@kabmo-labs/kabmo 0.7.0 → 0.9.0

package/src/client/tailwind.css

@@ -245,6 +245,25 @@
   }
 }
 
+/* The Files panel's tree, on a finger.
+ *
+ * Every row is `select-none`, but a long press on iOS/Android still raises the
+ * native callout and a selection of the CONTAINER's text — measured on a phone:
+ * holding a file row highlighted the whole panel instead of opening its menu.
+ * `user-select` alone does not stop it; `-webkit-touch-callout` is what removes
+ * the callout menu, and `user-select: none` on the scroller (not only the rows)
+ * is what keeps a press that drifts between two rows from selecting the text of
+ * both. Rows themselves stay `select-none` and no row carries `select-text`:
+ * a path is copied through the context menu's Copy Path, never by dragging over
+ * it, and a selectable row makes every press a candidate for a selection.
+ */
+.file-tree-touch,
+.file-tree-touch * {
+  -webkit-touch-callout: none;
+  -webkit-user-select: none;
+  user-select: none;
+}
+
 /* Horizontally scrollable strips (mobile tab bars) that pan without a visible
  * scrollbar track eating vertical space. */
 .no-scrollbar {
@@ -365,6 +384,43 @@
 .shiki span { color: var(--shiki-light); }
 html[data-theme-variant="dark"] .shiki span { color: var(--shiki-dark); }
 
+/* No per-token underline in a diff.
+ *
+ * `@codemirror/merge` wraps the characters that changed in `.cm-changedText`
+ * (and a deleted chunk's in `.cm-deletedText`) and its BASE THEME paints a 2px
+ * gradient along the bottom of each fragment. A word-level change is usually
+ * several fragments — `2` → `22` is one — so the reader got a run of short
+ * coloured bars under the code that reads as a second, broken baseline rather
+ * than as emphasis. The row's own band and the gutter marker already say which
+ * side a row belongs to.
+ *
+ * Three facts about how this has to be written, each measured:
+ *
+ * 1. **It cannot be suppressed from the panel's own `EditorView.theme`.** That
+ *    theme rejects the `&light`/`&dark` selectors the package's rules are spelled
+ *    with (`RangeError: Unsupported selector: &light`, which took the whole
+ *    merge view down and left an empty host).
+ * 2. **A plain `.cm-changedText { background: none }` LOSES.** The package's rule
+ *    is `.ͼ2.cm-merge-b .cm-changedText` — two classes on the root plus one on the
+ *    span, i.e. specificity (0,3,0) — and CodeMirror mounts its style modules
+ *    after this sheet, so document order is against us as well.
+ * 3. **So the selector carries three class-level parts of its own** (`.cm-editor`
+ *    + `.cm-merge-b`/`.cm-merge-a` + the span class), which wins on specificity
+ *    rather than by `!important` — an `!important` here would also beat a
+ *    future theme that legitimately wants a different treatment, and this is a
+ *    cosmetic suppression, not a hard override.
+ *
+ * `diff-panel.e2e.ts` asserts the computed `background-image` on a real changed
+ * token, so a package bump that reintroduces the bar fails there rather than in
+ * a screenshot review. */
+.cm-editor.cm-merge-a .cm-changedText,
+.cm-editor.cm-merge-b .cm-changedText,
+.cm-editor.cm-merge-a .cm-deletedChunk .cm-deletedText,
+.cm-editor.cm-merge-b .cm-deletedChunk .cm-deletedText,
+.cm-editor .cm-deletedChunk .cm-deletedText {
+  background: none;
+}
+
 /* Find matches, painted inside the token spans the highlighter emits. An
  * inline <mark> colours a background without moving a glyph, which is what
  * keeps the transparent <textarea> above aligned with this layer — a block or
@@ -381,14 +437,6 @@ html[data-theme-variant="dark"] .shiki span { color: var(--shiki-dark); }
   color: inherit;
   background: color-mix(in srgb, var(--theme-warning) 32%, transparent);
 }
-/* An extra ⌘D selection: same geometry as a find match, different ink. The
- * caret can only live in the primary range, so the two must not look alike —
- * the user has to see where their keystrokes will land. */
-.shiki .find-match[data-occurrence] {
-  background: color-mix(in srgb, var(--theme-info) 30%, transparent);
-  border-top: 1px solid color-mix(in srgb, var(--theme-info) 55%, transparent);
-  border-bottom: 1px solid color-mix(in srgb, var(--theme-info) 55%, transparent);
-}
 .shiki .find-match[data-find-current] {
   background: color-mix(in srgb, var(--theme-warning) 55%, transparent);
   border-top: 1px solid color-mix(in srgb, var(--theme-warning) 75%, transparent);

