fix: keep index cache on partial delete; bound unconnected sessions

- moss-vscode: discardedPreviousIndex was set *before* deleteInBatches, so a
  delete that threw partway still told the caller to drop the persisted cache.
  Some old documents would survive while the cache — the only record of their
  ids — was gone, leaving them answering searches for deleted or renamed files
  with no way for a later rebuild to find them. The flag now flips only after
  the stale delete has fully succeeded, so a partial delete keeps the cache and
  the next rebuild retries the cleanup.

- server.py: /api/offer accepted an SDP and started the pipeline immediately,
  with nothing to end a session whose client never completed the WebRTC/RTVI
  handshake — Whisper, Piper and Ollama stayed loaded until the transport
  noticed or the process exited. Added a watchdog that shuts the session down
  if on_client_ready has not fired within SESSION_HANDSHAKE_TIMEOUT_SECS
  (default 45s, generous against the frontend's own 30s connect timeout so a
  slow but genuine client is never cut off), cancelled once the session ends.
  Also bounded concurrency with MAX_ACTIVE_BOTS (default 2), checked before
  spawning so excess offers get a 503 rather than degrading live sessions.
  Both documented in the README table and .env.example.

Verified: the delete-flag placement across partial-delete, delete-then-throw
and success — only flag-after avoids stranding documents; and the watchdog for
a client that never connects vs ready at 0.1s and 0.35s, plus the capacity gate
at the boundary.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: samanyugoyal2010

apps/moss-interview-coach/README.md

@@ -85,6 +85,8 @@ Open [http://localhost:3000](http://localhost:3000) → pick a track (**System D
 | `WHISPER_DEVICE` | no | `auto` |
 | `PIPER_VOICE` | no | `en_US-lessac-medium` |
 | `GRADE_SUBPROCESS_TIMEOUT_SECS` | no | `60` |
+| `SESSION_HANDSHAKE_TIMEOUT_SECS` | no | `45` — ends a session whose client never completes the WebRTC/RTVI handshake |
+| `MAX_ACTIVE_BOTS` | no | `2` — further offers get 503 until a slot frees |
 | `BACKEND_HOST` | no | `127.0.0.1` |
 | `BACKEND_PORT` | no | `8000` |
 | `BACKEND_RELOAD` | no | unset — uvicorn autoreload off; set `1` for development only |

apps/moss-interview-coach/backend/.env.example

@@ -21,6 +21,11 @@ PIPER_VOICE=en_US-lessac-medium
 
 # Grader subprocess
 GRADE_SUBPROCESS_TIMEOUT_SECS=60
+# Ends a session whose client never finishes the WebRTC/RTVI handshake, so a
+# dropped offer cannot hold Whisper/Piper/Ollama open.
+SESSION_HANDSHAKE_TIMEOUT_SECS=45
+# Concurrent interviews. Each loads its own STT/TTS and shares one Ollama.
+MAX_ACTIVE_BOTS=2
 
 # Backend
 # Loopback by default: /api/offer is unauthenticated, and each call spins up

apps/moss-interview-coach/backend/server.py

@@ -82,6 +82,11 @@
 PIPER_VOICE = os.getenv("PIPER_VOICE", "en_US-lessac-medium")
 GRADER_WORKER_PATH = Path(__file__).resolve().parent / "grader_worker.py"
 GRADE_SUBPROCESS_TIMEOUT_SECS = float(os.getenv("GRADE_SUBPROCESS_TIMEOUT_SECS", "60"))
+# Generous relative to the frontend's own 30s connect timeout, so a slow but
+# genuine client is never cut off — this only catches offers that go nowhere.
+SESSION_HANDSHAKE_TIMEOUT_SECS = float(os.getenv("SESSION_HANDSHAKE_TIMEOUT_SECS", "45"))
+# Each session loads Whisper/Piper and drives Ollama, so concurrency is bounded.
+MAX_ACTIVE_BOTS = int(os.getenv("MAX_ACTIVE_BOTS", "2"))
 
