[TimeToBuildBob]

Summary

Continue ActivityWatch/activitywatch#302 with Python HTTP integration over draft ActivityWatch/aw-core#183 at 4ac214618dd9e93cc8e054b4e797ad70df96f641 (Git-pinned and locked). Includes #183 local discovery commits rebased on master; that PR remains independently mergeable.

• Device-scoped bucket CRUD, events/count/single and bulk delete, heartbeat, JSON/CSV export and query routes reuse existing validation/authentication through immutable request-local API views.
• Normalize server UUID and local to one stored scope; preserve peer ownership. Legacy POST is local-only, alias-aware, and rejects local/global routing disagreement. Other unique global-name compatibility remains; ambiguity is 409.
• Query cache includes scope; heartbeat state uses device + canonical bucket ID, with insert/delete/metadata invalidation.
• Complete device catalogue, grouped metadata/export and grouped import with whole-envelope identity/event preflight. Export substitutes source UUID for local sentinel; imported source history remains peer-owned elsewhere. Preserve metadata data.
• Device import merges existing same-device buckets and skips duplicate events (timestamp, duration, canonical data), matching Rust. An alias of stored history merges into that row; it does not create a sibling. Legacy /import still rejects existing exact names. Rollback deletes only buckets this call created.
• Grouped export streams events into a private tempfile from a dedicated read-only SQLite snapshot before HTTP success. The API write lock is held only to flush and pin that snapshot, so later writes are not blocked for the duration of staging. No live database cursor survives response iteration.
• SQLite worker-thread requests use thread-owned connections, closed at teardown, while sharing write serialization and API caches. Never disable SQLite thread checks or swap the shared API's datastore.
• Unsupported scoped Memory/Peewee requests return 501. Authentication and host checks remain in force.

Verification

Initial 4 HTTP contract tests failed on missing routes. Additional regressions reproduced metadata loss, unsafe legacy POST acknowledgement, catalogue/import error-path gaps, per-bucket snapshot commits, request-thread SQLite 500s, reject-on-existing device re-import, and export holding the write lock before repair.

• 19 file-backed SQLite HTTP contract tests, included in make test, including re-import dedup/alias merge, concurrent write during staged export, real concurrent WAL writer exclusion, staging failure before success, real request-thread export and parallel same-name device isolation.
• Broad server slice: 143 passed via repository make test (live-client test_client.py and test_integration.py excluded). Repository mypy 31 files passed.
• Core snapshot follow-up at 4ac2146: 392 passed / 5 skipped, repository mypy 37 files passed (using its prescribed stubs/import flags).
• Ruff, Black and whitespace passed; commits use normal hooks.

A same-version PyPI aw-core installation survived the first Poetry install despite the Git lock. Removed only aw-core from the isolated venv, reinstalled and verified direct_url.json identifies the exact Git pin before the no-PYTHONPATH tests. Subsequent pin update to 4ac2146 is locked in poetry.lock.

Explicit draft boundaries

• Not complete cross-backend identity acceptance; no Rust duplicate-name guards removed. No production services/databases changed; no watcher adoption or sync-v2 import enabled.
• SQLite is the only device-routed Python backend; unsupported ones return 501.
• Individual groups reuse Python rollback for newly created buckets; earlier successful groups may remain after a runtime failure.
• Event streaming retains the backend's existing time-range semantics. Unbounded archive/timestamp fidelity remains acceptance work. Legacy JSON/CSV export implementations remain separate.
• Full shared HTTP and backend-specific migration/same-name acceptance remains, including privacy and read-reader refresh boundaries.
• Peer hostname is a deterministic bucket-metadata representative, not a latest-name registry.
• Draft dependency must land and be replaced by an upstream release/pin before shipping. Local passes are not current-head CI or a released outcome.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The follow-up appears safe to merge; the previous duplicate-import issue is fixed.

Summary

Adds device-scoped bucket and query routes, grouped import/export, and request-owned SQLite connections.

• Callers can choose a device before working with its buckets.
• The server lists, exports, and imports buckets grouped by device.
• SQLite requests use their own connection on worker threads.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Request[HTTP request] --> Connection[Request-owned SQLite connection]
    Connection --> Scope[Device-scoped API view]
    Scope --> Bucket[Bucket and event operations]
    Scope --> Query[Scope-keyed query cache]
    Connection --> Export[Read-only export snapshot]
    Export --> File[Staged download]

Loading

_{Reviews (3) · Last reviewed commit: "fix(api): skip duplicate new events with..." · Reviewed by Greptile}

[TimeToBuildBob]

The previous format failure is superseded: 0a4ded7 passes format and lint; its remaining checks were still running when inspected. The two CodeQL findings flag DELETE requests inside test assertions (tests/test_device_addressing.py); those calls are still present on this head.

The implementation session is actively using this branch/worktree, so I left it untouched and sent the owner the two exact findings and the minimal repair (execute each DELETE before asserting its response status). No merge or CI-green claim; this remains a draft.

[TimeToBuildBob]

@greptileai review

[greptile-apps]

Imports keep duplicate new events

When an existing bucket receives two identical new events in one device import, _merge_imported_events keeps both. Each event is checked against the same existing set, which contains only stored events. Both copies reach create_events, so overlapping source histories can inflate event counts and activity totals.

Add each accepted event's identity to the set before checking the next event.

Suggested change

	new_events = [
	event
	for event in incoming
	if self._import_event_identity(event) not in existing
	]
	new_events = []
	for event in incoming:
	identity = self._import_event_identity(event)
	if identity not in existing:
	existing.add(identity)
	new_events.append(event)

[TimeToBuildBob]

Fixed in 0278a28.

_merge_imported_events compared each incoming event only against stored history, so two identical new events in one batch both reached create_events. Accepted identities are now recorded as they land. Regression test_import_skips_duplicate_new_events_in_one_batch failed at count 3 before the set update and passes at 2 after. The two CodeQL DELETE-in-assert findings are split so the request runs before the status check.

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

Integrated #201 in d6e9d4c, retaining the existing same-batch import dedup repair. Current aa99cfc pins/locks integrated core 26001d3; verified installed direct_url.json, no PYTHONPATH. tests/test_device_backend_contract.py is included in make test: set AW_RUST_CONTRACT_BINARY to run identical real-loopback HTTP fixtures on both backends. Eight shared cases pass, including Python→Rust and Rust→Python idempotent grouped transfer, aliases/query/export, heartbeat state, UUID/local equivalence and forged legacy ownership. They exposed two repaired gaps: core alias-query existence and naive created timestamps causing Rust import 422. New creation is aware UTC; grouped export normalizes historical naive metadata without rewriting SQL (regression verifies this). Package slice 156 passed; mypy32, Ruff/Black/hooks pass. Both Rust name guards remain and full same-name acceptance is unfinished; no production migration, watcher/V2 rollout or release claim.