@cortexkit/aft-opencode 0.39.3 → 0.40.0

package/dist/workflow-hints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-hints.d.ts","sourceRoot":"","sources":["../src/workflow-hints.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC;IAC/C,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;IACzB,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,sCAAsC;IACtC,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAkIzE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CASjG"}
+{"version":3,"file":"workflow-hints.d.ts","sourceRoot":"","sources":["../src/workflow-hints.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC;IAC/C,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;IACzB,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,sCAAsC;IACtC,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAgIzE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CASjG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/aft-opencode",
-  "version": "0.39.3",
+  "version": "0.40.0",
   "type": "module",
   "description": "OpenCode plugin for Agent File Tools (AFT) — tree-sitter and lsp powered code analysis",
   "main": "dist/index.js",
@@ -25,28 +25,29 @@
     "test:e2e": "bun test src/__tests__/e2e/",
     "lint": "biome check src",
     "schema": "bun scripts/build-schema.ts",
+    "build:tool-schemas": "bun run scripts/build-tool-schemas.ts",
     "prepublishOnly": "bun run build",
     "test:unit": "bun test src/__tests__ --path-ignore-patterns 'src/__tests__/e2e/**'"
   },
   "dependencies": {
     "@clack/prompts": "^1.2.0",
-    "@cortexkit/aft-bridge": "0.39.3",
+    "@cortexkit/aft-bridge": "0.40.0",
     "@xterm/headless": "^5.5.0",
     "comment-json": "^4.6.2",
     "undici": "^7.25.0",
     "zod": "^4.1.8"
   },
   "optionalDependencies": {
-    "@cortexkit/aft-darwin-arm64": "0.39.3",
-    "@cortexkit/aft-darwin-x64": "0.39.3",
-    "@cortexkit/aft-linux-arm64": "0.39.3",
-    "@cortexkit/aft-linux-x64": "0.39.3",
-    "@cortexkit/aft-win32-arm64": "0.39.3",
-    "@cortexkit/aft-win32-x64": "0.39.3"
+    "@cortexkit/aft-darwin-arm64": "0.40.0",
+    "@cortexkit/aft-darwin-x64": "0.40.0",
+    "@cortexkit/aft-linux-arm64": "0.40.0",
+    "@cortexkit/aft-linux-x64": "0.40.0",
+    "@cortexkit/aft-win32-arm64": "0.40.0",
+    "@cortexkit/aft-win32-x64": "0.40.0"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.17.7",
-    "@opencode-ai/sdk": "^1.17.7",
+    "@opencode-ai/plugin": "^1.17.9",
+    "@opencode-ai/sdk": "^1.17.9",
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0"
   },

package/src/shared/ignored-message.ts

@@ -0,0 +1,61 @@
+import { resolvePromptContext } from "./last-assistant-model.js";
+
+/**
+ * Append an `ignored: true` synthetic user message to a session.
+ *
+ * Used for user-facing informational panels that must NOT trigger an agent
+ * turn (e.g. status output, the external-directory restriction notice). The
+ * message renders under the current agent (resolved from recent messages) so
+ * it shows in the right place in the OpenCode UI, and carries `noReply: true`
+ * so no LLM call is made.
+ *
+ * IMPORTANT (cache + crash safety): this path deliberately passes ONLY `agent`
+ * (never model/variant). OpenCode crashes if model/variant are supplied on a
+ * `noReply: true` prompt, and omitting them keeps the synthetic message from
+ * busting the provider prefix cache the previous assistant turn warmed.
+ *
+ * Lives in `shared/` (not `index.ts`) because `index.ts` must export only the
+ * plugin default; both the plugin entry and `tools/permissions.ts` call this.
+ */
+export async function sendIgnoredMessage(
+  client: unknown,
+  sessionID: string,
+  text: string,
+): Promise<void> {
+  const typedClient = client as {
+    session?: {
+      prompt?: (input: unknown) => unknown;
+      promptAsync?: (input: unknown) => unknown;
+    };
+  };
+
+  let agent: string | undefined;
+  try {
+    const ctx = await resolvePromptContext(
+      client as Parameters<typeof resolvePromptContext>[0],
+      sessionID,
+    );
+    agent = ctx?.agent;
+  } catch {
+    agent = undefined;
+  }
+
+  const body: Record<string, unknown> = {
+    noReply: true,
+    parts: [{ type: "text", text, ignored: true }],
+  };
+  if (agent) body.agent = agent;
+  const promptInput = { path: { id: sessionID }, body };
+
+  if (typeof typedClient.session?.prompt === "function") {
+    await Promise.resolve(typedClient.session.prompt(promptInput));
+    return;
+  }
+
+  if (typeof typedClient.session?.promptAsync === "function") {
+    await typedClient.session.promptAsync(promptInput);
+    return;
+  }
+
+  throw new Error("[aft-plugin] client.session.prompt is unavailable");
+}

