@hienlh/ppm 0.21.0 → 0.22.0

package/src/providers/claude-agent-sdk.ts

@@ -27,7 +27,7 @@ import { SUBSCRIPTION_PROMPT_CACHE_TTL_MS, API_KEY_PROMPT_CACHE_TTL_MS } from ".
 import { buildTurnUsage, formatTurnUsageLog } from "../shared/turn-usage.ts";
 import { accountSelector } from "../services/account-selector.service.ts";
 import { accountService, type AccountWithTokens } from "../services/account.service.ts";
-import { parseSessionMessage, nestChildEventsAcrossMessages } from "../services/jsonl-transcript-parser.ts";
+import { parseSessionMessage, nestChildEventsAcrossMessages, parseJsonlTranscript, fullParseWindow } from "../services/jsonl-transcript-parser.ts";
 import { applyBackgroundAgentStatus } from "../shared/background-agent-status.ts";
 import { mergeSubagentChildren, resolveSessionDir } from "../services/subagent-transcript-merger.ts";
 import { stringifyToolResultContent } from "../shared/tool-result-content.ts";
@@ -2133,6 +2133,47 @@ export class ClaudeAgentSdkProvider implements AIProvider {
     }
   }
 
+  /**
+   * Every message in the transcript, compacted-away segments included.
+   *
+   * `getSessionMessages` walks back from the newest message through
+   * `parentUuid`, and the `compact_boundary` record Claude Code writes when it
+   * compacts carries `parentUuid: null` — so the walk stops there and
+   * `getMessages` answers with the last segment only. That is right for the
+   * chat view, which shows the compact summary with a "Load previous
+   * conversation" button beside it. The search index has no such affordance:
+   * asking it the same question indexed 179 of one session's 1084 messages and
+   * left the oldest 18 hours of it unfindable by any query. Reading the file
+   * linearly ignores the `parentUuid` chain and costs less than the SDK call
+   * (40ms for a 6.9MB transcript).
+   */
+  async getFullMessages(sessionId: string, opts?: { maxBytes?: number }): Promise<ChatMessage[]> {
+    const transcriptDir = resolveSessionDir(sessionId, getSessionProjectPath(sessionId));
+    if (transcriptDir) {
+      const file = `${transcriptDir}.jsonl`;
+      // Nothing else bounds this path. `validateJsonlPath` guards the route
+      // that serves one chat's pre-compact scroll; the search indexer arrives
+      // here instead, unattended and once per stale session — and a bumped
+      // INDEXER_VERSION makes that every session on disk. Parsing costs about
+      // 4.3× the file in transient allocator growth (measured: 88.6MB → +355MB
+      // RSS, which neither a forced GC nor dropping the array gives back), so
+      // past the bound the newest `FULL_PARSE_MAX_BYTES` are read and the rest
+      // of the history is left out of the index rather than out of memory.
+      // `maxBytes` is a parameter only so a test can assert the window against a
+      // one-byte-over fixture: a real 128MB transcript is a 12s read even when
+      // the point is that most of it goes unread.
+      const fromByte = fullParseWindow(file, opts?.maxBytes);
+      if (fromByte > 0) {
+        console.warn(`[sdk] getFullMessages: ${sessionId} transcript is over the full-parse bound — indexing from byte ${fromByte} on, older segments stay out of the index`);
+      }
+      try {
+        const fromFile = await parseJsonlTranscript(file, undefined, { fromByte });
+        if (fromFile.length > 0) return fromFile;
+      } catch { /* unreadable or malformed — fall back to the conversation */ }
+    }
+    return this.getMessages(sessionId);
+  }
+
   async getMessages(sessionId: string): Promise<ChatMessage[]> {
     try {
       const messages = await getSessionMessages(sessionId);

