* fix(config): report settings persistence failures (#220)
Settings saves now go through one serialized config store
(py/config_store.py). A commit re-reads config.json under a process
lock, applies the change to a copy and replaces the file atomically
(temp file beside it, fsync, close, os.replace), so a failed write
leaves the old file in place.
POST /prompt_manager/settings commits first and only then publishes
the values at runtime. A write failure is 500 config-write-failed, an
unparseable config.json is 409 config-unreadable (the file is kept
instead of replaced) and a stale expected_revision is 409
settings-changed. A save reports persisted, revision, runtime_applied
and restart_required_fields; GET adds the revision. Only submitted keys
are written; other sections and the CivitAI key are kept.
* fix(lora): report integration save failures (#220)
POST /prompt_manager/lora/enable commits integrations.lora_manager
through the config store and publishes the runtime values only after
config.json holds them. Before, it set the runtime values, rewrote the
whole runtime config (dropping sections it did not know) and reported
success even when the write had failed.
A write failure is 500 config-write-failed and changes nothing at
runtime; an unparseable config.json is 409 config-unreadable. The
body goes through the capped JSON reader and the flags must be
booleans. A trigger word cache that fails to load is reported as
persisted:true, cache_loaded:false. The CivitAI key is never echoed.
The LoRA tests now write to a temporary config path.
* fix(jobs): refuse legacy record-changing operations while a job runs
The job registry gains admission classes. A records job is refused
while any records or guarded job runs, a guarded job while a records
job runs, and read jobs share only the one-job-per-kind rule.
record_changing=True stays as the spelling of records. Job summaries
add cancellable and admission, and a non-cancellable job ignores
cancel.
JobRegistry.hold() registers a running, non-cancellable job for a
legacy-page operation and ends it when the request does. The legacy
restore, maintenance, prompt cleanup, duplicate image delete, LoRA
import and batch auto-tag routes hold as records; thumbnail generation
(both routes) and thumbnail clear hold as guarded. A maintenance run
of only read checks holds as read. So a restore during a scan, or a
scan during a legacy restore, is refused with the running job named
instead of interleaving; this closes the gap noted on #269.
Refusals keep each route's shape: the JSON routes return the legacy
409 "<title> already running", and the thumbnail and LoRA streams
send their existing error event.
* test(lora): keep the preserved-section fixture free of secret values
CodeQL flagged the fixture that writes the secret constant into a test
config file as clear-text storage. The test only needs a marker value
to prove the stored key survives a save.
* fix(config): read under the commit lock and publish saves in write order
- ConfigStore.read takes the commit lock, so no read handle is open while
config.json is replaced (Windows refuses that replace).
- os.replace is retried briefly on a Windows PermissionError (antivirus or
indexer handles) before the save is reported as not written.
- The temp file is written beside realpath(config.json), so a symlinked
config keeps its link and a bind mount fails truthfully.
- commit() takes a publish callback that runs under the lock after the
write; settings and LoRA saves publish there, so two concurrent saves
reach the runtime in write order and the runtime ends on the last one.
- The concurrency tests now wait until the second caller is blocked on the
lock (tests/lock_probe.py) before releasing the first.
* fix(jobs): require an admission class, admit holds on entry, true Activity states
- JobRegistry.start raises TypeError when neither admission nor
record_changing is given, so a new job never runs as "read" beside a
scan by omission.
- hold() admits when its block is entered, so a hold that is never entered
leaves no running records job behind; callers that answer a refusal in
their own way check blocker() first, with no await before the block.
- A held SSE operation that ends in an error event (thumbnail generation,
legacy batch auto-tag) is listed as failed, and refused input (duplicate
delete without paths, an unreadable thumbnail body) is answered before
the hold, so it is not listed as a job.
- Activity keeps a job's cancellable flag (true when an older server omits
it) and shows Cancel only for a running, cancellable job, in Recent work
and in the job view. A held legacy job no longer offers a Cancel that
does nothing.
* fix(admin): legacy pages show why a request was refused
A job running in the workspace refuses the legacy record-changing requests,
and a corrupt config.json refuses a settings save. The legacy pages now
name the reason instead of hiding it:
- LoRA import: the busy and failure frames carry status and progress, and
the admin modal handles type "error": it shows the message, notifies and
closes, instead of staying on "Initializing..." at 0%.
- Legacy batch auto-tag: a refusal by another job is a 200 stream with one
error frame ({type, status, message}), which both pages already render;
a second batch keeps its exact JSON 409.
- Gallery cache clear: a refused server clear shows the reason and stops
before the success toast and the "Not generated" reset.
- Admin settings save and maintenance show the reply's error ("config.json
cannot be read...", "Scan for metadata already running") instead of
"Failed to save settings" or "HTTP 409: Conflict".
- Tests cover the read-only /maintenance branch: a read-only selection runs
during a scan as a read hold; a mixed or default selection is refused.
* refactor(api): move the settings routes out of admin.py
GET and POST /prompt_manager/settings, their validation, the config commit
and runtime publication, and the shared commit-failure reply now live in
py/api/settings_routes.py as SettingsRoutesMixin, before S3 adds host
fields there. No behaviour change: the same routes, payloads and status
codes; admin.py drops about 300 lines.
* chore(coverage): raise the floors of the frontend files this round touched
admin.js, gallery.js, activity.mjs and activity-job-view.mjs, to their
measured coverage. No floor is lowered.
* fix(admin): the gallery starts no thumbnail status read while it leaves
The gallery's startup thumbnail check runs one second after load. When that
second ended while the page was leaving (CI, WebKit: the workflow test
navigates from the gallery to the admin page), WebKit failed the new read
with "Fetch API cannot load ... due to access control checks." and
Playwright reported a page error.
Like the admin page (#290), the gallery now has a page lifetime that ends
on beforeunload and pagehide (and starts again on a back/forward restore).
The check starts no read once it has ended and passes it as the read's
signal. A page-clock workflow test that leaves before the second ends
failed on both events, in Chromium and WebKit, before this change.
Vito
3b1d00501f