package/src/shared/rpc-notifications.ts

@@ -0,0 +1,121 @@
+/**
+ * In-memory notification queue for server → TUI push.
+ *
+ * Also tracks whether a TUI client is actively connected (polling).
+ * The server plugin cannot use `process.env.OPENCODE_CLIENT` to detect TUI
+ * because the server runs in a separate process from the TUI client.
+ */
+
+export interface RpcNotification {
+  id: number;
+  type: string;
+  payload: Record<string, unknown>;
+  sessionId?: string;
+}
+
+let queue: RpcNotification[] = [];
+let nextNotificationId = 1;
+// Timestamp of last drain — used to detect if a TUI is actively polling.
+// The TUI polls every 500ms; we consider it connected if it polled within
+// the last 3 seconds (6× the poll interval, tolerates transient delays).
+//
+// PER-SESSION: a single server process can serve MANY sessions (e.g. a TUI on
+// session A plus an OpenCode Desktop opened on session B for the same project,
+// whose newer RPC server this TUI's port discovery then selects). The TUI
+// poller drains with ITS active session id, so a session is "TUI-connected"
+// only if a TUI recently drained FOR THAT session. A process-global timestamp
+// would make session B's producers (`/aft-status`, configure warnings, etc.)
+// take the TUI-dialog path because session A's TUI is polling — queuing a
+// B-scoped dialog action that A's poller correctly refuses to show, so B's
+// notice is lost (it also suppressed B's non-TUI fallback). Tracking drains per
+// session routes each producer to the right delivery path.
+const lastDrainAtBySession = new Map<string, number>();
+let lastDrainAtAny = 0;
+const TUI_CONNECTED_WINDOW_MS = 3_000;
+
+/** Push a notification for the TUI to pick up via polling. */
+export function pushNotification(
+  type: string,
+  payload: Record<string, unknown>,
+  sessionId?: string,
+): void {
+  queue.push({ id: nextNotificationId++, type, payload, sessionId });
+  // Cap queue size to prevent unbounded growth if a TUI is not draining.
+  // Session-fair eviction: a naive `slice(-50)` drops the globally-oldest
+  // items, so a noisy session could evict ANOTHER session's single unseen
+  // notification. Instead, always retain each session's newest item, then
+  // fill the rest of the budget with the newest overall — no session can
+  // starve another's pending dialog out of the window.
+  if (queue.length > 100) {
+    const newestPerSession = new Map<string | undefined, number>();
+    for (const notification of queue) {
+      const previous = newestPerSession.get(notification.sessionId);
+      if (previous === undefined || notification.id > previous) {
+        newestPerSession.set(notification.sessionId, notification.id);
+      }
+    }
+    const mustKeep = new Set(newestPerSession.values());
+    const byNewest = [...queue].sort((a, b) => b.id - a.id);
+    const kept: RpcNotification[] = [];
+    for (const notification of byNewest) {
+      if (kept.length < 50 || mustKeep.has(notification.id)) kept.push(notification);
+    }
+    queue = kept.sort((a, b) => a.id - b.id);
+  }
+}
+
+/** Return pending notifications after acking the client's last received id.