package/src/providers/codex-app-server/codex-history.ts

@@ -97,7 +97,8 @@ function fnOutputToToolResult(p: Record<string, unknown>): ChatEvent {
 export function parseRolloutJsonl(
   text: string,
   opts?: {
-    preCompact?: boolean;
+    /** Which compaction boundary to stop at, counting from the start of the file. */
+    preCompactIndex?: number;
     /** Reads a spawned thread's transcript so its card can nest it. */
     loadSubagent?: (threadId: string) => SubagentTranscript | null;
   },
@@ -105,6 +106,7 @@ export function parseRolloutJsonl(
   const messages: ChatMessage[] = [];
   let i = 0;
   let pendingEvents: ChatEvent[] = [];
+  let compactionsSeen = 0;
   // Kept so the completion can answer the card the spawn opened, with the
   // report the child ended on.
   const subagentTranscripts = new Map<string, SubagentTranscript | null>();
@@ -184,8 +186,19 @@ export function parseRolloutJsonl(
       else if (typeof p.type === "string" && p.type.endsWith("_call_output")) pendingEvents.push(fnOutputToToolResult(p));
       else if (typeof p.type === "string" && p.type.endsWith("_call")) pendingEvents.push(genericCallToToolUse(p));
     } else if (rec.type === "compacted") {
-      // Pre-compact mode: everything accumulated so far IS the pre-compact history.
-      if (opts?.preCompact) { if (pendingEvents.length) flushAssistant("", ts); break; }
+      if (opts?.preCompactIndex) {
+        // One segment per request, the way the Claude parser's `oneSegment` does.
+        // The requested boundary ends the walk; every boundary before it closes a
+        // stretch nobody asked for, so what was collected is dropped rather than
+        // prepended — the card at the head of the segment is what leads back to it.
+        if (++compactionsSeen === opts.preCompactIndex) {
+          if (pendingEvents.length) flushAssistant("", ts);
+          break;
+        }
+        pendingEvents = [];
+        messages.length = 0;
+        continue;
+      }
       // In-place compaction: `replacement_history` REPLACES everything before this
       // point. Reset to the post-compact base; turns after it append normally.
       pendingEvents = [];
@@ -374,16 +387,42 @@ function subagentLoader(
   };
 }
 
-/** The compaction summary text if this rollout was compacted, else null. */
-function compactionSummary(text: string): string | null {
+/**
+ * Every compaction's summary text, in file order — `[]` when never compacted.
+ *
+ * All of them rather than the first, because a thread can be compacted more than
+ * once and each boundary has its own summary. The *last* is what the post-compact
+ * view's card shows, since that is the compaction which produced the view being
+ * rendered; reading the first showed a twice-compacted thread the summary of work
+ * two segments ago. The earlier ones head the segments the "load more" walk opens.
+ */
+function compactionSummaries(text: string): string[] {
+  const out: string[] = [];
   for (const line of completeLines(text)) {
     const rec = parseLine(line);
-    if (rec?.type === "compacted") {
-      const msg = (rec.payload as Record<string, unknown> | undefined)?.message;
-      return typeof msg === "string" ? msg : "";
-    }
+    if (rec?.type !== "compacted") continue;
+    const msg = (rec.payload as Record<string, unknown> | undefined)?.message;
+    out.push(typeof msg === "string" ? msg : "");
   }
-  return null;
+  return out;
+}
+
+/**
+ * The "earlier conversation was compacted" card that heads a compacted view.
+ *
+ * `#<index>` in the id is load-bearing, not decoration: the client sends the card's
+ * id back as `before`, and on a thread compacted more than once it is the only thing
+ * saying *which* boundary to walk back from. `#` rather than another `-` because a
+ * thread id is a uuid whose last group can be all digits, and a trailing `-12` would
+ * then be indistinguishable from an index.
+ */
+function compactCard(summary: string, threadId: string, index: number, file: string): ChatMessage {
+  return {
+    id: `codex-compact-${threadId}#${index}`,
+    role: "assistant",
+    content: `${summary || "_Earlier conversation was compacted to save context._"}\n\nread the full transcript at: ${file}`,
+    timestamp: new Date().toISOString(),
+  };
 }
 
