason`) never crosses the boundary — a live acceptance run
+        // shipped a 220-char multi-line nginx 502 HTML page into TelePost's
+        // `failure_code` CODE column that way.
+        const normalized = (0, TargetOutcome_1.terminalReasonFor)(outcome);
+        const reasonCode = (0, TargetOutcome_1.protocolErrorCodeForTerminalReason)(normalized?.code) ?? undefined;
+        const reason = (normalized?.message ?? '').trim() || undefined;
         let payload;
         if (outcome.kind === 'no_candidate' || outcome.kind === 'duplicate') {
             payload = {
                 requestId,
                 disposition: 'no_alternative',
-                reason: outcome.reason,
+                reasonCode,
+                reason,
                 workId: outcome.kind === 'duplicate' ? outcome.workId : undefined,
                 ...scanCounts(outcome.scan),
             };
@@ -253,7 +263,8 @@ class NotificationPolicy {
             payload = {
                 requestId,
                 disposition: 'failed',
-                reason: outcome.error,
+                reasonCode,
+                reason,
                 ...scanCounts(outcome.scan),
             };
         }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "private": true
 }

package/dist/scheduler/ManualJobService.d.ts

@@ -25,6 +25,16 @@ export interface ManualJobServiceDeps {
     config(): StandaloneConfig;
     /** The shared admission path — the same instance the legacy shim uses. */
     admission: ManualJobAdmission;
+    /**
+     * Ask the runtime to abort the in-flight run when the cancelled job is the one
+     * executing right now.
+     *
+     * The ledger write is the source of truth and happens first; this only stops
+     * the in-process download loop from running to completion after it has been
+     * cancelled. A job that is merely queued behind another run has no live run to
+     * abort, and the hook is then never called.
+     */
+    onCancel?(slotId: string): void;
     /** Injected clock, for tests. */
     now?(): number;
 }

package/dist/scheduler/ManualJobService.js

@@ -78,10 +78,15 @@ class ManualJobService {
      * that terminalises the work and stops further deliveries.
      */
     cancelJob(jobId) {
-        (0, JobCancellation_1.cancelConsumerJob)(this.deps.database, jobId, this.now());
+        const result = (0, JobCancellation_1.cancelConsumerJob)(this.deps.database, jobId, this.now());
         // The cancellation is now durable, so its terminal event must be too — a
         // consumer that polls after cancelling must never see an unterminated stream.
         this.events.reconcile(jobId);
+        // Only a cancel that actually transitioned the ledger has a live run worth
+        // aborting. The ledger write came first, so the abort path cannot resurrect
+        // the job; it only makes the running download loop stop consuming.
+        if (result.cancelled)
+            this.deps.onCancel?.(jobId);
         return this.viewBySlotId(jobId);
     }
     viewBySlotId(slotId) {

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD = void 0;
 // GENERATED by scripts/write-version.js — do not edit manually.
-exports.BUILD = { version: '3.4.0', commit: '5d231179a9b3' };
+exports.BUILD = { version: '3.4.1', commit: 'd2e9c9e338bd' };
 //# sourceMappingURL=version.js.map

package/dist/webui/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow-webui-backend",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "PixivFlow WebUI Backend - CommonJS module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixivflow",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "🎨 Pixiv 下载、筛选与自动收集工具 - 批量下载插画和小说、按标签/热度/日期筛选、定时任务与可靠 HTTP 交付 | Pixiv downloader and automation toolkit with filtering, scheduling and reliable HTTP delivery",
   "repository": {
     "type": "git",