+ *  Updates lastDrainAt so isTuiConnected() reflects recent activity.
+ *
+ *  Session scoping: when `sessionId` is provided, only notifications tagged for
+ *  that session (or session-less/global ones) are returned and pruned — a
+ *  notification tagged for a DIFFERENT session is never handed to this client
+ *  and is never pruned by this client's ack. This matters because the in-memory
+ *  queue is per-process but a TUI can end up draining a process that also serves
+ *  OTHER sessions: e.g. opening OpenCode Desktop on the same project starts a
+ *  newer RPC server that the TUI's port discovery (newest-pid-wins) then selects,
+ *  so a Desktop-session dialog action would otherwise surface in an unrelated
+ *  TUI session. Each client also tracks its own `lastReceivedId`, so a global
+ *  watermark prune would let session A's ack drop session B's still-unseen
+ *  notification — scoping the prune to the acking session prevents that too.
+ *
+ *  Delivery is at-least-once (non-destructive return + prune-on-ack): a returned
+ *  notification stays queued until a later call acks it via a higher
+ *  `lastReceivedId`, so a lost poll response re-delivers on the next poll. */
+export function drainNotifications(lastReceivedId = 0, sessionId?: string): RpcNotification[] {
+  const now = Date.now();
+  lastDrainAtAny = now;
+  if (sessionId !== undefined) lastDrainAtBySession.set(sessionId, now);
+  const matchesClient = (notification: RpcNotification): boolean =>
+    sessionId === undefined ||
+    notification.sessionId === undefined ||
+    notification.sessionId === sessionId;
+  if (lastReceivedId > 0) {
+    // Prune only notifications THIS client both owns (session-matched) and has
+    // acked (id <= lastReceivedId). Other sessions' notifications survive.
+    queue = queue.filter(
+      (notification) => !(notification.id <= lastReceivedId && matchesClient(notification)),
+    );
+  }
+  return queue.filter(
+    (notification) => notification.id > lastReceivedId && matchesClient(notification),
+  );
+}
+
+/** Whether a TUI client is actively polling for notifications.
+ *  Returns true only if a TUI has drained within the last 3 seconds.
+ *
+ *  Pass `sessionId` (preferred) to ask whether a TUI is polling FOR THAT
+ *  SESSION — this is what producers (`/aft-status`, configure warnings, etc.)
+ *  must use to decide dialog-vs-message, so a TUI on a different session in the
+ *  same process does not misroute their delivery. Omit it only for legacy/global
+ *  callers that genuinely have no session context; they fall back to "any
+ *  session recently drained" (the pre-per-session behavior). */
+export function isTuiConnected(sessionId?: string): boolean {
+  const now = Date.now();
+  if (sessionId !== undefined) {
+    const at = lastDrainAtBySession.get(sessionId) ?? 0;
+    return at > 0 && now - at < TUI_CONNECTED_WINDOW_MS;
+  }
+  return lastDrainAtAny > 0 && now - lastDrainAtAny < TUI_CONNECTED_WINDOW_MS;
+}

package/src/shared/rpc-utils.ts

@@ -1,15 +1,20 @@
-import { createHash } from "node:crypto";
 import { join } from "node:path";
+import { projectRootKeyHash } from "@cortexkit/aft-bridge";
 