 /**
@@ -400,14 +439,9 @@ export function getRolloutMessages(sessionsDir: string, threadId: string, reques
     const msgs = parseRolloutJsonl(text, {
       loadSubagent: subagentLoader(sessionsDir, requestedCwd, new Set([threadId]), SUBAGENT_DEPTH),
     });
-    const summary = compactionSummary(text);
-    if (summary !== null) {
-      msgs.unshift({
-        id: `codex-compact-${threadId}`,
-        role: "assistant",
-        content: `${summary || "_Earlier conversation was compacted to save context._"}\n\nread the full transcript at: ${file}`,
-        timestamp: new Date().toISOString(),
-      });
+    const summaries = compactionSummaries(text);
+    if (summaries.length) {
+      msgs.unshift(compactCard(summaries[summaries.length - 1]!, threadId, summaries.length, file));
     }
     return msgs;
   } catch { return []; }
@@ -422,17 +456,37 @@ export function isCodexRolloutPath(p: string): boolean {
 }
 
 /**
- * Pre-compact slice for the "load more" feature. Jails to ~/.codex/sessions,
- * fail-closed on cwd, returns the messages BEFORE the compaction boundary.
+ * One pre-compact segment for the "load more" feature. Jails to ~/.codex/sessions,
+ * fail-closed on cwd.
+ *
+ * One segment per request rather than everything before the first boundary, which is
+ * what this used to return. A thread compacted twice has three stretches, and the old
+ * answer handed the newest card the *oldest* stretch while leaving the middle one
+ * reachable from nothing at all — not a short answer, a lost one. `before` names the
+ * card that was clicked, and the segment it opens is itself headed by the previous
+ * boundary's card, so the walk continues the way the Claude path's does.
  */
-export function getCodexPreCompactMessages(file: string, requestedCwd?: string): ChatMessage[] {
+export function getCodexPreCompactMessages(file: string, requestedCwd?: string, beforeId?: string): ChatMessage[] {
   if (!isCodexRolloutPath(file)) throw new Error("Access denied: not a codex rollout");
   const resolved = resolve(file);
   let text: string;
   try { text = readFileSync(resolved, "utf-8"); } catch { throw new Error("File not found"); }
+  // Read once and reused below. `readSessionMeta` opens and reads the whole rollout again, and
+  // this path is already reading a file that reaches tens of megabytes on the very sessions
+  // the feature exists for — asking for it twice per click was a third of the cost for nothing.
+  const meta = readSessionMeta(resolved);
   if (requestedCwd != null) {
-    const meta = readSessionMeta(resolved);
     if (!meta?.cwd || normPath(meta.cwd) !== normPath(requestedCwd)) return []; // fail-closed
   }
-  return parseRolloutJsonl(text, { preCompact: true });
+  const summaries = compactionSummaries(text);
+  if (!summaries.length) return [];
+  // A client holding a card from before the index existed sends the bare id. The newest
+  // boundary is the one that card came from, and on a thread compacted once — which is
+  // every thread that path was ever correct for — the two agree.
+  const asked = Number(beforeId?.match(/#(\d+)$/)?.[1]);
+  const index = asked >= 1 && asked <= summaries.length ? asked : summaries.length;
+  const segment = parseRolloutJsonl(text, { preCompactIndex: index });
+  if (index < 2) return segment;
+  const threadId = meta?.id ?? threadIdFromName(resolved) ?? "";
+  return [compactCard(summaries[index - 2]!, threadId, index - 1, resolved), ...segment];
 }

package/src/server/index.ts

@@ -45,6 +45,7 @@ async function setupLogFile() {
   const { resolve } = await import("node:path");
   const { appendFileSync, mkdirSync, existsSync } = await import("node:fs");
   const { getPpmDir } = await import("../services/ppm-dir.ts");
+  const { stdioIsLogFile, consumeStdioIsLogEnv } = await import("../services/log-rotate.ts");
 
   const ppmDir = getPpmDir();
   if (!existsSync(ppmDir)) mkdirSync(ppmDir, { recursive: true });
@@ -70,9 +71,26 @@ async function setupLogFile() {
     try { appendFileSync(logPath, `[${ts}] [${level}] ${redact(msg)}\n`); } catch {}
   };
 
