fix: prevent daemon CLI timeouts on slow storage (#518)

Slow NAS storage could outlast fixed daemon client and server deadlines, causing CLI, TUI, MCP, statistics, and backup requests to fail while useful work was still progressing. These daemon-backed operations now wait for completion or caller cancellation, while discovery, connection setup, browser traffic, and ordinary API clients retain protective bounds.

Generated NAS Compose bundles now reconcile the moving GHCR `latest` image with `pull_policy: always`. Operators can update with `docker compose up -d`; existing bundles should be regenerated, edited to add the policy, or updated explicitly with `docker compose pull` followed by `docker compose up -d`. A restart alone continues to reuse the installed image.

Validation: `go vet -tags "fts5 sqlite_vec" ./...`, `make test`, and `make lint`.

Co-authored-by: Wes McKinney <wesm@users.noreply.github.com>

Author: wesm

.github/workflows/docker-pr.yml

@@ -1,8 +1,7 @@
 name: Docker
 
-# The PR dispatcher always calls the main-pinned workflow. That workflow
-# independently routes same-repository Linux jobs to the managed public fleet
-# and fork jobs to GitHub-hosted runners.
+# Build and smoke-test the PR image without registry credentials. Keep this
+# branch-defined workflow on a GitHub-hosted runner.
 on:
   pull_request:
     paths:
@@ -22,5 +21,49 @@ on:
 permissions: read-all
 
 jobs:
-  run:
-    uses: kenn-io/msgvault/.github/workflows/docker.yml@main
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - name: Build browser application
+        run: make web-assets-check
+
+      - name: Build amd64 image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: msgvault:test
+          build-args: |
+            VERSION=test
+            COMMIT=${{ github.sha }}
+            BUILD_DATE=test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Smoke test (amd64)
+        run: |
+          docker run --rm msgvault:test version
+          docker run --rm msgvault:test --help
+
+          tmpdir="$(mktemp -d)"
+          trap 'sudo rm -rf "$tmpdir"' EXIT
+          sudo chown 1000:1000 "$tmpdir"
+          docker run --rm -v "$tmpdir:/data" msgvault:test init-db
+          sudo test -f "$tmpdir/msgvault.db" || { sudo ls -la "$tmpdir"; echo "FATAL: database not created"; exit 1; }
+
+          # Runtime is binary-only: no frontend toolchain or external asset tree.
+          docker run --rm --entrypoint sh msgvault:test -c \
+            'test ! -e /usr/local/bin/bun && test ! -e /usr/local/bin/node && test ! -d /usr/share/msgvault/web'

.github/workflows/docker.yml

@@ -1,7 +1,6 @@
 name: Docker
 
 on:
-  workflow_call:
   push:
     branches: [main]
     tags:
@@ -11,61 +10,9 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  # PR validation: build and smoke-test only, no registry access
-  validate:
-    if: github.event_name == 'pull_request'
-    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.3.14
-
-      - name: Build browser application
-        run: make web-assets-check
-
-      - name: Build amd64 image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          platforms: linux/amd64
-          push: false
-          load: true
-          tags: msgvault:test
-          build-args: |
-            VERSION=test
-            COMMIT=${{ github.sha }}
-            BUILD_DATE=test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Smoke test (amd64)
-        run: |
-          docker run --rm msgvault:test version
-          docker run --rm msgvault:test --help
-
-          tmpdir="$(mktemp -d)"
-          trap 'sudo rm -rf "$tmpdir"' EXIT
-          sudo chown 1000:1000 "$tmpdir"
-          docker run --rm -v "$tmpdir:/data" msgvault:test init-db
-          sudo test -f "$tmpdir/msgvault.db" || { sudo ls -la "$tmpdir"; echo "FATAL: database not created"; exit 1; }
-
-          # Runtime is binary-only: no frontend toolchain or external asset tree.
-          docker run --rm --entrypoint sh msgvault:test -c \
-            'test ! -e /usr/local/bin/bun && test ! -e /usr/local/bin/node && test ! -d /usr/share/msgvault/web'
-
   # Publish: build multi-arch and push to GHCR (main/tags only)
   publish:
-    if: github.event_name != 'pull_request'
-    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && github.ref == 'refs/heads/main' && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     permissions:
       contents: read
       packages: write

cmd/msgvault/cmd/backup.go

@@ -475,7 +475,7 @@ func runBackupCreateLocal(cmd *cobra.Command) error {
 	}
 	defer func() { _ = blobs.Close() }()
 
