novacode-cli 1.2.0__py3-none-any.whl

novacode_cli/context/archives.py

@@ -0,0 +1,248 @@
+"""Versioned, checksummed, atomically published full-message recovery archives."""
+
+from __future__ import annotations
+
+import json
+import re
+import uuid
+from pathlib import Path
+
+# JSON and LangGraph interfaces carry heterogeneous values.
+# ruff: noqa: ANN401
+from typing import Any
+
+from langchain_core.messages import messages_from_dict, messages_to_dict
+
+from novacode_cli.hermes.activation import content_hash, publish
+
+MANIFEST_VERSION = 2
+
+
+class RecoveryArchiveError(ValueError):
+    """An archive is incomplete or its checksum does not match."""
+
+
+class RecoveryStore:
+    """Keep immutable archives and identify older incomplete transcript files."""
+
+    def __init__(self, root: Path) -> None:
+        """Initialize local state without acquiring invocation ownership."""
+        self.root = Path(root)
+
+    def _blob(self, data: bytes, blobs: dict) -> Any:
+        digest = content_hash(data)
+        path = self.root / "blobs" / digest
+        if path.exists():
+            if path.read_bytes() != data:
+                message = "Immutable recovery blob checksum conflict"
+                raise RecoveryArchiveError(message)
+        else:
+            publish(path, data)
+        blobs[digest] = len(data)
+        return {"__nova_binary__": digest}
+
+    def _encode(self, value: Any, blobs: Any) -> Any:
+        if isinstance(value, bytes):
+            return self._blob(value, blobs)
+        if isinstance(value, dict):
+            if set(value) in ({"__nova_binary__"}, {"__nova_mapping__"}):
+                return {
+                    "__nova_mapping__": [
+                        [key, self._encode(item, blobs)] for key, item in value.items()
+                    ]
+                }
+            return {key: self._encode(item, blobs) for key, item in value.items()}
+        if isinstance(value, (tuple, list)):
+            return [self._encode(item, blobs) for item in value]
+        if value is None or isinstance(value, (str, int, float, bool)):
+            return value
+        message = f"Unsupported archive value: {type(value).__name__}"
+        raise RecoveryArchiveError(message)
+
+    def _read_blob(self, digest: str) -> bytes:
+        if not re.fullmatch(r"[0-9a-f]{64}", digest):
+            message = "Invalid blob reference"
+            raise RecoveryArchiveError(message)
+        data = (self.root / "blobs" / digest).read_bytes()
+        if content_hash(data) != digest:
+            message = "Recovery blob checksum mismatch"
+            raise RecoveryArchiveError(message)
+        return data
+
+    def _decode(self, value: Any) -> Any:
+        if isinstance(value, dict):
+            if set(value) == {"__nova_mapping__"}:
+                return {key: self._decode(item) for key, item in value["__nova_mapping__"]}
+            if set(value) == {"__nova_binary__"}:
+                return self._read_blob(value["__nova_binary__"])
+            return {key: self._decode(item) for key, item in value.items()}
+        if isinstance(value, list):
+            return [self._decode(item) for item in value]
+        return value
+
+    def archive(
+        self,
+        thread: str,
+        messages: list,
+        *,
+        approvals: Any = (),
+        state: Any = None,
+        source: str = "manual",
+        checkpoint: Any = None,
+    ) -> Path:
+        """Publish a complete manifest after all message blobs are durable."""
+        blobs: dict[str, int] = {}
+        payload = self._encode(
+            {
+                "messages": messages_to_dict(messages),
+                "approvals": approvals,
+                "state": state or {},
+                "checkpoint": checkpoint,
+            },
+            blobs,
+        )
+        encoded = json.dumps(payload, ensure_ascii=False, allow_nan=False).encode()
+        digest = content_hash(encoded)
+        publish(self.root / "blobs" / digest, encoded)
+        manifest = {
+            "version": MANIFEST_VERSION,
+            "id": uuid.uuid4().hex,
+            "thread": thread,
+            "source": source,
+            "message_count": len(messages),
+            "payload": digest,
+            "blobs": blobs,
+            "complete": True,
+        }
+        manifest["checksum"] = content_hash(json.dumps(manifest, sort_keys=True).encode())
+        destination = self.root / "manifests" / f"{manifest['id']}.json"
+        publish(destination, json.dumps(manifest, sort_keys=True).encode())
+        return destination
+
+    def inspect(self, reference: str) -> Any:
+        """Validate an archive and all its referenced blobs before returning it."""