-  console.log = (...args: unknown[]) => { origLog(...args); writeLog("INFO", args); };
-  console.error = (...args: unknown[]) => { origError(...args); writeLog("ERROR", args); };
-  console.warn = (...args: unknown[]) => { origWarn(...args); writeLog("WARN", args); };
+  // The supervisor spawns this process with `stdio: ["ignore", logFd, logFd]`
+  // where logFd is ppm.log itself, so console output already lands in the log
+  // through fd 1 — with no timestamp, no level, and crucially *unredacted*,
+  // because `redact()` above only ever ran on the appended copy. That is how
+  // ppm.log came to hold 1,395,012 lines of which only 532,792 carried the
+  // prefix: the other 862,220 were the same events arriving raw.
+  //
+  // Where the console already reaches the file, the original call is dropped
+  // and only the formatted, redacted line is written — one copy per event, and
+  // the safe one. Run from a terminal (`bun dev:server`) stdout is a tty, both
+  // checks are false, and the terminal keeps its output exactly as before.
+  const stdoutIsLogFile = stdioIsLogFile(1, logPath);
+  const stderrIsLogFile = stdioIsLogFile(2, logPath);
+  // Read once, then dropped: the terminals, SDK children and `ppm` invocations this server
+  // spawns inherit its environment, and none of their stdouts is the log file.
+  consumeStdioIsLogEnv();
+
+  console.log = (...args: unknown[]) => { if (!stdoutIsLogFile) origLog(...args); writeLog("INFO", args); };
+  console.error = (...args: unknown[]) => { if (!stderrIsLogFile) origError(...args); writeLog("ERROR", args); };
+  console.warn = (...args: unknown[]) => { if (!stderrIsLogFile) origWarn(...args); writeLog("WARN", args); };
 
   // Capture uncaught errors — count-based exit for supervisor restart
   let exceptionCount = 0;
@@ -131,16 +149,21 @@ app.get("/api/info", (c) => c.json(ok({
   tunnel_active: !!tunnelService.getTunnelUrl(),
 })));
 
-// Public: recent logs for bug reports (last 30 lines)
+// Public: recent logs for bug reports (last 30 lines).
+//
+// Reads a bounded tail, never the file. This route sits *before*
+// authMiddleware, and `readFileSync` + `split("\n")` on the 276 MB ppm.log this
+// was found on cost 356 ms of blocked event loop and a 644 MB resident spike —
+// per call, unauthenticated, and growing with the log.
 app.get("/api/logs/recent", async (c) => {
   const { resolve } = await import("node:path");
-  const { existsSync, readFileSync } = await import("node:fs");
+  const { existsSync } = await import("node:fs");
   const { getPpmDir } = await import("../services/ppm-dir.ts");
   const { redactSecrets } = await import("../services/redact-secrets.ts");
+  const { tailLines } = await import("../services/file-lines.ts");
   const logFile = resolve(getPpmDir(), "ppm.log");
   if (!existsSync(logFile)) return c.json(ok({ logs: "" }));
-  const content = readFileSync(logFile, "utf-8");
-  const lines = content.split("\n").slice(-30).join("\n").trim();
+  const lines = await tailLines(logFile, 30);
   // Double-redact in case old logs have unredacted content
   return c.json(ok({ logs: redactSecrets(lines) }));
 });
@@ -179,6 +202,15 @@ app.route("/api/system", resourceRoutes);
 import { hostInfoRoutes } from "./routes/host-info.ts";
 app.route("/api/system", hostInfoRoutes);
 
+// Event-loop lag. One process serves every request and all of the chat work, so
+// a stall here is a stall everywhere; the report says whether the time was spent
+// on our own synchronous work or off the CPU entirely, which is what decides
+// whether the answer is in this repository at all.
+app.get("/api/system/event-loop", async (c) => {
+  const { lagReport } = await import("../services/event-loop-lag.ts");
+  return c.json(ok(lagReport()));
+});
+
 // Remote desktop (video capture + input) — on by default, opt-out via REMOTE_DESKTOP_ENABLED=0, see remote-desktop-flag.ts
 import { remoteDesktopRoutes } from "./routes/remote-desktop.ts";
 app.route("/api/remote-desktop", remoteDesktopRoutes);
@@ -970,6 +1002,9 @@ if (process.argv.includes("__serve__")) {
   // Start background usage limit polling (every 5 min)
   import("../services/claude-usage.service.ts").then(({ startUsagePolling }) => startUsagePolling()).catch(() => {});
 
