Conversation
…est#310) Runtime artifacts (agent workspaces, tool-output spill, C2 payloads, chat uploads, workflow checkpoints, diagnostic logs) previously accumulated without bound: most were only removed when a conversation or project was deleted, and tmp/c2 plus workflow checkpoints were never removed at all. Add a storage cleaner with named per-category tasks (Gitea-style), a settings page tab, and a background sweep that is off by default so upgrading never deletes existing data. Safety properties, since mis-deleting live task data costs far more than the disk saved: - dry-run is the default; a real cleanup requires dry_run=false together with confirm=true at the API layer, not just a frontend dialog - sessions active within active_grace_hours are always skipped, and a failed activity lookup skips conservatively (fail closed) - directories whose conversation/project no longer exists are reclaimed as orphans after orphan_grace_days - scanners never follow symlinks and every candidate path is confined to its category root; deletion renames to a .tmp-for-deletion marker first so a crash leaves recoverable residue instead of a half-deleted dir - storage:* permissions are admin-only; without the grantSystemRolePermissions skip the default branch would have given operators an irreversible file-deletion right Also fix two confirmed leaks: DeleteConversation left chat_uploads files on disk (their rows already vanished via ON DELETE CASCADE), and workflow checkpoints had no deletion path at all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联
Closes #310（增加清理运行空间垃圾的功能，可以释放无用的存储空间）
背景
运行期间产生的磁盘产物此前基本无界增长：多数只在删除会话/项目时才清理，
tmp/c2（回传截图、上传件、下发文件、payload）与data/workflow-checkpoints则从未被删除。本 PR 将其纳入统一的保留策略与清理入口。改动
新增
internal/storage包（Gitea 式具名清理任务 + Prometheus 式标记后原子清扫）：workspacetmp/workspacereductiontmp/reductionconversation_artifactsdata/conversation_artifactsplantaskskills/.eino/plantaskc2_artifactstmp/c2chat_uploadschat_uploadsworkflow_checkpointsdata/workflow-checkpointsdiagnostic_logslog/diagnostic-*.logstorage:（沿用本项目*int + Effective()惯例）；auto_clean默认关闭，与 ArgottlStrategy/ K8sttlSecondsAfterFinished的 unset 语义一致，升级不会在管理员不知情时删除既有数据GET /api/storage/meta、GET /api/storage/status（statfs用f_bavail并暴露 inode）、POST /api/storage/cleanupstorage:read/storage:write权限，仅授予 admin安全约束（误删活跃任务数据的代价远高于省下磁盘）
dry_run按预览处理；真实删除必须同时传dry_run=false与confirm=true，确认是 API 层显式动作而非仅前端弹窗active_grace_hours内有活动的会话一律跳过；活跃状态查询失败时保守跳过（fail closed）orphan_grace_days后回收.tmp-for-deletion再RemoveAll，崩溃只留下可补删的残骸顺带修复两个确定的泄漏
DeleteConversation漏删chat_uploads/：其chat_upload_artifacts行已由ON DELETE CASCADE清除，磁盘文件却永久残留（该目录比其他产物多一层日期目录，无法复用既有清理函数）data/workflow-checkpoints/*.ckpt此前无任何删除路径；checkpoint 生命周期由 Eino 持有、仓库内无干净终态钩子，故采用按龄保留（7 天）而非即时删除，避免破坏 resume 能力验证
go test ./internal/...与go vet ./...全绿skipped_active与新造文件精确对应）、confirm缺失 400、未知类别（含../穿越尝试）400、审计落库、config.yaml注释保留且未注册类别键被拒写storage:*说明
workflow_checkpoints未做即时删除（见上），如维护者希望运行结束即删，可在后续 PR 中于 Eino 终态钩子处调用.upgrade-backup/未纳入清理：属回滚归档而非运行垃圾，误删影响升级回退