+        identity = Path(reference).stem
+        if not re.fullmatch(r"[0-9a-f]{32}", identity):
+            message = "Use a recovery ID from /context recovery"
+            raise RecoveryArchiveError(message)
+        manifest = json.loads((self.root / "manifests" / f"{identity}.json").read_text())
+        if manifest.get("version") not in {1, 2} or not manifest.get("complete"):
+            message = "Incomplete or unsupported recovery manifest"
+            raise RecoveryArchiveError(message)
+        if manifest["version"] == MANIFEST_VERSION:
+            checked = dict(manifest)
+            checksum = checked.pop("checksum", None)
+            if checksum != content_hash(json.dumps(checked, sort_keys=True).encode()):
+                message = "Recovery manifest checksum mismatch"
+                raise RecoveryArchiveError(message)
+        else:
+            manifest["integrity"] = "legacy: payload verified; manifest checksum unavailable"
+        if not isinstance(manifest.get("blobs"), dict) or not isinstance(
+            manifest.get("payload"), str
+        ):
+            message = "Incomplete recovery manifest references"
+            raise RecoveryArchiveError(message)
+        payload = self._decode(json.loads(self._read_blob(manifest["payload"])))
+        for digest, size in manifest["blobs"].items():
+            if len(self._read_blob(digest)) != size:
+                message = "Recovery blob length mismatch"
+                raise RecoveryArchiveError(message)
+        return manifest, payload
+
+    def list(self, thread: str | None = None) -> Any:
+        """List recoverable archives and label damaged references."""
+        entries = []
+        for path in sorted((self.root / "manifests").glob("*.json")):
+            try:
+                manifest, _ = self.inspect(path.stem)
+                if thread is None or manifest["thread"] == thread:
+                    entries.append(manifest)
+            except (OSError, ValueError, KeyError, TypeError) as error:
+                entries.append({"id": path.stem, "complete": False, "error": str(error)})
+        sessions = self.root.parent / "sessions"
+        if sessions.is_dir():
+            for session in sorted(sessions.iterdir()):
+                if not session.is_dir() or (thread is not None and session.name != thread):
+                    continue
+                for pattern, source in (
+                    ("pre-compact-*.jsonl", "manual"),
+                    ("conversation_history/*.md", "automatic"),
+                ):
+                    entries.extend(
+                        {
+                            "id": f"legacy:{legacy.relative_to(sessions).as_posix()}",
+                            "thread": session.name,
+                            "source": source,
+                            "path": str(legacy),
+                            "complete": False,
+                            "restorable": False,
+                            "error": "Legacy transcript lacks a complete checkpoint manifest",
+                        }
+                        for legacy in sorted(session.glob(pattern))
+                        if legacy.is_file()
+                    )
+        return entries
+
+    async def restore(self, reference: str, agent: Any) -> str:
+        """Restore messages and graph approvals into a fresh checkpoint thread."""
+        import asyncio
+
+        _manifest, payload = await asyncio.to_thread(self.inspect, reference)
+        thread = uuid.uuid4().hex
+        config = {"configurable": {"thread_id": thread, "checkpoint_ns": ""}}
+        state = dict(payload["state"])
+        state["messages"] = messages_from_dict(payload["messages"])
+        # Persist approval interrupts through the saver, rather than advancing
+        # the graph's model node and losing the pending task/approval structure.
+        if payload.get("checkpoint"):
+            from novacode_cli.session.checkpoint_coordinator import CoordinatedGraph
+
+            if not isinstance(agent, CoordinatedGraph):
+                message = "Checkpoint restoration requires a coordinated graph"
+                raise RecoveryArchiveError(message)
+            saver = agent.coordinator.saver
+            packed = payload["checkpoint"]
+            checkpoint = saver.serde.loads_typed(tuple(packed["checkpoint"]))
+            pending = saver.serde.loads_typed(tuple(packed["pending"]))
+            async with agent.coordinator.mutation(config, agent.project):
+                saved = await saver.aput(
+                    config, checkpoint, packed["metadata"], checkpoint["channel_versions"]
+                )
+                grouped: dict[str, list[tuple[str, Any]]] = {}
+                for task_id, channel, value in pending:
+                    grouped.setdefault(task_id, []).append((channel, value))
+                for task_id, writes in grouped.items():
+                    await saver.aput_writes(saved, writes, task_id)
+            return thread
+        if payload["approvals"]:
+            message = "Archive contains pending approvals; use checkpoint-preserving restore"
+            raise RecoveryArchiveError(message)
+        await agent.aupdate_state(config, state)
+        return thread
+
+
+def default_recovery_store() -> RecoveryStore:
+    """Resolve the shared local archive store."""