+  // Watch how long the loop is unavailable for, and whose fault that is
+  import("../services/event-loop-lag.ts").then(({ startLagMonitor }) => startLagMonitor()).catch(() => {});
+
   // Discover + activate enabled extensions
   import("../services/extension.service.ts").then(({ extensionService }) => extensionService.startup()).catch((e) => {
     console.error("[ExtService] Startup error:", e);

package/src/server/routes/chat.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
 import { resolve, join, basename } from "node:path";
-import { existsSync, readdirSync, statSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { unlink } from "node:fs/promises";
+import { countLines } from "../../services/file-lines.ts";
 import { ensureUploadsDir, resolveUploadPath } from "../../services/chat-upload-storage.service.ts";
 import { chatService } from "../../services/chat.service.ts";
 import { draftService } from "../../services/draft.service.ts";
@@ -818,24 +819,25 @@ function resolveSessionJsonlPath(sessionId: string): { jsonlPath: string; jsonlD
 }
 
 /** GET /chat/sessions/:id/debug — session debug info (IDs, JSONL path) */
-chatRoutes.get("/sessions/:id/debug", (c) => {
+chatRoutes.get("/sessions/:id/debug", async (c) => {
   const sessionId = c.req.param("id");
   const { jsonlPath, jsonlDir, projectPath, exists } = resolveSessionJsonlPath(sessionId);
   // Transcript weight: file size + record count (1 JSONL line = 1 event record).
   // Line count skipped above 64MB so the debug button stays snappy on huge files.
+  //
+  // `countLines` rather than `readFileSync(path, "utf8")` plus a `charCodeAt`
+  // walk. Not for speed — both are 53 ms on a 35 MB transcript — but because
+  // the old one held the loop for every one of those milliseconds, and this one
+  // hands it back nine times. The yields inside it are explicit `setTimeout`s
+  // and have to be: awaiting the stream alone resolves as microtasks and blocks
+  // just as hard. See `file-lines.ts`.
   let jsonlSizeBytes: number | null = null;
   let jsonlLines: number | null = null;
   if (exists && jsonlPath) {
     try {
       const st = statSync(jsonlPath);
       jsonlSizeBytes = st.size;
-      if (st.size <= 64 * 1024 * 1024) {
-        const text = readFileSync(jsonlPath, "utf8");
-        let n = 0;
-        for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) n++;
-        if (text.length > 0 && text.charCodeAt(text.length - 1) !== 10) n++;
-        jsonlLines = n;
-      }
+      if (st.size <= 64 * 1024 * 1024) jsonlLines = await countLines(jsonlPath);
     } catch { /* stat/read failure — omit weight fields */ }
   }
   // PPM session ID == SDK session ID (canonical — see claude-agent-sdk.ts:728).
@@ -1000,11 +1002,13 @@ chatRoutes.get("/pre-compact-messages", async (c) => {
     // Codex rollouts live under ~/.codex/sessions (different format + jail than Claude JSONL).
     const { isCodexRolloutPath, getCodexPreCompactMessages } = await import("../../providers/codex-app-server/codex-history.ts");
     if (isCodexRolloutPath(jsonlPath)) {
-      const messages = getCodexPreCompactMessages(jsonlPath, c.get("projectPath"));
+      const messages = getCodexPreCompactMessages(jsonlPath, c.get("projectPath"), beforeUuid);
       return c.json(ok(messages));
     }
     const validated = validateJsonlPath(jsonlPath);
-    const messages = await parseJsonlTranscript(validated, beforeUuid);
+    // One compaction segment per request: the client walks further back by
+    // expanding the summary that arrives at the head of each one.
+    const messages = await parseJsonlTranscript(validated, beforeUuid, { oneSegment: true });
     return c.json(ok(messages));
   } catch (e) {
     const message = e instanceof Error ? e.message : "Unknown error";

