perf: v2.5.10 — ready for 10+ concurrent users, leaner locally

Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).

Server
- /api/analytics: the events-table scans run in the read worker
  (scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
  maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
  LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
  created_at) replaces idx_events_session_type: covering reads for session
  stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
  cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
  DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
  connection; a failed checkpoint restores the automatic one (hook COMMIT p95
  109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
  (liveSessions), shared for 1 s and cleared by this process's new/kill —
  GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
  skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
  query per transcript entry (23 ms/hook on a 763-turn session); one lane
  scan per hook; hourly upserts skip rows that did not grow; frames are sent
  after the transaction commits (and after the pane binding); new_event
  carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
  lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
  indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling

Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
  lane cards, git header, changes panel, settings); no per-tab hourly
  /updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
  a run-key change, notification pane lookup only when shown); WS reconnect
  jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
  GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
  (only while enabled); only the active locale loads; Workspace chunk
  prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
  /assets/ (cache v3 drops the old one)

Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.

Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).

scripts/import-history.js

@@ -2652,6 +2652,22 @@ async function scanAndImportSubagents(dbModule, sessionId, transcriptPath, opts
   return { imported: subFiles.length, created, reparented };
 }
 
+/** Count, total size and newest mtime of a session's subagent files. */
+function subagentFilesFingerprint(files) {
+  let size = 0;
+  let newest = 0;
+  for (const f of files) {
+    try {
+      const st = fs.statSync(f);
+      size += st.size;
+      newest = Math.max(newest, st.mtimeMs);
+    } catch {
+      /* vanished between listing and stat */
+    }
+  }
+  return `${files.length}:${size}:${Math.round(newest)}`;
+}
+
 /**
  * Backfill metadata.tokens onto existing subagent rows that predate per-agent
  * cost tracking. New imports and live SubagentStop scans stamp each subagent's
@@ -2667,7 +2683,11 @@ async function scanAndImportSubagents(dbModule, sessionId, transcriptPath, opts
  * completely untouched; only the per-agent breakdown is filled in.
  *
  * Idempotent and self-limiting: once a row has a tokens key it drops out of the
- * driving query, so steady-state startups do near-zero work.
+ * driving query, so steady-state startups do near-zero work. A row that can
+ * never be stamped (its file holds no usage) would keep its session in the
+ * query forever, so a session's subagent files are fingerprinted (count, size,
+ * newest mtime) into `metadata.subagent_tokens_checked` after a pass and are
+ * not parsed again until they change — measured 2–5 s of every boot before.
  */
 async function backfillSubagentTokenMetadata(dbModule) {
   const { db } = dbModule;
@@ -2721,6 +2741,14 @@ async function backfillSubagentTokenMetadata(dbModule) {
       continue;
     }
     if (!subFiles || subFiles.length === 0) continue;
+    const fingerprint = subagentFilesFingerprint(subFiles);
+    let checked = null;
+    try {
+      checked = s.meta ? JSON.parse(s.meta).subagent_tokens_checked : null;
+    } catch {
+      /* unreadable metadata: treat as never checked */
+    }
+    if (checked === fingerprint) continue; // nothing changed since the last pass
     scanned++;
     const mainAgentId = `${s.session_id}-main`;
     for (const file of subFiles) {
@@ -2733,6 +2761,14 @@ async function backfillSubagentTokenMetadata(dbModule) {
         /* non-fatal — partial or unrelated files are common */
       }
     }
+    try {
+      db.prepare(
+        `UPDATE sessions SET metadata = json_set(COALESCE(metadata, '{}'), '$.subagent_tokens_checked', ?)
+         WHERE id = ? AND json_valid(COALESCE(metadata, '{}'))`
+      ).run(fingerprint, s.session_id);
+    } catch {
+      /* the next boot simply checks this session again */
+    }
   }
   return { sessions: scanned, stamped };
 }

scripts/test-server.js

@@ -14,7 +14,9 @@
  * ones kept there are what the dormant stage/detection code is tested against.
  * `AGENTHUB_SETTINGS_FILE` goes to the same temp dir, so a suite that saves a
  * setting never writes the developer's real `~/.config/agenthub/settings.env`,
- * and `AGENTHUB_PRICING_SYNC=0` keeps every suite off the network.
+ * and `AGENTHUB_PRICING_SYNC=0` keeps every suite off the network. The
+ * `GIT_DIR`-family variables a git hook exports are dropped too, so a test's
+ * own `git init`/`commit` can never land in the real repository.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -44,6 +46,20 @@ const env = {
 };
 delete env.TMUX;
 delete env.TMUX_PANE;
+// Git exports these to a hook it runs from a linked worktree (the pre-commit
+// hook runs this suite): inherited, every `git init`/`commit` a test makes in
+// its temp folder went to the REAL repository instead — commits on the
+// worktree's HEAD and `core.bare = true` in the shared config.
+for (const k of [
+  "GIT_DIR",
+  "GIT_INDEX_FILE",
+  "GIT_WORK_TREE",
+  "GIT_COMMON_DIR",
+  "GIT_PREFIX",
+  "GIT_OBJECT_DIRECTORY",
+]) {
+  delete env[k];
+}
 
 const result = spawnSync(process.execPath, ["--test", ...args, ...(args.length ? [] : files)], {
   stdio: "inherit",