 /**
- * Compute a stable hash for a project directory.
- * Used to scope RPC port files per-project so multiple
- * OpenCode Desktop instances don't overwrite each other.
+ * Compute a stable hash for a project directory, used to scope RPC port files
+ * per-project so multiple OpenCode Desktop instances don't overwrite each
+ * other.
+ *
+ * Delegates to the shared `projectRootKeyHash`, which CANONICALIZES (realpath +
+ * Windows normalization) before hashing — the same identity the bridge pool
+ * routes by. Previously this hashed the RAW directory string, so a symlinked or
+ * raw-spelled launch dir scoped its port file to a different directory than the
+ * bridge routed to, leaving the sidebar unable to discover the live server
+ * (stale-port / wrong-project class).
  */
 export function projectHash(directory: string): string {
-  // Normalize: strip trailing slashes
-  const normalized = directory.replace(/\/+$/, "");
-  return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+  return projectRootKeyHash(directory);
 }
 
 /**

package/src/tui/index.tsx

@@ -26,8 +26,6 @@ import {
 // per-server token on every RPC request; legacy integer port files are still
 // tolerated for already-running older server plugins.
 
-const STATUS_COMMAND = "aft-status";
-
 // RPC clients keyed by directory — one per project
 const rpcClients = new Map<string, AftRpcClient>();
 
@@ -52,6 +50,39 @@ function getSessionId(api: TuiPluginApi): string | null {
   return null;
 }
 
+interface TuiMessage {
+  id: number;
+  type: string;
+  payload: Record<string, unknown>;
+  sessionId?: string;
+}
+
+const lastReceivedNotificationIdBySession = new Map<string, number>();
+
+/** Poll for pending server → TUI notifications via RPC. */
+async function consumeTuiMessages(client: AftRpcClient, sessionId: string): Promise<TuiMessage[]> {
+  try {
+    const result = await client.call<{ messages?: TuiMessage[] }>("consume-notifications", {
+      lastReceivedId: lastReceivedNotificationIdBySession.get(sessionId) ?? 0,
+      sessionId,
+    });
+    return (result.messages ?? []).map((message) => ({
+      id: message.id,
+      type: message.type,
+      payload: message.payload,
+      sessionId: message.sessionId,
+    }));
+  } catch {
+    return [];
+  }
+}
+
+function markTuiMessagesReceived(sessionId: string, messages: TuiMessage[]): void {
+  const previous = lastReceivedNotificationIdBySession.get(sessionId) ?? 0;
+  const next = messages.reduce((max, message) => Math.max(max, message.id), previous);
+  if (next > previous) lastReceivedNotificationIdBySession.set(sessionId, next);
+}
+
 // ---------------------------------------------------------------------------
 // StatusDialog — themed, two-column JSX dialog. Modeled on the magic-context
 // /ctx-status pattern (packages/plugin/src/tui/index.tsx in that repo):
@@ -133,7 +164,6 @@ interface StatusDialogProps {
   sessionID: string;
   initial: AftStatusSnapshot | null;
   initialError: string | null;
-  onClose: () => void;
 }
 
 /**
@@ -576,39 +606,40 @@ async function showStatusDialog(api: TuiPluginApi): Promise<void> {
     initialError = "AFT is starting up. Status will refresh automatically...";
   }
 
-  const dismissStatusDialog = () => {
-    api.ui.dialog.setSize("medium");
-    api.ui.dialog.clear();
-  };
-
+  // The host's DialogProvider already wraps every replace()'d element in its own
+  // <Dialog> frame (absolute, centered, zIndex 3000) and binds Esc/Ctrl-C to pop
+  // the stack. Rendering our own <api.ui.Dialog> inside it was a frame-inside-a-
+  // frame: the inner absolute box anchored within the already-narrowed parent and
+  // rendered shifted down-right off the screen edge, unthemed, with key focus on
+  // the wrong layer. Pass the bare component — the host frames it — exactly like
+  // the DialogAlert/DialogConfirm paths and magic-context's status dialog do.
+  //
+  // Also: do NOT pass an onClose that calls dialog.clear(). The host invokes the
+  // entry's onClose on Esc AND clear() re-invokes every entry's onClose, so a
+  // clear()-based onClose recursed infinitely on close. The host pops the stack
+  // itself, and StatusDialog stops its own polling via onCleanup when unmounted,
+  // so no custom onClose is needed. `replace` resets size to "medium", so request
+  // "large" AFTER it.
+  api.ui.dialog.replace(() => (
+    <StatusDialog
+      api={api}
+      client={client}
+      directory={directory}
+      sessionID={sessionID}
+      initial={initial}
+      initialError={initialError}
+    />
+  ));
   api.ui.dialog.setSize("large");
-  api.ui.dialog.replace(
-    () => (
-      <api.ui.Dialog size="large" onClose={dismissStatusDialog}>
-        <StatusDialog
-          api={api}
-          client={client}
-          directory={directory}
-          sessionID={sessionID}
-          initial={initial}
-          initialError={initialError}
-          onClose={dismissStatusDialog}
-        />
-      </api.ui.Dialog>
-    ),
-    dismissStatusDialog,
-  );
 }
 