package/src/server/routes/git.ts

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { gitService } from "../../services/git.service.ts";
 import { gitHunksService, type HunkRequest, type HunkScope } from "../../services/git-hunks/git-hunks.service.ts";
 import { assertSafeRev, gitBlameService } from "../../services/git-blame/git-blame.service.ts";
+import { branchDiff } from "../../services/git-branch-diff/branch-diff.service.ts";
 import { discoverGitRepos, isGitRepo } from "../../services/git-repos/git-repo-discovery.ts";
 import { isInsideDir, realPathOrSelfSync } from "../../services/fs-ops/fs-real-path.ts";
 import { ok, err } from "../../types/api.ts";
@@ -128,6 +129,32 @@ gitRoutes.get("/diff-stat", async (c) => {
   }
 });
 
+/**
+ * GET /git/branch-diff?base=&head=&mode=three-dot|two-dot
+ *
+ * Every file a branch changed, in one answer, plus the commit those changes
+ * were measured against. The Branch Review tab opens each file's diff at
+ * `mergeBase`, so the list and the viewer can never disagree about the base.
+ *
+ * A bad ref is a 400, not a 500: `base` and `head` come straight from a picker,
+ * and a branch deleted since it was rendered is an ordinary thing to ask about.
+ */
+gitRoutes.get("/branch-diff", async (c) => {
+  const projectPath = c.get("projectPath");
+  const mode = c.req.query("mode") === "two-dot" ? "two-dot" : "three-dot";
+  try {
+    const result = await branchDiff(
+      projectPath,
+      c.req.query("base"),
+      c.req.query("head"),
+      mode,
+    );
+    return c.json(ok(result));
+  } catch (e) {
+    return c.json(err((e as Error).message), 400);
+  }
+});
+
 /** GET /git/file-diff?file=&ref= */
 gitRoutes.get("/file-diff", async (c) => {
   try {
@@ -144,9 +171,11 @@ gitRoutes.get("/file-diff", async (c) => {
   }
 });
 
-/** GET /git/file-full-diff?file=&ref=
+/** GET /git/file-full-diff?file=&ref=&ref2=&text=1
  *  Returns full file contents (VSCode-style) for both sides:
- *  { original: <ref version>, modified: <working tree> } */
+ *  { original: <ref version>, modified: <working tree> }
+ *  A binary file answers `binary: true` with both sides empty; `text=1` is the
+ *  viewer's "Open Anyway" and asks for the decoded bytes regardless. */
 gitRoutes.get("/file-full-diff", async (c) => {
   try {
     const projectPath = c.get("projectPath");
@@ -156,13 +185,64 @@ gitRoutes.get("/file-full-diff", async (c) => {
     const ref2 = c.req.query("ref2") || undefined;
     const bad = invalidRev(ref, ref2);
     if (bad) return c.json(err(bad), 400);
-    const result = await gitService.fileFullDiff(projectPath, file, ref, ref2);
+    const result = await gitService.fileFullDiff(projectPath, file, ref, ref2, {
+      text: c.req.query("text") === "1",
+    });
     return c.json(ok(result));
   } catch (e) {
     return c.json(err((e as Error).message), 500);
   }
 });
 