package/src/server/index.ts

@@ -268,7 +268,9 @@ startWaitingRuntime();
  *
  * A Kabmo update replaces the store and leaves the install — it is a
  * copied directory of ordinary files — so this is the only thing that notices.
- * It is version-gated and skips git clones, so a plugin the user installed from
+ * An install Kabmo wrote is compared by CONTENT, so a shipped fix applies even
+ * when its version did not move; a directory of unknown provenance keeps the
+ * version gate, and git clones are skipped, so a plugin the user installed from
  * a URL is never overwritten by a store entry that happens to share its id.
  *
  * BEFORE the server halves load, and that order is the whole point: a plugin's
@@ -283,7 +285,10 @@ startWaitingRuntime();
 try {
   const synced = await syncBundledPlugins();
   for (const item of synced.updated) {
-    console.log(`[kabmo] plugins:        synced ${item.pluginId} ${item.from} → ${item.to}`);
+    // A content-only sync has no version to show, and printing `1.0.0 → 1.0.0`
+    // would read as a no-op when a shipped fix actually landed.
+    const span = item.contentOnly ? `${item.to} (content changed, version unchanged)` : `${item.from} → ${item.to}`;
+    console.log(`[kabmo] plugins:        synced ${item.pluginId} ${span}`);
     if (item.warning) console.error(`[plugins] ${item.pluginId}: rebuild after sync failed — ${item.warning}`);
   }
   for (const failure of synced.failed) console.error(`[plugins] ${failure.pluginId}: bundled sync failed — ${failure.error}`);

package/src/server/lib/auth/guard.test.ts

@@ -30,6 +30,18 @@ describe('public paths', () => {
     expect(isPublicPath('/login')).toBe(true);
   });
 
+  /**
+   * The two shells ask their update check from native code, which has no
+   * session cookie — and the button is for a shell so stale it may not be able
+   * to load the console at all. Gating these answered `401` to every shell on a
+   * password-protected console, which the settings screen could only report as
+   * "Could not ask the server" (measured against a real install).
+   */
+  test('the native shells can ask what is published without a session', () => {
+    expect(isPublicPath('/api/updates/android')).toBe(true);
+    expect(isPublicPath('/api/updates/ios')).toBe(true);
+  });
+
   test('the assets the login screen is built from are public', () => {
     for (const path of [
       '/_dev-assets/client/index-abc.js',
@@ -153,6 +165,22 @@ describe('authentication is per run, never inherited from disk', () => {
     expect(response?.status).toBe(401);
   });
 
+  /**
+   * The bug this pins: both shells ask their update check from NATIVE code,
+   * which carries no cookie, so a password-protected console answered `401` and
+   * the settings screen could only say "Could not ask the server" (measured on a
+   * real install). The desktop route stays gated because the CONSOLE asks it,
+   * and the console is behind the login.
+   */
+  test('a password does not gate the native shells\u2019 update check', async () => {
+    useTempDataDir();
+    await initAuth('correct-horse');
+
+    expect(authGate(new Request('http://localhost/api/updates/android'))).toBeUndefined();
+    expect(authGate(new Request('http://localhost/api/updates/ios'))).toBeUndefined();
+    expect(authGate(new Request('http://localhost/api/updates/desktop?kind=macos'))?.status).toBe(401);
+  });
+
   test('a document request is redirected to the login screen, not answered 401', async () => {
     useTempDataDir();
     await initAuth('correct-horse');

