| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
docs: refine multilingual documentation copy | 6 个月前 | |
feat: complete async service migration and production acceptance | 29 天前 | |
docs: refine multilingual documentation copy | 6 个月前 | |
feat: complete async service migration and production acceptance | 29 天前 | |
docs: reorganize markdown into multilingual folders | 6 个月前 | |
feat: complete async service migration and production acceptance | 29 天前 | |
feat(ui): refresh dashboard and desktop project launcher | 2 个月前 | |
fix(codex): preserve auth for gateway and aggregate profiles | 3 天前 | |
docs: refine multilingual documentation copy | 6 个月前 | |
docs: refine multilingual documentation copy | 6 个月前 | |
feat: complete async service migration and production acceptance | 29 天前 | |
feat(requestlog): move payload capture onto a bounded background write queue (#496) * feat(core): add request payload group commit and spill segment primitives Building blocks for moving request payload logging off the gateway hot path. Nothing in the service calls them yet. - request_log_spill: queue memory budget from min(physical memory, cgroup limit) / 32 clamped to 32 MiB..1 GiB, overridable with CODEXMANAGER_REQUEST_LOG_PAYLOAD_QUEUE_MAX_BYTES; CRC32-framed segment records with torn-tail and corruption detection; segment store and reader with an exclusive .lock, 64 MiB rollover, periodic sync_data, clear boundaries (roll / purge_before) and retried deletes; the memory/spill ordering state machine - Storage::write_request_log_payload_batch: one write transaction with a savepoint per job. The batched writes reuse the in-transaction generation and retention checks of the *_if_current APIs, whose public signatures and behaviour are unchanged - is_sqlite_busy_error to tell busy/locked from real failures * feat(core): let spill records carry a redacted body with original digests A spilled job that asks for redaction must not reach the disk as the raw request. SpillRecordMeta gains an optional SpillOriginalDigests block (SHA-256 and length of the original body, SHA-256 of the attempt's wire bytes) so the spill thread can write a redacted copy while the stored hashes and sizes still describe what was received and sent. A record with these digests never carries a wire body, and decoding rejects one that does. * feat(requestlog): move payload capture onto a bounded background write queue Request payload logging can no longer affect receiving or forwarding. The capture hot path only shares the request Bytes, snapshots an in-memory clear generation and enqueues under a short IO-free lock. It never touches SQLite, the storage pool or files, never spawns threads, logs, blocks or returns errors, and catches panics. - a preprocessing pool (redaction, 16 KB preview, splitting, hashing) feeds a single writer that group-commits up to 64 jobs / 8 MiB / 50 ms per transaction in capture order - jobs over the memory budget spill to <db dir>/request-log-spill in capture order and are replayed once the in-memory queue drains or after a restart; when free disk runs low a job is dropped and counted by reason - a busy database or unavailable storage keeps the batch and retries with backoff instead of dropping it; the writer and spill threads are supervised and restarted after a panic, releasing their accounting - clears are guarded: jobs captured before a clear are discarded from the queue, the hand-off and the spill files, jobs captured while it runs are kept, and the database still rejects stale generations - zero-copy client capture shared with local validation; upstream WebSocket frames shared with the send - admin-only requestlog/payload_queue_stats RPC with per-reason drop counters and per-trace drop reasons - document CODEXMANAGER_REQUEST_LOG_PAYLOAD_QUEUE_MAX_BYTES * feat(requestlog): show unrecorded request payloads in the logs page - Tauri command and Web mapping for requestlog/payload_queue_stats - admins see a notice with per-reason counts when payloads were not recorded (disk full, slow disk, IO error, writer unavailable, spill directory locked), refreshed every 30 s - the detail dialog explains why a payload is missing: dropped, or rejected by a clear or the retention window - en/ko/ru translations * test(requestlog): size payload queue test jobs to the budgets they exercise Three pipeline tests used a queue budget equal to one small job and broke on the queue's own limits rather than on the behaviour under test: - the job submitted after the spill-thread restart had a longer trace id than the budget job, so it exceeded the budget and spilled - the hold test's post-clear job did not fit in the hand-off area next to the held pre-clear job (half the queue budget) and was dropped as disk_slow; the first job is now large enough, and the test accepts that the gated writer may already hold the first pre-clear job, which the database then rejects instead of the purge discarding it - the late-install test's second job was dropped as disk_slow while the first was still in the hand-off area; the budget now fits both, so they spill only because of the leftover segment * fix(requestlog): redact spilled payloads before they reach the disk Jobs over the memory budget were appended to request-log-spill/ as the raw request body plus the separate wire body, and only redacted later by the writer. With redaction on (the default), credentials such as authorization, token or api_key fields therefore sat in plaintext in the segment files until replay. The spill thread now redacts a job that asks for redaction before appending it, producing exactly what the database path would store, and keeps only digests of the original body and wire bytes next to it. The wire body of such a job is never written. On replay the stored body hash, size and wire digest come from those digests, so the rows are identical to writing the job directly. Add a pipeline regression that spills redacting jobs with a separate wire body, checks the segment files and the replayed rows for leaks and digests, and a unit test that the redacted copy preprocesses exactly like the original body for JSON objects, root arrays, plain text and non-UTF-8 bodies in both storage modes. | 12 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 6 个月前 | ||
| 29 天前 | ||
| 6 个月前 | ||
| 29 天前 | ||
| 6 个月前 | ||
| 29 天前 | ||
| 2 个月前 | ||
| 3 天前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 29 天前 | ||
| 12 天前 |