+    from novacode_cli.config import config
+
+    return RecoveryStore(config.HOME_DIR / "recovery")
+
+
+async def handle_recovery_command(args: str, *, agent: Any, thread: str) -> tuple[str, str | None]:
+    """Transport-independent listing, inspection, and fresh-thread restoration."""
+    import asyncio
+
+    parts = args.split()
+    store = default_recovery_store()
+    if not parts or parts == ["list"]:
+        entries = await asyncio.to_thread(store.list, thread)
+        return json.dumps(entries, indent=2), None
+    command_arity = 2
+    if len(parts) == command_arity and parts[0] == "inspect":
+        manifest, _payload = await asyncio.to_thread(store.inspect, parts[1])
+        return json.dumps(manifest, indent=2), None
+    if len(parts) == command_arity and parts[0] == "restore":
+        restored = await store.restore(parts[1], agent)
+        return f"Restored into new thread {restored}", restored
+    message = "Usage: /context recovery [list|inspect <id>|restore <id>]"
+    raise ValueError(message)

novacode_cli/context/estimates.py

@@ -0,0 +1,65 @@
+"""Separate text estimates, fixed image heuristics and image transport size."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+from langchain_core.messages.utils import count_tokens_approximately
+
+if TYPE_CHECKING:
+    from langchain_core.messages import AnyMessage
+
+IMAGE_TYPES = frozenset({"image", "image_url", "input_image"})
+TOKENS_PER_IMAGE = 85
+
+
+@dataclass(frozen=True)
+class ContentEstimate:
+    """Heuristics only; image dimensions and provider billing are unobserved."""
+
+    text_tokens: int
+    image_tokens: int
+    image_transport_chars: int
+
+    @property
+    def total(self) -> int:
+        """Input estimate excluding schemas, with no base64 character charge."""
+        return self.text_tokens + self.image_tokens
+
+
+def estimate_content(messages: Sequence[AnyMessage]) -> ContentEstimate:
+    """Count images separately, including nested tool-result image blocks."""
+    images = transport = 0
+
+    def sanitize(value: Any) -> Any:  # noqa: ANN401 - heterogeneous content blocks
+        nonlocal images, transport
+        if isinstance(value, list):
+            return [sanitize(item) for item in value]
+        if not isinstance(value, Mapping):
+            return value
+        if value.get("type") in IMAGE_TYPES:
+            images += 1
+            payload = value.get("base64") or value.get("image_url") or value.get("url")
+            if isinstance(payload, Mapping):
+                payload = payload.get("url") or payload.get("data")
+            source = value.get("source")
+            if not payload and isinstance(source, Mapping):
+                payload = source.get("data")
+            if isinstance(payload, str):
+                if payload.startswith("data:"):
+                    transport += len(payload.partition(",")[2])
+                elif not payload.startswith(("https://", "http://")):
+                    transport += len(payload)
+            return {"type": "image"}
+        return {key: sanitize(item) for key, item in value.items()}
+
+    sanitized = [
+        message.model_copy(update={"content": sanitize(message.content)})
+        if isinstance(message.content, list)
+        else message
+        for message in messages
+    ]
+    text_tokens = count_tokens_approximately(sanitized, tokens_per_image=0)
+    return ContentEstimate(text_tokens, images * TOKENS_PER_IMAGE, transport)

novacode_cli/context/history.py

@@ -0,0 +1,17 @@
+"""Reconstruct the conversation sent to the model after library compaction."""
+
+from collections.abc import Mapping
+from typing import Any
+
+
+def effective_messages(values: Mapping[str, Any]) -> list[Any]:
+    """Use the summary and retained tail instead of the checkpoint archive."""