package/src/server/lib/auth/guard.ts

@@ -41,6 +41,16 @@ const LOGIN_PATH = '/login';
 /** Paths that never require a session, because they ARE the way in. */
 const PUBLIC_EXACT = new Set([
   '/api/health',
+  // The native shells' own update check. Android and iOS ask these from
+  // NATIVE code (`AppUpdateCheck.kt`, `SettingsViewController.fetchRelease`),
+  // which carries no WebView cookie — and the button exists precisely for a
+  // shell too stale to load the console, so it cannot depend on a session
+  // either. Both answer GitHub's public release list (a version and a download
+  // URL), which is the same data an unauthenticated browser can read from
+  // github.com; `/api/updates/desktop` stays gated because only the CONSOLE
+  // asks it, and the console is behind the login.
+  '/api/updates/android',
+  '/api/updates/ios',
   '/api/auth/state',
   '/api/auth/login',
   '/api/auth/logout',

package/src/server/lib/bundler/titlebar-css.test.ts

@@ -50,11 +50,21 @@ describe('window-drag contract', () => {
   /**
    * The shell's hit test starts at the element under the pointer and walks up.
    * A header without the attribute is a header that cannot move the window.
+   *
+   * EVERY header that can be the window's top strip is listed, not just the
+   * desktop pair. A desktop shell window may be narrower than `App`'s 768px
+   * layout breakpoint (all three shells allow 720px), so the phone layout's
+   * headers are title bars too — and the mobile ones were missing the attribute
+   * entirely, which on macOS left a narrowed window with no draggable strip in
+   * its main screen and no way to move it.
    */
-  test('both title-bar headers carry data-drag-region', () => {
+  test('every title-bar header carries data-drag-region', () => {
     for (const path of [
       'src/client/components/layout/desktop-layout/TopNavbar.tsx',
       'src/client/components/layout/session-sidebar/Header.tsx',
+      'src/client/components/mobile/mobile-main-view/Header.tsx',
+      'src/client/components/mobile/mobile-session-sidebar/Header.tsx',
+      'src/client/components/mobile/RightSidebar.tsx',
     ]) {
       const file = source(path);
       expect(file).toContain('dragRegionProps()');
@@ -63,6 +73,37 @@ describe('window-drag contract', () => {
     expect(source('src/client/lib/desktop/titlebar.ts')).toContain("'data-drag-region'");
   });
 
+  /**
+   * The phone headers reserve the shell's own inset, not only the PWA's.
+   *
+   * `titlebarPaddingLeft` reads `env(titlebar-area-x)`, which a native WKWebView
+   * never defines — so the shell's 76px of traffic lights has to come from
+   * `titlebarInsetLeft`, the helper the desktop headers already use. Without it
+   * the phone header's hamburger and wordmark sat UNDER the traffic lights.
+   */
+  test('the phone headers use the shell inset', () => {
+    for (const path of [
+      'src/client/components/mobile/mobile-main-view/Header.tsx',
+      'src/client/components/mobile/mobile-session-sidebar/Header.tsx',
+      'src/client/components/mobile/RightSidebar.tsx',
+    ]) {
+      expect(source(path)).toContain('titlebarInsetLeft(');
+    }
+  });
+
+  /**
+   * A header marked as a drag region makes its controls drag handles unless
+   * they say otherwise — `app-region` INHERITS (WebView2's spec, enforced by
+   * Chromium 152), and a drag handle swallows the click.
+   */
+  test('a drag-region header marks its controls no-drag', () => {
+    const pairs: Array<[string, string]> = [
+      ['src/client/components/mobile/RightSidebar.tsx', 'titlebar-no-drag'],
+      ['src/client/components/common/header-controls/index.tsx', 'titlebar-no-drag'],
+    ];
+    for (const [path, marker] of pairs) expect(source(path)).toContain(marker);
+  });
+
   /** The PWA keeps its drag region: the property has to reach the browser. */
   test('the webkit property survives the bundle', async () => {
     const out = await build(`