 /**
- * Register the `/aft-status` slash command, preferring the v1.14.42+ keymap
- * API and falling back to the legacy `api.command.register` for older hosts.
+ * Register the AFT status palette command, preferring the v1.14.42+ keymap API
+ * and falling back to the legacy `api.command.register` for older hosts.
  *
- * The `keymap.registerLayer` shape uses `name`/`title`/`run`/`namespace`/
- * `slashName` (see `@opencode-ai/plugin/tui` types) and is what the host's
- * own legacy command-shim translates into. Calling it directly skips the
- * deprecation warning and works without depending on the (now-deprecated)
- * `api.command` namespace existing at all.
+ * No slash entry is registered here. The server config hook owns the single
+ * `/aft-status` slash registration, while this palette command keeps Ctrl+P
+ * discovery in the TUI.
  */
 function registerStatusCommand(api: TuiPluginApi): void {
   type ApiAny = {
@@ -632,7 +663,6 @@ function registerStatusCommand(api: TuiPluginApi): void {
           name: "aft.status",
           title: "AFT: Status",
           category: "AFT",
-          slashName: STATUS_COMMAND,
           run() {
             void showStatusDialog(api);
           },
@@ -649,7 +679,6 @@ function registerStatusCommand(api: TuiPluginApi): void {
         title: "AFT: Status",
         value: "aft.status",
         category: "AFT",
-        slash: { name: STATUS_COMMAND },
         onSelect() {
           void showStatusDialog(api);
         },
@@ -658,9 +687,8 @@ function registerStatusCommand(api: TuiPluginApi): void {
     return;
   }
 
-  // Neither API surface is present. The TUI host can still load — we only
-  // lose the slash-command entry point. The sidebar (registered above)
-  // remains available so users can still see AFT status visually.
+  // Neither API surface is present. The TUI host can still load; users can
+  // still see AFT status through the sidebar and server-owned slash command.
 }
 
 async function showStartupNotifications(api: TuiPluginApi): Promise<void> {
@@ -732,8 +760,8 @@ const tui: TuiPlugin = async (api) => {
   try {
     api.slots.register(await createAftSidebarSlot(api, packageVersion));
   } catch {
-    // Older OpenCode TUI hosts may not implement api.slots; fall through
-    // and keep the slash command working.
+    // Older OpenCode TUI hosts may not implement api.slots; fall through and
+    // keep the palette command / server-owned slash command working.
   }
 
   // OpenCode 1.14.42 removed `api.command.register` entirely
@@ -746,6 +774,58 @@ const tui: TuiPlugin = async (api) => {
   // See https://github.com/cortexkit/aft/issues/33.
   registerStatusCommand(api);
 