+    messages = list(values.get("messages", []))
+    event = values.get("_summarization_event")
+    if not isinstance(event, Mapping):
+        return messages
+    cutoff = event.get("cutoff_index")
+    summary = event.get("summary_message")
+    if not isinstance(cutoff, int) or cutoff < 0 or summary is None:
+        return messages
+    return [summary, *messages[cutoff:]]

novacode_cli/context/knowledge_cache.py

@@ -0,0 +1,292 @@
+"""Disposable, owner-private SQLite knowledge artifacts and producer fences."""
+# ruff: noqa: ANN401, EM101, TRY003
+
+from __future__ import annotations
+
+import csv
+import hashlib
+import json
+import os
+import sqlite3
+import subprocess
+import time
+from contextlib import contextmanager
+from pathlib import Path
+from threading import RLock
+from typing import Any
+
+TTL = 7 * 24 * 3600
+MAX_ARTIFACTS = 2000
+MAX_PAYLOAD = 64 * 1024 * 1024
+LEASE_SECONDS = 90
+
+
+def digest(value: str | bytes) -> str:
+    """Hash identities or complete source bytes without storing the original."""
+    return hashlib.sha256(value.encode() if isinstance(value, str) else value).hexdigest()
+
+
+def _protect(directory: Path) -> None:
+    """Restrict the directory before creating SQLite and its WAL sidecars."""
+    directory.mkdir(parents=True, exist_ok=True, mode=0o700)
+    if directory.is_symlink() or directory.resolve() != directory.absolute():
+        raise ValueError("Knowledge directory must not contain links")
+    if os.name != "nt":
+        directory.chmod(0o700)
+        return
+    executable = Path(os.environ.get("SYSTEMROOT", "C:/Windows")) / "System32/icacls.exe"
+    identity = subprocess.run(  # noqa: S603
+        [str(executable.with_name("whoami.exe")), "/user", "/fo", "csv", "/nh"],
+        capture_output=True,
+        text=True,
+        timeout=10,
+        check=True,
+        creationflags=subprocess.CREATE_NO_WINDOW,
+    )
+    sid = next(csv.reader([identity.stdout.strip()]))[1]
+    if not sid.startswith("S-1-") or any(c not in "S0123456789-" for c in sid):
+        raise OSError("Could not determine knowledge directory owner")
+    subprocess.run(  # noqa: S603
+        [str(executable), str(directory), "/inheritance:r", "/grant:r", f"*{sid}:(OI)(CI)F"],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        timeout=10,
+        check=True,
+        creationflags=subprocess.CREATE_NO_WINDOW,
+    )
+
+
+class KnowledgeCache:
+    """Short independent transactions; never hold a connection across model work."""
+
+    def __init__(self, directory: Path) -> None:
+        """Defer filesystem and database work until a lookup or command."""
+        self.directory = directory.absolute()
+        self._ready = False
+        self._lock = RLock()
+
+    @contextmanager
+    def connection(self) -> Any:
+        """Serialize lazy initialization and short writes within this instance."""
+        with self._lock, self._connection() as db:
+            yield db
+
+    @contextmanager
+    def _connection(self) -> Any:
+        """Open a bounded writer transaction on a private disposable database."""
+        if not self._ready:
+            _protect(self.directory)
+        path = self.directory / "knowledge.sqlite3"
+        if path.is_symlink():
+            raise ValueError("Knowledge database must not be a link")
+        db = sqlite3.connect(path, timeout=0.5)
+        db.row_factory = sqlite3.Row
+        try:
+            if not self._ready:
+                self._wal(db)
+                db.executescript("""
+                    CREATE TABLE IF NOT EXISTS namespaces (
+                        ns TEXT PRIMARY KEY, epoch INTEGER NOT NULL DEFAULT 0,
+                        semantic_cache_enabled INTEGER NOT NULL DEFAULT 1,
+                        stats TEXT NOT NULL DEFAULT '{}');
+                    CREATE TABLE IF NOT EXISTS artifacts (
+                        ns TEXT NOT NULL, key TEXT NOT NULL, refs TEXT NOT NULL,
+                        summary TEXT NOT NULL, model TEXT NOT NULL,
+                        embedding TEXT NOT NULL, vector TEXT, created REAL NOT NULL,
+                        expires REAL NOT NULL, accessed REAL NOT NULL, bytes INTEGER NOT NULL,
+                        PRIMARY KEY(ns,key));
+                    CREATE TABLE IF NOT EXISTS leases (
+                        ns TEXT NOT NULL, key TEXT NOT NULL, epoch INTEGER NOT NULL,
+                        owner TEXT NOT NULL, until REAL NOT NULL, PRIMARY KEY(ns,key));
+                    CREATE INDEX IF NOT EXISTS artifact_access ON artifacts(accessed);
+                """)
+                self._ready = True
+            db.execute("BEGIN IMMEDIATE")
+            yield db
+            db.commit()
+        except BaseException:
+            db.rollback()
+            raise
+        finally:
+            db.close()
+
+    @staticmethod
+    def _wal(db: sqlite3.Connection) -> None:
+        """Bound retries for SQLite's non-waiting initial journal-mode upgrade."""