 COACH_BEHAVIOR = (
     "Conduct a live voice interview. Ask probing follow-ups, push for trade-offs, "
@@ -845,9 +850,11 @@ async def on_client_connected(transport: SmallWebRTCTransport, client: Any) -> N
         # PipelineWorker enables RTVI by default and add_event_handler appends,
         # so this runs alongside pipecat's own set_bot_ready() handler.
         greeted = False
+        client_ready = asyncio.Event()
 
         @worker.rtvi.event_handler("on_client_ready")
         async def on_client_ready(rtvi: Any) -> None:
+            client_ready.set()
             # A client that re-sends ready (reconnect) must not replay the
             # welcome over an interview already in progress.
             nonlocal greeted
@@ -893,8 +900,34 @@ async def on_client_disconnected(transport: SmallWebRTCTransport, client: Any) -
         # signal handling; the worker is still torn down from
         # on_client_disconnected above.
         runner = WorkerRunner(handle_sigint=False, handle_sigterm=False)
-        await runner.add_workers(worker)
-        await runner.run()
+
+        async def _handshake_watchdog(current: ActiveSession) -> None:
+            """Tear the session down if the client never finishes connecting.
+
+            /api/offer accepts an SDP and starts the pipeline immediately, so a
+            caller that never completes the WebRTC/RTVI handshake would leave
+            Whisper, Piper and Ollama loaded until the transport happened to
+            notice or the process exited.
+            """
+            try:
+                await asyncio.wait_for(
+                    client_ready.wait(), timeout=SESSION_HANDSHAKE_TIMEOUT_SECS
+                )
+            except asyncio.TimeoutError:
+                logger.warning(
+                    f"No client handshake within {SESSION_HANDSHAKE_TIMEOUT_SECS:.0f}s "
+                    f"(track={track_id}); ending session."
+                )
+                await current.shutdown()
+
+        watchdog = asyncio.create_task(_handshake_watchdog(session))
+        try:
+            await runner.add_workers(worker)
+            await runner.run()
+        finally:
+            watchdog.cancel()
+            with suppress(asyncio.CancelledError):
+                await watchdog
     finally:
         if session is not None:
             active_sessions.discard(session)
@@ -1094,6 +1127,16 @@ async def offer(request: Request) -> dict[str, Any]:
             status_code=503,
             detail=f"Grader worker missing at {GRADER_WORKER_PATH.name}.",
         )
+    # Refuse before spawning: every session loads Whisper/Piper and competes for
+    # the same local Ollama, so unbounded offers would degrade the live ones.
+    if active_bots >= MAX_ACTIVE_BOTS:
+        raise HTTPException(
+            status_code=503,
+            detail=(
+                f"At capacity: {active_bots} interview(s) already running "
+                f"(MAX_ACTIVE_BOTS={MAX_ACTIVE_BOTS}). Try again shortly."
+            ),
+        )
 
     body = await _json_object_body(request)
 

apps/moss-vscode/src/indexer/indexer.ts

@@ -122,14 +122,20 @@ export class CodebaseIndexer {
           staleIds.push(`${rel}#chunk-${i}`);
         }
       }
-      // Past this point the previous index is being destroyed, so any exit that
-      // is not "ready" leaves the persisted cache describing documents that no
-      // longer exist. A failure *before* here (scan, session setup) leaves the
-      // old documents intact, and the cache with them.
-      this.discardedPreviousIndex = true;
       if (staleIds.length) {
         await this.deleteInBatches(staleIds);
       }
+      // Only once the stale delete has fully succeeded. If it throws partway,
+      // some old documents survive — and the persisted cache is the only record
+      // of their ids, so it must be kept for a later rebuild to retry the
+      // cleanup. Clearing it there would strand those documents in the index
+      // permanently, still answering searches for deleted or renamed files.
+      //
+      // From here on the previous index really is gone, so any exit that is not
+      // "ready" must invalidate the cache. A failure before this point (scan,
+      // session setup, a partial delete) leaves the old documents intact and
+      // the cache with them.
+      this.discardedPreviousIndex = true;
       this.pathChunkCounts.clear();
 
       let processed = 0;