mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 04:02:18 +01:00
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - A hosted instance keeps its data in Postgres, and it reaches that
database through a connection pooler
> - A pooler recycles the server side of a connection that sat idle. The
client still holds the socket and believes it is open
> - The next query fails while the driver writes it to that dead socket,
with `write CONNECTION_CLOSED host:5432`
> - The request that happened to draw the recycled connection fails,
although nothing is wrong with the query or the database
> - Only one code path guards against this today, so the same error
keeps reaching users and error reporting from every other path
> - This pull request replays a query when the write itself failed,
because those bytes never reached the server
> - The benefit is that a recycled connection costs one retry instead of
one failed request
## Linked Issues or Issue Description
No existing issue. The problem, in the bug report format:
**What happened**
Requests fail with `write CONNECTION_CLOSED <host>:5432` (driver code
`CONNECTION_CLOSED`). It is most visible on the first queries after an
idle period, when the pool holds connections the pooler already
recycled.
**Expected behavior**
A connection that the pooler recycled while it was idle is not a
user-visible failure. The client notices the dead socket and uses a live
connection.
**Steps to reproduce**
1. Run the server against a pooled Postgres endpoint (for example a Neon
`-pooler` host).
2. Leave the instance idle until the pooler recycles the server side of
the pooled connections.
3. Issue any request that queries the database.
**Paperclip version or commit**
Present on master.
## What Changed
- `packages/db/src/transient-write-retry.ts` (new) wraps the root
`postgres.js` client. When a query fails while the driver writes it to
the socket, the wrapper runs it again on a fresh connection. Three
attempts, 50 ms then 100 ms backoff.
- `packages/db/src/client.ts` gives Drizzle the wrapped client. The
teardown registry keeps the real client, because shutdown must end the
actual pool.
- The wrapper is deliberately narrow:
- It matches only the write phase (`code === "CONNECTION_CLOSED"` and a
message that starts with `write CONNECTION_CLOSED`). The write failed,
so the server never saw the query, and a replay cannot run anything
twice. That makes it safe for reads and writes alike.
- An error after the write propagates untouched, because the server may
have acted on the query.
- `CONNECTION_ENDED` and `CONNECTION_DESTROYED` propagate untouched,
because they mean a deliberate shutdown.
- Queries inside `db.transaction()` run on the scoped client that
`sql.begin()` returns, which the wrapper does not touch. A transaction
that loses its connection must abort, not replay.
- A query runs once however many handlers attach to it, and it still
executes lazily, like `postgres.js` itself.
## Verification
```
npx vitest run packages/db/src/transient-write-retry.test.ts # 7 passed
npx vitest run packages/db/src/client-teardown-registry.test.ts \
packages/db/src/client-options.test.ts # existing db suites pass
npx vitest run server/src/__tests__/cloud-tenant-transient-db-retry.test.ts # 6 passed
cd packages/db && npx tsc --noEmit # clean
```
New tests cover the replay, the `.values()` form Drizzle uses, the
attempt budget, an error that must not replay, and one execution per
pending query. A Drizzle round trip runs through a fake wire-protocol
server, which shows the wrapper is transparent to ordinary queries.
## Risks
Low risk.
- The retry only fires for a failure during the socket write, where the
server never received the query. A replay therefore cannot duplicate an
effect.
- A permanently unreachable database costs two extra attempts and 150 ms
before the same error surfaces.
- Transactions keep exactly their current behavior.
- Existing `retryOnTransientDbConnectionError` in the auth middleware
stays. It wraps a broader set of codes for one path, and it is
unaffected.
- No migration. No configuration change. No API change.