+        deadline = time.monotonic() + 0.5
+        while True:
+            try:
+                db.execute("PRAGMA journal_mode=WAL")
+                return  # noqa: TRY300
+            except sqlite3.OperationalError as exc:
+                if (
+                    getattr(exc, "sqlite_errorcode", 0)
+                    not in {sqlite3.SQLITE_BUSY, sqlite3.SQLITE_LOCKED}
+                    or time.monotonic() >= deadline
+                ):
+                    raise
+                time.sleep(0.025)
+
+    @staticmethod
+    def namespace(root: Path, assistant: str) -> str:
+        """Canonical workspace plus assistant identity is the sharing boundary."""
+        return digest(json.dumps([os.path.normcase(str(root.resolve())), assistant]))
+
+    @staticmethod
+    def _state(db: sqlite3.Connection, ns: str) -> sqlite3.Row:
+        db.execute("INSERT OR IGNORE INTO namespaces(ns) VALUES (?)", (ns,))
+        return db.execute("SELECT * FROM namespaces WHERE ns=?", (ns,)).fetchone()
+
+    def state(self, ns: str) -> dict:
+        """Read the immediately authoritative enable flag and epoch."""
+        with self.connection() as db:
+            return dict(self._state(db, ns))
+
+    def control(self, ns: str, action: str) -> dict:
+        """Clear/off fence old producers; each namespace retains its own toggle."""
+        with self.connection() as db:
+            self._state(db, ns)
+            if action in {"clear", "off"}:
+                db.execute("UPDATE namespaces SET epoch=epoch+1 WHERE ns=?", (ns,))
+                db.execute("DELETE FROM artifacts WHERE ns=?", (ns,))
+                db.execute("DELETE FROM leases WHERE ns=?", (ns,))
+            if action in {"on", "off"}:
+                db.execute(
+                    "UPDATE namespaces SET semantic_cache_enabled=? WHERE ns=?",
+                    (int(action == "on"), ns),
+                )
+            self._evict(db, ns)
+            state = self._state(db, ns)
+            stats = json.loads(state["stats"])
+            retained = db.execute(
+                "SELECT coalesce(sum(bytes),0) FROM artifacts WHERE ns=?", (ns,)
+            ).fetchone()[0]
+            return {
+                "semantic_cache_enabled": bool(state["semantic_cache_enabled"]),
+                "epoch": state["epoch"],
+                "retained_bytes": retained,
+                **stats,
+            }
+
+    def event(self, ns: str, name: str, value: float = 1) -> None:
+        """Persist only numeric accounting, never queries or source content."""
+        with self.connection() as db:
+            stats = json.loads(self._state(db, ns)["stats"])
+            stats[name] = stats.get(name, 0) + value
+            db.execute("UPDATE namespaces SET stats=? WHERE ns=?", (json.dumps(stats), ns))
+
+    def candidates(self, ns: str, model: str, key: str | None) -> list[dict]:
+        """Retrieve bounded metadata; callers must validate every returned source."""
+        with self.connection() as db:
+            self._evict(db, ns)
+            rows = db.execute(
+                "SELECT * FROM artifacts WHERE ns=? AND model=?" + (" AND key=?" if key else ""),  # noqa: S608 - fixed SQL suffix.