package/src/server/lib/db/schema.ts

@@ -18,6 +18,7 @@ import { ensureScheduleSchema } from '@/server/lib/schedule/schema.server';
 import { ensureWaitingSchema } from '@/server/lib/waiting/schema.server';
 import { ensurePluginSchema } from '@/server/lib/plugins/schema.server';
 import { ensureModelRolePresetSchema } from '@/server/lib/model-roles/schema.server';
+import { ensureWorktreeSchema } from '@/server/lib/db/worktree-registry.server';
 import { migrateWorkspaceFolderColumns } from '@/shared/lib/workspace/schema-migrations';
 import { migrateSessionStreamStateColumns } from '@/shared/lib/omp/session/schema-migrations';
 
@@ -112,6 +113,9 @@ export async function initSchema(db: DbClient): Promise<void> {
   await ensurePluginSchema(db);
   // Named model-role presets (the role editor's preset picker).
   await ensureModelRolePresetSchema(db);
+  // Worktree registry: the ref each worktree branched from, and the identity
+  // cache that keys its folder.
+  await ensureWorktreeSchema(db);
 
   await db.exec(`
     CREATE TABLE IF NOT EXISTS files (

package/src/server/lib/db/worktree-registry.server.ts

@@ -0,0 +1,91 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The `worktrees` table: one row per worktree Kabmo created.
+ *
+ * Everything a worktree row shows is read from git — except two things this
+ * table is the only home for:
+ *
+ *  - **`start_ref`**, the ref the branch was created from. `aheadOfStart` gates
+ *    the delete dialog's branch checkbox, and git cannot answer it later: the
+ *    branch has moved on, and for an existing-branch worktree there was no start
+ *    ref at all.
+ *  - **`project_id`**, the repository's identity, which is what the default
+ *    root is keyed by. It is a CACHE, not a derivation result: the derivation
+ *    moves when a repository gains an unrelated root commit (see
+ *    `worktree/project-id.ts`), so a stored value always wins.
+ */
+
+import type { DbClient } from '@/server/lib/db/client';
+
+const WORKTREE_SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS worktrees (
+    path TEXT PRIMARY KEY,
+    primary_root TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    branch TEXT NOT NULL,
+    start_ref TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_worktrees_primary ON worktrees (primary_root);
+`;
+
+export interface WorktreeRow {
+  path: string;
+  primary_root: string;
+  project_id: string;
+  branch: string;
+  start_ref: string;
+  created_at: string;
+}
+
+/** Idempotent: the worktree registry, created on every database open. */
+export async function ensureWorktreeSchema(db: DbClient): Promise<void> {
+  await db.exec(WORKTREE_SCHEMA_SQL);
+}
+
+/**
+ * The identity cache: the project id already recorded for this repository.
+ * `LIMIT 1` because every row of one repository carries the same value.
+ */
+export async function worktreeIdentityFor(db: DbClient, primaryRoot: string): Promise<string | null> {
+  try {
+    const row = await db.get<{ project_id: string }>(
+      'SELECT project_id FROM worktrees WHERE primary_root = ? LIMIT 1',
+      [primaryRoot],
+    );
+    return typeof row?.project_id === 'string' && row.project_id ? row.project_id : null;
+  } catch {
+    // A database that cannot answer is not a reason to refuse the operation:
+    // the derivation still gives a usable key.
+    return null;
+  }
+}
+
+export async function worktreeRowFor(db: DbClient, worktreePath: string): Promise<WorktreeRow | undefined> {
+  return db.get<WorktreeRow>('SELECT * FROM worktrees WHERE path = ?', [worktreePath]);
+}
+
+export async function listWorktreeRows(db: DbClient, primaryRoot: string): Promise<WorktreeRow[]> {
+  return db.all<WorktreeRow>('SELECT * FROM worktrees WHERE primary_root = ?', [primaryRoot]);
+}
+
+export async function putWorktreeRow(db: DbClient, row: WorktreeRow): Promise<void> {
+  await db.run(
+    `INSERT INTO worktrees (path, primary_root, project_id, branch, start_ref, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(path) DO UPDATE SET
+       primary_root = excluded.primary_root,
+       project_id = excluded.project_id,
+       branch = excluded.branch,
+       start_ref = excluded.start_ref`,
+    [row.path, row.primary_root, row.project_id, row.branch, row.start_ref, row.created_at],
+  );
+}
+
+export async function removeWorktreeRow(db: DbClient, worktreePath: string): Promise<void> {
+  await db.run('DELETE FROM worktrees WHERE path = ?', [worktreePath]);
+}