+/**
+ * The content types `/git/file-blob` will name. Everything outside this list is
+ * served as `application/octet-stream`: a blob URL inherits *this* origin, so
+ * answering with the repository's own `text/html` — or `image/svg+xml`, which
+ * carries script — would let a committed file run code inside the app.
+ */
+const BLOB_IMAGE_TYPES: Record<string, string> = {
+  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+  webp: "image/webp", bmp: "image/bmp", ico: "image/x-icon", avif: "image/avif",
+};
+
+/**
+ * GET /git/file-blob?file=&ref=HEAD — the file's bytes at a revision.
+ *
+ * What the binary diff view draws its left-hand pane from: `/files/raw` serves
+ * the working tree, and nothing else reaches the version a commit holds. The
+ * path needs no traversal check of its own — git resolves `ref:path` inside the
+ * repository and refuses anything above it ("is outside repository").
+ */
+gitRoutes.get("/file-blob", async (c) => {
+  try {
+    const projectPath = c.get("projectPath");
+    const file = c.req.query("file");
+    if (!file) return c.json(err("Missing query: file"), 400);
+    const ref = c.req.query("ref") || "HEAD";
+    // The same guard as every sibling route, and it is not decoration here: `ref` reaches
+    // `git show` as its own argv word, so `?ref=--output=<path>` is an option rather than a
+    // revision. Measured on a scratch repository, `git show --output=<victim> HEAD:a.txt`
+    // exits 0 and leaves the victim at zero bytes — arbitrary file destruction, on a server
+    // that is routinely reachable through a public tunnel URL.
+    const bad = invalidRev(ref);
+    if (bad) return c.json(err(bad), 400);
+    const bytes = await gitService.fileBlob(projectPath, file, ref);
+    if (!bytes) return c.json(err("File does not exist at that revision"), 404);
+    const ext = file.split(".").pop()?.toLowerCase() ?? "";
+    // Copied into a plain Uint8Array because a Buffer is typed over
+    // ArrayBufferLike, which BodyInit does not accept.
+    return new Response(new Uint8Array(bytes), {
+      headers: {
+        "Content-Type": BLOB_IMAGE_TYPES[ext] ?? "application/octet-stream",
+        "Content-Length": String(bytes.length),
+        "X-Content-Type-Options": "nosniff",
+      },
+    });
+  } catch (e) {
+    return c.json(err((e as Error).message), 500);
+  }
+});
+
 /** GET /git/graph?max=200&skip=0 */
 gitRoutes.get("/graph", async (c) => {
   try {

package/src/server/routes/remote-desktop.ts

@@ -10,7 +10,7 @@
 import { Hono, type Context } from "hono";
 import { ok, err } from "../../types/api.ts";
 import { configService } from "../../services/config.service.ts";
-import { getFfmpegCapabilities } from "../../services/media-transcode/ffmpeg-capabilities.ts";
+import { getFfmpegCapabilities, workingEncoders } from "../../services/media-transcode/ffmpeg-capabilities.ts";
 import { isRemoteDesktopEnabled } from "../../services/remote-desktop/remote-desktop-flag.ts";
 import { mintRemoteDesktopNonce } from "../../services/remote-desktop/remote-desktop-nonce.ts";
 import { listDisplays } from "../../services/remote-desktop/remote-desktop-displays.ts";
@@ -51,9 +51,14 @@ function assertSessionAllowed(c: Context): Response | null {
 
 remoteDesktopRoutes.get("/capabilities", async (c) => {
   if (!isRemoteDesktopEnabled()) return c.json(err("remote desktop is disabled"), 404);
-  const [caps, readiness, displays] = await Promise.all([getFfmpegCapabilities(), remoteDesktopReadiness(), listDisplays()]);
+  const [caps, readiness, displays, encoders] = await Promise.all([
+    getFfmpegCapabilities(), remoteDesktopReadiness(), listDisplays(), workingEncoders(),
+  ]);
   return c.json(ok({
     displays,
+    // Every encoder that really encodes here, preference order, for the codec picker. The
+    // first is what a session uses unless the client names another.
+    encoders,
     // Flat booleans kept for existing clients/tests; `readiness` is the source of truth.
     ffmpegAvailable: !!caps.ffmpeg,
     videoAvailable: readiness.videoReady,

package/src/server/ws/global.ts

@@ -58,7 +58,7 @@ function setWatch(ws: GlobalWsSocket, projectName: string): void {
   const project = configService.get("projects").find((p) => p.name === projectName);
   if (!project) return;
 
-  startWatching(projectName, project.path);
+  void startWatching(projectName, project.path);
   watchedProject.set(ws, projectName);
 }
 