## Model Used
- Claude Fable 5 (`claude-fable-5`), 1M context, extended thinking, run
through Claude Code with tool use and code execution.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] I have updated relevant documentation to reflect my changes — no
documented behavior or configuration changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green — pending first run
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups —
pending first review
- [x] I will address all Greptile and reviewer comments before
requesting merge
192 lines
7.8 KiB
TypeScript
192 lines
7.8 KiB
TypeScript
import net from "node:net";
|
|
import { sql as drizzleSql } from "drizzle-orm";
|
|
import { afterEach, describe, expect, it } from "vitest";
|
|
import type { Sql } from "postgres";
|
|
import { closeRegisteredClients, createDb } from "./client.js";
|
|
import { isTransientWritePhaseError, withTransientWriteRetry } from "./transient-write-retry.js";
|
|
|
|
/** The exact shape postgres.js raises when the socket write fails. */
|
|
function writeClosedError(): Error {
|
|
const error = new Error("write CONNECTION_CLOSED db.example.internal:5432");
|
|
(error as Error & { code: string }).code = "CONNECTION_CLOSED";
|
|
return error;
|
|
}
|
|
|
|
/** A stub standing in for the root postgres.js client's `unsafe` surface. */
|
|
function stubSql(behavior: { failures: number; error?: () => Error }) {
|
|
let calls = 0;
|
|
const state = {
|
|
get calls() {
|
|
return calls;
|
|
},
|
|
};
|
|
const unsafe = (_query: string, _parameters?: unknown[]) => {
|
|
calls += 1;
|
|
const attempt = calls;
|
|
const shouldFail = attempt <= behavior.failures;
|
|
const outcome = () =>
|
|
shouldFail
|
|
? Promise.reject((behavior.error ?? writeClosedError)())
|
|
: Promise.resolve([{ attempt }]);
|
|
return {
|
|
then: (onFulfilled?: ((value: unknown) => unknown) | null, onRejected?: ((reason: unknown) => unknown) | null) =>
|
|
outcome().then(onFulfilled, onRejected),
|
|
values: () => outcome().then(() => [[attempt]]),
|
|
};
|
|
};
|
|
const sql = { unsafe } as unknown as Sql;
|
|
return { sql, state };
|
|
}
|
|
|
|
describe("isTransientWritePhaseError", () => {
|
|
it("matches only the write-phase connection-closed shape", () => {
|
|
expect(isTransientWritePhaseError(writeClosedError())).toBe(true);
|
|
|
|
const midQuery = new Error("read CONNECTION_CLOSED db.example.internal:5432");
|
|
(midQuery as Error & { code: string }).code = "CONNECTION_CLOSED";
|
|
expect(isTransientWritePhaseError(midQuery)).toBe(false);
|
|
|
|
const ended = new Error("write CONNECTION_ENDED db.example.internal:5432");
|
|
(ended as Error & { code: string }).code = "CONNECTION_ENDED";
|
|
expect(isTransientWritePhaseError(ended)).toBe(false);
|
|
|
|
expect(isTransientWritePhaseError(new Error("write CONNECTION_CLOSED x:1"))).toBe(false); // no code
|
|
expect(isTransientWritePhaseError(null)).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("withTransientWriteRetry", () => {
|
|
it("replays a query whose socket write failed, and returns the replay's rows", async () => {
|
|
const { sql, state } = stubSql({ failures: 1 });
|
|
const rows = await withTransientWriteRetry(sql).unsafe("select 1", []);
|
|
expect(rows).toEqual([{ attempt: 2 }]);
|
|
expect(state.calls).toBe(2);
|
|
});
|
|
|
|
it("replays the .values() form drizzle uses", async () => {
|
|
const { sql, state } = stubSql({ failures: 2 });
|
|
const values = await withTransientWriteRetry(sql).unsafe("select 1", []).values();
|
|
expect(values).toEqual([[3]]);
|
|
expect(state.calls).toBe(3);
|
|
});
|
|
|
|
it("gives up after the attempt budget and surfaces the driver error", async () => {
|
|
const { sql, state } = stubSql({ failures: Number.POSITIVE_INFINITY });
|
|
await expect(withTransientWriteRetry(sql).unsafe("select 1", [])).rejects.toThrow(
|
|
"write CONNECTION_CLOSED",
|
|
);
|
|
expect(state.calls).toBe(3);
|
|
});
|
|
|
|
it("does not replay an error that may have reached the server", async () => {
|
|
const midQuery = () => {
|
|
const error = new Error("read CONNECTION_CLOSED db.example.internal:5432");
|
|
(error as Error & { code: string }).code = "CONNECTION_CLOSED";
|
|
return error;
|
|
};
|
|
const { sql, state } = stubSql({ failures: Number.POSITIVE_INFINITY, error: midQuery });
|
|
await expect(withTransientWriteRetry(sql).unsafe("select 1", [])).rejects.toThrow(
|
|
"read CONNECTION_CLOSED",
|
|
);
|
|
expect(state.calls).toBe(1);
|
|
});
|
|
|
|
it("runs one execution no matter how many handlers attach to the pending query", async () => {
|
|
const { sql, state } = stubSql({ failures: 0 });
|
|
const pending = withTransientWriteRetry(sql).unsafe("select 1", []);
|
|
await Promise.all([pending, pending.catch(() => undefined), pending.then((rows) => rows)]);
|
|
expect(state.calls).toBe(1);
|
|
});
|
|
|
|
it("never executes a query twice when a caller both awaits it and takes its values", async () => {
|
|
// `.values()` selects the row shape of the one execution, like the driver.