+  // Poll for server → TUI dialog requests. The server owns the slash command,
+  // and this poller is how it asks the TUI process to show native UI.
+  let pollInFlight = false;
+  const messagePoller = setInterval(() => {
+    // Scope the drain to the TUI's active session so notifications tagged for a
+    // different session (served by the same RPC process) are not consumed here.
+    // Do not poll on non-session routes: a session-scoped action fetched while
+    // sessionless could otherwise be acked without being shown.
+    if (pollInFlight) return;
+
+    const requestedSessionId = getSessionId(api);
+    if (!requestedSessionId) return;
+
+    const directory = api.state.path.directory ?? "";
+    if (!directory) return;
+
+    pollInFlight = true;
+    const client = getRpcClient(directory);
+    void consumeTuiMessages(client, requestedSessionId)
+      .then(async (messages) => {
+        // If the user switched routes while the RPC was in flight, drop this
+        // batch without advancing the cursor; the next poll for the active
+        // session will fetch the right notifications.
+        if (getSessionId(api) !== requestedSessionId) return;
+
+        const orderedMessages = [...messages].sort((a, b) => a.id - b.id);
+        for (const message of orderedMessages) {
+          if (getSessionId(api) !== requestedSessionId) return;
+          if (message.sessionId && message.sessionId !== requestedSessionId) continue;
+          if (message.type !== "action") continue;
+          if (message.payload?.action !== "show-status-dialog") continue;
+          await showStatusDialog(api);
+        }
+
+        if (getSessionId(api) !== requestedSessionId) return;
+        markTuiMessagesReceived(requestedSessionId, orderedMessages);
+      })
+      .catch(() => {
+        // Intentional: message polling should never crash the TUI.
+      })
+      .finally(() => {
+        pollInFlight = false;
+      });
+  }, 500);
+
+  api.lifecycle?.onDispose?.(() => {
+    clearInterval(messagePoller);
+    lastReceivedNotificationIdBySession.clear();
+    for (const client of rpcClients.values()) client.reset();
+    rpcClients.clear();
+  });
+
   // Show startup notifications — RPC server is already running by the time TUI loads
   void showStartupNotifications(api);
 };

package/src/tui/sidebar.tsx

@@ -7,9 +7,9 @@
 // session.updated/message.updated events with a small debounce, same as
 // magic-context, so the panel stays current without polling.
 
+import { canonicalizeProjectRoot } from "@cortexkit/aft-bridge";
 import type { TuiPluginApi, TuiSlotPlugin, TuiThemeCurrent } from "@opencode-ai/plugin/tui";
 import { createEffect, createMemo, createSignal, on, onCleanup } from "solid-js";
-
 import { AftRpcClient } from "../shared/rpc-client";
 import {
   type AftStatusSnapshot,
@@ -317,16 +317,22 @@ export function isSnapshotForContext(
   directory: string,
   servedDirectory: string | undefined,
 ): boolean {
-  const stripSlash = (p: string) => p.replace(/\/+$/, "");
+  // Canonicalize both sides through the SAME canonicalizer the bridge routes
+  // by, so a symlinked / `/var`-vs-`/private/var` / trailing-slash spelling of
+  // the sidebar directory still matches Rust's canonical_root. A raw stripSlash
+  // compare (the old behavior) rejected legitimate snapshots whenever the TUI
+  // directory and Rust's root were different spellings of the same location,
+  // leaving the sidebar blank on aliased roots.
+  const canon = (p: string) => canonicalizeProjectRoot(p);
   const roots = [snapshot.project_root, snapshot.canonical_root].filter(
     (r): r is string => typeof r === "string" && r.length > 0,
   );
   if (roots.length === 0) return true; // placeholder / synthetic
-  const dir = stripSlash(directory);
-  if (roots.some((r) => stripSlash(r) === dir)) return true;
+  const dir = canon(directory);
+  if (roots.some((r) => canon(r) === dir)) return true;
   if (typeof servedDirectory === "string" && servedDirectory.length > 0) {
-    const served = stripSlash(servedDirectory);
-    return roots.some((r) => stripSlash(r) === served);
+    const served = canon(servedDirectory);
+    return roots.some((r) => canon(r) === served);
   }
   return false;
 }