package/src/server/lib/fs/canonical.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Canonical paths and containment for filesystem work.
+ *
+ * Two traps this exists to close, both measured:
+ *
+ *  - **A spelling difference is not a difference.** On macOS git prints
+ *    `/private/tmp/...` for a directory the caller typed as `/tmp/...`, and
+ *    `path.resolve` alone does not reconcile them. A worktree compared against
+ *    its own entry answered "not inside", so the session badge silently never
+ *    appeared.
+ *  - **A missing path cannot be `realpath`'d at all** — and that is exactly the
+ *    `missing` worktree, whose directory was removed outside Kabmo. Resolving
+ *    the nearest existing ANCESTOR and re-appending the tail is what lets such a
+ *    worktree still be matched against the entry git keeps listing.
+ *
+ * Everything that compares two paths goes through here; `isWithinRoot` in
+ * `lib/fs/root.ts` stays the raw prefix test it always was.
+ */
+
+import path from 'path';
+import { realpath } from 'fs/promises';
+
+/** Absolute, symlink-resolved, no trailing separator. */
+export async function canonicalPath(target: string): Promise<string> {
+  const absolute = path.resolve(target).replace(/\/+$/, '');
+  const pending: string[] = [];
+  let cursor = absolute;
+  while (true) {
+    try {
+      const resolved = (await realpath(cursor)).replace(/\/+$/, '');
+      return pending.length > 0 ? [resolved, ...pending].join(path.sep) : resolved;
+    } catch {
+      const parent = path.dirname(cursor);
+      // The whole ancestor chain is gone (or this is the filesystem root): the
+      // `..`-folded path is the best answer that exists.
+      if (parent === cursor) return absolute;
+      pending.unshift(path.basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+
+/** True when `target` is `root` itself or lies inside it. Both are canonicalized. */
+export async function pathHolds(root: string, target: string): Promise<boolean> {
+  const [canonicalRoot, canonicalTarget] = await Promise.all([canonicalPath(root), canonicalPath(target)]);
+  return canonicalTarget === canonicalRoot || canonicalTarget.startsWith(`${canonicalRoot}${path.sep}`);
+}

