Throttle agent usage writes and cache inventory per request

src/lib/server/hosts/index.ts

@@ -6,6 +6,7 @@ import { db } from '../db/index.js';
 import { ensureHostSchema } from './schema.js';
 import { successfulObservation, routineObservationSql, importantOperationSql, operationTargetSql, safeOperationTarget } from './observations.js';
 import { currentOperationSource } from './operation-context.js';
+import { parseHostInventory } from './request-context.js';
 import { fleetSettings } from '../settings.js';
 import { recordInstanceResources, validateInstanceResources } from './calibration.js';
 import { refreshHostAvailability, scheduleAvailabilityRefresh } from './availability.js';
@@ -38,7 +39,7 @@ function presentDecommission(row: DecommissionRow | undefined): HostDecommission
 }
 function hostFromRow(row: HostRow): Host {
     const enabling = database().prepare('SELECT requested_at FROM ec_host_enable_requests WHERE host_id=?').get(row.id) as { requested_at: string } | undefined;
-    const inventory: HostInventory = JSON.parse(row.inventory);
+    const inventory = parseHostInventory(row.id, row.inventory);
     const connected = !!row.credential_active && !!row.last_heartbeat && Date.now() - Date.parse(row.last_heartbeat) <= HEARTBEAT_MAX_AGE_MS;
     const reasons: string[] = [];
     if (!row.enrolled_at) reasons.push('Agent has not enrolled.');
@@ -304,9 +305,15 @@ export function enrollHost(token: unknown, rawInventory: unknown): { hostId: str
 }
 export function authenticateCredential(token: string): Host | null {
     if (!token || token.length > 200) return null;
-    const row = database().prepare('SELECT id,host_id FROM ec_host_credentials WHERE token_hash=? AND revoked_at IS NULL').get(digest(token)) as { id: string; host_id: string } | undefined;
+    const row = database().prepare('SELECT id,host_id,last_used_at FROM ec_host_credentials WHERE token_hash=? AND revoked_at IS NULL')
+        .get(digest(token)) as { id: string; host_id: string; last_used_at: string | null } | undefined;
     if (!row) return null;
-    database().prepare('UPDATE ec_host_credentials SET last_used_at=? WHERE id=?').run(now(), row.id);
+    const timestamp = Date.now();
+    if (row.last_used_at === null || timestamp - Date.parse(row.last_used_at) >= 60_000) {
+        database().prepare(`UPDATE ec_host_credentials SET last_used_at=? WHERE id=? AND revoked_at IS NULL
+            AND (last_used_at IS NULL OR last_used_at<=?)`)
+            .run(new Date(timestamp).toISOString(), row.id, new Date(timestamp - 60_000).toISOString());
+    }
     return getHost(row.host_id);
 }
 export function revokeCredentials(hostId: string): void {