package/src/server/ws/remote-desktop.ts

@@ -6,9 +6,11 @@
  * token already travels as `?token=` on every WS URL (`isWsUpgradeAuthorized`,
  * `src/server/index.ts`) and proves nothing beyond "holds the one reusable app token", so a
  * single-use short-TTL nonce (`POST /api/remote-desktop/session`) must be presented as the
- * client's *first* message — `{type:"auth", nonce, displayId?}` — before capture or input
- * starts. `displayId` picks one of `/capabilities`' `displays`; absent/unknown = primary. Kept out
- * of the query string (unlike the coarse token) so it never lands in proxy/tunnel access logs.
+ * client's *first* message — `{type:"auth", nonce, displayId?, cursor?, codec?}` — before
+ * capture or input starts. `displayId` picks one of `/capabilities`' `displays`; absent/unknown = primary.
+ * `cursor` and `codec` carry the client's saved cursor and encoder prefs, because ffmpeg takes
+ * both at startup and applying them afterwards would respawn it on every connect. Kept out of
+ * the query string (unlike the coarse token) so they never land in proxy/tunnel access logs.
  *
  * Both the feature flag and `auth.enabled` are re-checked here even though
  * `src/server/index.ts` already gated the upgrade on them — this handler must never depend on
@@ -58,8 +60,13 @@ async function authenticateFirstMessage(ws: RemoteDesktopWs, text: string): Prom
       getBufferedAmount: ws.getBufferedAmount ? () => ws.getBufferedAmount!() : undefined,
       close: (code, reason) => ws.close(code, reason),
     };
-    const displayId = typeof parsed.displayId === "string" ? parsed.displayId : undefined;
-    ws.data.session = await createRemoteDesktopSession(socket, displayId);
+    ws.data.session = await createRemoteDesktopSession(socket, {
+      displayId: typeof parsed.displayId === "string" ? parsed.displayId : undefined,
+      // Only an explicit `false` hides it: an older client sends no flag at all and must keep
+      // getting the pointer it has always had.
+      showCursor: parsed.cursor !== false,
+      encoder: typeof parsed.codec === "string" ? parsed.codec : undefined,
+    });
   } catch (e) {
     console.error(`[remote-desktop] failed to start capture: ${(e as Error).message}`);
     ws.send(JSON.stringify({ type: "error", message: (e as Error).message }));

package/src/services/binary-content.ts

@@ -0,0 +1,25 @@
+/**
+ * Is this file content binary?
+ *
+ * The answer has to be taken from *bytes*. `git show` hands simple-git a string
+ * decoded as UTF-8, and a PNG survives that as megabytes of U+FFFD — which is
+ * exactly what the diff editor used to render, line-numbered and highlighted,
+ * for every image in a commit.
+ */
+
+/** git's own window (`buffer_is_binary`, FIRST_FEW_BYTES in xdiff-interface.c). */
+export const BINARY_SNIFF_BYTES = 8000;
+
+/**
+ * True when `bytes` looks binary — a NUL inside the first 8000 bytes.
+ *
+ * The same rule git applies when it prints "Binary files differ" instead of a
+ * diff, and the same shape as `file.service`'s check for whether to answer
+ * base64, so the diff view and the editor agree about any given file. A side
+ * that does not exist (`null`) is not binary: an added file has no old version,
+ * and that alone must not send the pair down the binary path.
+ */
+export function isBinaryContent(bytes: Uint8Array | null | undefined): boolean {
+  if (!bytes) return false;
+  return bytes.subarray(0, BINARY_SNIFF_BYTES).includes(0);
+}

package/src/services/chat-search.service.ts

@@ -188,7 +188,7 @@ export async function indexSession(
   projectPath: string,
   jsonlMtime = 0,
 ): Promise<void> {
-  const messages = await chatService.getMessages(providerId, sessionId);
+  const messages = await chatService.getFullMessages(providerId, sessionId);
   indexMessages(sessionId, projectPath, messages, jsonlMtime);
 }
 

package/src/services/chat.service.ts

@@ -201,6 +201,15 @@ class ChatService {
       ? { ...message, content: stripSharedContext(message.content) }
       : message);
   }
+
+  /** Whole transcript rather than the resumable conversation, for the search index.
+   *  Falls back to the conversation for a provider that draws no distinction. */
+  async getFullMessages(providerId: string, sessionId: string): Promise<ChatMessage[]> {
+    const provider = providerRegistry.get(providerId);
+    if (!provider) return [];
+    if (provider.getFullMessages) return await provider.getFullMessages(sessionId);
+    return await provider.getMessages?.(sessionId) ?? [];
+  }
 }
 
 export const chatService = new ChatService();