package/src/server/lib/fs/relative-path.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * One rule for every name the Files panel WRITES: a path relative to the folder
+ * that was named, nested segments allowed, and nothing that can leave it.
+ *
+ * The panel's create and rename both used to accept a bare name only, which made
+ * a nested path unreachable from the UI: creating `src/lib/parse.ts` meant
+ * creating `src`, expanding it, then `lib`, then the file. The restriction was
+ * never about safety — `resolveWithinRoot` already refuses an escape — it was
+ * the shape of the input field, so the grammar is now stated once and both
+ * callers read it.
+ *
+ * What is refused, and why each one is a distinct decision:
+ *
+ * - an ABSOLUTE path (`/etc/passwd`, `C:\x`): `path.join(dir, abs)` discards the
+ *   folder the user named, so the write would land somewhere the dialog never
+ *   showed. `resolveWithinRoot` catches most of it, but a drive-relative `C:x`
+ *   normalizes under the root and would silently create a file named `C:x`.
+ * - any `..` SEGMENT: the escape itself. `resolveWithinRoot` would refuse a
+ *   result outside the root, but `a/../b.ts` resolves INSIDE it, so the refusal
+ *   would be about the wrong thing — the user would get "Invalid path" for a
+ *   path that looks fine.
+ * - a NUL byte: it truncates the path at the syscall boundary.
+ *
+ * A backslash is treated as a separator rather than refused: a Windows user
+ * types `src\lib\x.ts` into the same field, and refusing it would be a rule the
+ * field cannot explain. Empty and `.` segments are dropped, so `src//x.ts` and
+ * `./src/x.ts` name the same file as `src/x.ts`.
+ *
+ * Returns the normalized POSIX-relative path, or null when it names nothing.
+ */
+export function normalizeRelativePath(raw: string): string | null {
+  const trimmed = raw.trim().replace(/\\/g, '/');
+  if (!trimmed || trimmed.includes('\0')) return null;
+  if (trimmed.startsWith('/') || /^[a-zA-Z]:/.test(trimmed)) return null;
+
+  const segments: string[] = [];
+  for (const segment of trimmed.split('/')) {
+    if (segment === '' || segment === '.') continue;
+    if (segment === '..') return null;
+    segments.push(segment);
+  }
+  return segments.length > 0 ? segments.join('/') : null;
+}