+                (ns, model, key) if key else (ns, model),
+            ).fetchall()
+            return [dict(row) for row in rows]
+
+    def touch(self, ns: str, key: str, epoch: int) -> bool:
+        """Validate the fence and update access after source validation."""
+        with self.connection() as db:
+            state = self._state(db, ns)
+            if state["epoch"] != epoch or not state["semantic_cache_enabled"]:
+                return False
+            return bool(
+                db.execute(
+                    "UPDATE artifacts SET accessed=? WHERE ns=? AND key=?",
+                    (self._access(db), ns, key),
+                ).rowcount
+            )
+
+    def invalidate(self, ns: str, key: str) -> None:
+        """Discard a source-invalid artifact."""
+        with self.connection() as db:
+            db.execute("DELETE FROM artifacts WHERE ns=? AND key=?", (ns, key))
+        self.event(ns, "invalidations")
+
+    def acquire(self, ns: str, key: str, epoch: int, owner: str) -> bool:
+        """Lease a single producer across processes, expiring crashed producers."""
+        with self.connection() as db:
+            state = self._state(db, ns)
+            if state["epoch"] != epoch or not state["semantic_cache_enabled"]:
+                return False
+            db.execute("DELETE FROM leases WHERE until<=?", (time.time(),))
+            return bool(
+                db.execute(
+                    "INSERT OR IGNORE INTO leases VALUES (?,?,?,?,?)",
+                    (ns, key, epoch, owner, time.time() + LEASE_SECONDS),
+                ).rowcount
+            )
+
+    def release(self, ns: str, key: str, owner: str) -> None:
+        """Release only this producer's lease, never a replacement lease."""
+        with self.connection() as db:
+            db.execute("DELETE FROM leases WHERE ns=? AND key=? AND owner=?", (ns, key, owner))
+
+    def publish(
+        self,
+        ns: str,
+        key: str,
+        epoch: int,
+        owner: str,
+        refs: str,
+        summary: str,
+        model: str,
+        embedding: str,
+        vector: list[float] | None,
+    ) -> bool:
+        """Commit only while both the namespace fence and producer lease match."""
+        payload = json.dumps(vector, allow_nan=False) if vector is not None else None
+        size = len((refs + summary + model + embedding + (payload or "")).encode())
+        with self.connection() as db:
+            state = self._state(db, ns)
+            lease = db.execute("SELECT * FROM leases WHERE ns=? AND key=?", (ns, key)).fetchone()
+            if (
+                state["epoch"] != epoch
+                or not state["semantic_cache_enabled"]
+                or not lease
+                or lease["owner"] != owner
+                or lease["until"] <= time.time()
+            ):
+                return False
+            now = time.time()
+            db.execute(
+                "INSERT OR REPLACE INTO artifacts VALUES (?,?,?,?,?,?,?,?,?,?,?)",
+                (
+                    ns,
+                    key,
+                    refs,
+                    summary,
+                    model,
+                    embedding,
+                    payload,
+                    now,
+                    now + TTL,
+                    self._access(db),
+                    size,
+                ),
+            )
+            self._evict(db, ns)
+            return True
+
+    @staticmethod
+    def _access(db: sqlite3.Connection) -> int:
+        """Order touches even when the platform clock repeats or moves backwards."""
+        previous = db.execute("SELECT coalesce(max(accessed),0) FROM artifacts").fetchone()[0]
+        return max(time.time_ns() // 1000, int(previous) + 1)
+
+    @staticmethod
+    def _evict(db: sqlite3.Connection, ns: str) -> None:
+        db.execute("DELETE FROM artifacts WHERE expires<=?", (time.time(),))
+        db.execute(
+            "DELETE FROM artifacts WHERE ns=? AND key IN "
+            "(SELECT key FROM artifacts WHERE ns=? ORDER BY accessed DESC LIMIT -1 OFFSET ?)",
+            (ns, ns, MAX_ARTIFACTS),
+        )
+        total = db.execute("SELECT coalesce(sum(bytes),0) FROM artifacts").fetchone()[0]
+        while total > MAX_PAYLOAD:
+            row = db.execute(
+                "SELECT ns,key,bytes FROM artifacts ORDER BY accessed LIMIT 1"
+            ).fetchone()
+            db.execute("DELETE FROM artifacts WHERE ns=? AND key=?", (row["ns"], row["key"]))
+            total -= row["bytes"]