-	freezer, closeFreezer, err := newBackupFreezer()
+	freezer, closeFreezer, err := newBackupFreezer(cmd.Context())
 	if err != nil {
 		return err
 	}
@@ -533,13 +533,16 @@ func runBackupCreateLocal(cmd *cobra.Command) error {
 // freezeViaDaemon coordinator over it. backup create must never scan a
 // live-daemon-owned SQLite file unfrozen, so a daemon that cannot be
 // resolved here is a hard failure rather than a silent unfrozen fallback.
-func newBackupFreezer() (backup.FreezeCoordinator, func(), error) {
+func newBackupFreezer(ctx context.Context) (backup.FreezeCoordinator, func(), error) {
 	rt := findDaemonRuntime(cfg.Data.DataDir)
 	if rt == nil {
 		return nil, func() {}, errors.New(
 			"backup create: no running msgvault daemon found; refusing to back up an unfrozen archive")
 	}
-	client, err := daemonclient.New(daemonclient.Config{
+	// Begin and End deliberately use separate per-call contexts. Keep command
+	// values on the client root without letting command cancellation poison the
+	// cleanup request that releases an already-open freeze window.
+	client, err := newDaemonCLIClient(context.WithoutCancel(ctx), daemonclient.Config{
 		URL:           urlFromDaemonRuntime(rt),
 		APIKey:        cfg.Server.APIKey,
 		AllowInsecure: true,

cmd/msgvault/cmd/backup_daemon_test.go

@@ -0,0 +1,121 @@
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.kenn.io/kit/daemon"
+	"go.kenn.io/msgvault/internal/apiprotocol"
+	"go.kenn.io/msgvault/pkg/client/generated"
+)
+
+func TestNewBackupFreezerUsesCommandContextAndCLIMode(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+	var marker atomic.Value
+	requestCanceled := make(chan struct{})
+	mux := http.NewServeMux()
+	mux.Handle("/api/ping", daemon.NewPingHandler(daemon.PingHandlerOptions{
+		Service: daemonService,
+		Version: Version,
+	}))
+	mux.HandleFunc("/api/v1/backup/freeze/begin", func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal("/api/v1/backup/freeze/begin", r.URL.Path)
+		marker.Store(r.Header.Get(apiprotocol.ClientClassHeader))
+		<-r.Context().Done()
+		close(requestCanceled)
+	})
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+
+	dataDir := t.TempDir()
+	withStoreResolverConfig(t, lifecycleTestConfig(dataDir))
+	rt := daemonRuntimeForHTTPServer(t, srv, daemonAPIKeyFingerprint(""))
+	_, err := daemonRuntimeStore(dataDir).Write(rt.Record)
+	require.NoError(err, "write daemon runtime")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	freezer, closeFreezer, err := newBackupFreezer(ctx)
+	require.NoError(err, "newBackupFreezer")
+	t.Cleanup(closeFreezer)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- freezer.Begin(ctx)
+	}()
+	require.Eventually(func() bool {
+		return marker.Load() != nil
+	}, 2*time.Second, 10*time.Millisecond, "freeze request starts")
+	cancel()
+
+	require.Eventually(func() bool {
+		select {
+		case <-requestCanceled:
+			return true
+		default:
+			return false
+		}
+	}, 2*time.Second, 10*time.Millisecond)
+	assert.Equal(apiprotocol.ClientClassCLI, marker.Load())
+	require.Error(<-done, "freeze request canceled")
+}
+
+func TestNewBackupFreezerEndsFreezeAfterCommandCancellation(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+	var beginMarker atomic.Value
+	var endMarker atomic.Value
+
+	mux := http.NewServeMux()
+	mux.Handle("/api/ping", daemon.NewPingHandler(daemon.PingHandlerOptions{
+		Service: daemonService,
+		Version: Version,
+	}))
+	mux.HandleFunc("/api/v1/backup/freeze/begin", func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(http.MethodPost, r.Method)
+		beginMarker.Store(r.Header.Get(apiprotocol.ClientClassHeader))
+		w.Header().Set("Content-Type", "application/json")
+		assert.NoError(json.NewEncoder(w).Encode(generated.BackupFreezeBeginResponse{
+			Token: "freeze-token",
+		}))
+	})
+	mux.HandleFunc("/api/v1/backup/freeze/end", func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(http.MethodPost, r.Method)
+		endMarker.Store(r.Header.Get(apiprotocol.ClientClassHeader))
+		var request generated.BackupFreezeEndRequest
+		assert.NoError(json.NewDecoder(r.Body).Decode(&request))
+		assert.Equal("freeze-token", request.Token)
+		w.Header().Set("Content-Type", "application/json")
+		_, err := w.Write([]byte(`{}`))
+		assert.NoError(err)
+	})
+	srv := httptest.NewServer(mux)
+	t.Cleanup(srv.Close)
+
+	dataDir := t.TempDir()
+	withStoreResolverConfig(t, lifecycleTestConfig(dataDir))
+	rt := daemonRuntimeForHTTPServer(t, srv, daemonAPIKeyFingerprint(""))
+	_, err := daemonRuntimeStore(dataDir).Write(rt.Record)
+	require.NoError(err, "write daemon runtime")
+
+	commandCtx, cancelCommand := context.WithCancel(context.Background())
+	freezer, closeFreezer, err := newBackupFreezer(commandCtx)
+	require.NoError(err, "newBackupFreezer")
+	t.Cleanup(closeFreezer)
+
+	require.NoError(freezer.Begin(commandCtx), "begin freeze")
+	cancelCommand()
+
+	cleanupCtx, cancelCleanup := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancelCleanup()
+	require.NoError(freezer.End(cleanupCtx), "end freeze after command cancellation")
+	assert.Equal(apiprotocol.ClientClassCLI, beginMarker.Load())
+	assert.Equal(apiprotocol.ClientClassCLI, endMarker.Load())
+}