|
|
// Starting a second execution here would repeat a mutation's effect.
|
|
const { sql, state } = stubSql({ failures: 0 });
|
|
const pending = withTransientWriteRetry(sql).unsafe("insert into t values (1)", []);
|
|
const rows = await pending;
|
|
const values = await pending.values();
|
|
expect(state.calls).toBe(1);
|
|
expect(values).toBe(rows);
|
|
});
|
|
|
|
it("takes the values shape when it is chosen before the query runs", async () => {
|
|
const { sql, state } = stubSql({ failures: 0 });
|
|
const pending = withTransientWriteRetry(sql).unsafe("select 1", []);
|
|
expect(await pending.values()).toEqual([[1]]);
|
|
expect(state.calls).toBe(1);
|
|
});
|
|
});
|
|
|
|
describe("createDb with the retrying client", () => {
|
|
// The same minimal wire-protocol fake as client-teardown-registry.test.ts:
|
|
// enough of the startup and query flow for drizzle to run a real query
|
|
// through the proxied client, proving the retry face is transparent.
|
|
function startFakePostgresServer(): Promise<{ server: net.Server; port: number }> {
|
|
const authOk = Buffer.from([0x52, 0, 0, 0, 8, 0, 0, 0, 0]);
|
|
const readyForQuery = Buffer.from([0x5a, 0, 0, 0, 5, 0x49]);
|
|
const emptyQueryReply = Buffer.concat([
|
|
Buffer.from([0x31, 0, 0, 0, 4]),
|
|
Buffer.from([0x32, 0, 0, 0, 4]),
|
|
Buffer.from([0x54, 0, 0, 0, 6, 0, 0]),
|
|
Buffer.from([0x43, 0, 0, 0, 0x0d, 0x53, 0x45, 0x4c, 0x45, 0x43, 0x54, 0x20, 0x30, 0]),
|
|
]);
|
|
const server = net.createServer((socket) => {
|
|
let greeted = false;
|
|
socket.on("data", () => {
|
|
if (!greeted) {
|
|
greeted = true;
|
|
socket.write(Buffer.concat([authOk, readyForQuery]));
|
|
return;
|
|
}
|
|
socket.write(Buffer.concat([emptyQueryReply, readyForQuery]));
|
|
});
|
|
socket.on("error", () => {});
|
|
});
|
|
return new Promise((resolve) => {
|
|
server.listen(0, "127.0.0.1", () => {
|
|
resolve({ server, port: (server.address() as net.AddressInfo).port });
|
|
});
|
|
});
|
|
}
|
|
|
|
let server: net.Server | null = null;
|
|
let url: string | null = null;
|
|
|
|
afterEach(async () => {
|
|
if (url) await closeRegisteredClients(url);
|
|
if (server) await new Promise((resolve) => server!.close(resolve));
|
|
server = null;
|
|
url = null;
|
|
});
|
|
|
|
it("still answers ordinary drizzle queries through the proxy", async () => {
|
|
const started = await startFakePostgresServer();
|
|
server = started.server;
|
|
url = `postgres://test:test@127.0.0.1:${started.port}/test`;
|
|
const db = createDb(url, { connectTimeoutSeconds: 5, prepare: false });
|
|
await expect(db.execute(drizzleSql`select 0`)).resolves.toBeDefined();
|
|
});
|
|
|
|
it("leaves every other client surface reachable through the proxy", async () => {
|
|
// Drizzle itself only awaits `unsafe()` or takes its `.values()`, but the
|
|
// client is reachable as `db.$client`, and callers use it as a tagged
|
|
// template, open transactions on it, and end it. A wrapper that broke any
|
|
// of those would fail far from here, so pin them against the real driver.
|
|
const started = await startFakePostgresServer();
|
|
server = started.server;
|
|
url = `postgres://test:test@127.0.0.1:${started.port}/test`;
|
|
const db = createDb(url, { connectTimeoutSeconds: 5, prepare: false });
|
|
const client = (db as unknown as { $client: Sql }).$client;
|
|
|
|
await expect(client`select 1`).resolves.toBeDefined();
|
|
await expect(client.unsafe("select 1", [])).resolves.toBeDefined();
|
|
await expect(
|
|
client.begin(async (tx) => {
|
|
await tx.unsafe("select 1", []);
|
|
return "transaction result";
|
|
}),
|
|
).resolves.toBe("transaction result");
|
|
await expect(client.end({ timeout: 1 })).resolves.toBeUndefined();
|
|
});
|
|
});
|