package/src/server/lib/fs/root-worktree.test.ts

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The WORKTREE branch of the scoped-root allow-list.
+ *
+ * A chat started in a linked checkout runs THERE, outside its folder's
+ * `project_path` — and `resolveRoot` answered the fallback for it (measured), so
+ * Files/Search/Git/Terminal silently showed the app root while the agent wrote
+ * to the worktree.
+ *
+ * The rule is deliberately narrow: the candidate's own REPOSITORY ROOT must be a
+ * registered project, so a registered project never becomes a filesystem grant.
+ * A SUBDIRECTORY of a registered checkout stays refused — the allow-list is exact
+ * roots, and a panel is pointed at a worktree root, never at a folder inside it.
+ *
+ * Its own file, with its own database, because it needs a REAL git repository:
+ * `resolveProjectRoot` only answers for a directory holding a `.git` entry, and
+ * faking that would test the fake.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveRoot } from '@/server/lib/fs/root';
+import { getDb } from '@/server/db.server';
+import { isolateDb, releaseDb } from '@/test-support/isolated-db';
+import { removeDir } from '@/test-support/remove-dir';
+
+const GIT_ENV = { ...Bun.env, GIT_EDITOR: 'true', GIT_TERMINAL_PROMPT: '0' };
+
+function git(cwd: string, ...args: string[]): string {
+  return Bun.spawnSync({ cmd: ['git', ...args], cwd, env: GIT_ENV }).stdout.toString();
+}
+
+function makeRepo(dir: string): string {
+  mkdirSync(dir, { recursive: true });
+  git(dir, 'init', '-q', '-b', 'main', '.');
+  git(dir, 'config', 'user.email', 'test@example.invalid');
+  git(dir, 'config', 'user.name', 'Test');
+  writeFileSync(join(dir, 'f.txt'), 'a\n');
+  git(dir, 'add', '-A');
+  git(dir, 'commit', '-q', '-m', 'base');
+  return dir;
+}
+
+let workRoot: string;
+const saved = { SYNC_WORKSPACE: Bun.env.SYNC_WORKSPACE, MOCK: Bun.env.MOCK };
+
+beforeEach(async () => {
+  await isolateDb();
+  Bun.env.SYNC_WORKSPACE = 'false';
+  Bun.env.MOCK = 'false';
+  workRoot = mkdtempSync(join(tmpdir(), 'kabmo-root-worktree-'));
+});
+
+afterEach(async () => {
+  await releaseDb();
+  removeDir(workRoot);
+  for (const [key, value] of Object.entries(saved)) {
+    if (value === undefined) delete Bun.env[key];
+    else Bun.env[key] = value;
+  }
+});
+
+describe('resolveRoot and worktrees', () => {
+  test('a linked worktree of a registered project is allowed', async () => {
+    const repo = makeRepo(join(workRoot, 'repo'));
+    const linked = join(workRoot, 'linked-wt');
+    git(repo, 'worktree', 'add', '-q', '-b', 'feat', linked);
+
+    const db = await getDb();
+    await db.run('INSERT INTO workspace_folders (name, project_path) VALUES (?, ?)', ['proj', repo]);
+
+    expect(await resolveRoot(linked, '/fallback')).toBe(linked);
+  });
+
+  test('a SUBDIRECTORY of a registered checkout is still refused', async () => {
+    const repo = makeRepo(join(workRoot, 'repo-sub'));
+    const sub = join(repo, 'src');
+    mkdirSync(sub, { recursive: true });
+
+    const db = await getDb();
+    await db.run('INSERT INTO workspace_folders (name, project_path) VALUES (?, ?)', ['proj', repo]);
+
+    // The allow-list is EXACT roots. Panels point at a worktree root, which is
+    // what the new branch admits; widening it to subdirectories would turn a
+    // registered project into a filesystem grant for anything beneath it.
+    expect(await resolveRoot(sub, '/fallback')).toBe('/fallback');
+  });
+
+  test('a worktree of an UNREGISTERED repository is refused', async () => {
+    const registered = makeRepo(join(workRoot, 'registered'));
+    const stranger = makeRepo(join(workRoot, 'stranger'));
+    const strangerWt = join(workRoot, 'stranger-wt');
+    git(stranger, 'worktree', 'add', '-q', '-b', 's', strangerWt);
+
+    const db = await getDb();
+    await db.run('INSERT INTO workspace_folders (name, project_path) VALUES (?, ?)', ['proj', registered]);
+
+    expect(await resolveRoot(strangerWt, '/fallback')).toBe('/fallback');
+    expect(await resolveRoot(stranger, '/fallback')).toBe('/fallback');
+  });
+
+  test('an exact registered project path is still honored, and a missing one falls back', async () => {
+    const repo = makeRepo(join(workRoot, 'exact'));
+    const db = await getDb();
+    await db.run('INSERT INTO workspace_folders (name, project_path) VALUES (?, ?)', ['proj', repo]);
+
+    expect(await resolveRoot(repo, '/fallback')).toBe(repo);
+    expect(await resolveRoot(join(workRoot, 'gone'), '/fallback')).toBe('/fallback');
+  });
+});

package/src/server/lib/fs/root.ts

@@ -14,6 +14,8 @@
 import path from 'path';
 import { getDb } from '@/server/db.server';
 import { pathExists } from '@/server/lib/omp/core/paths';
+import { canonicalPath } from '@/server/lib/fs/canonical';
+import { resolveProjectRoot } from '@/server/lib/omp/core/worktree';
 
 const APP_ROOT = process.cwd();
 
@@ -124,8 +126,18 @@ export async function getDefaultFsRoot(mock: boolean): Promise<string> {
  * the server is allowed to operate on.
  *
  * Returns `fallback` when `rawRoot` is missing, does not exist, or is not on
- * the allow-list (app root / subpath / registered project_path), so existing
- * callers keep their previous behavior for unscoped requests.
+ * the allow-list (app root / subpath / registered project_path / **worktree of
+ * a registered project**), so existing callers keep their previous behavior for
+ * unscoped requests.
+ *
+ * The worktree branch is why a worktree session's panels can point anywhere:
+ * a chat started in a linked checkout runs there, and `resolveRoot` answered the
+ * fallback for it — measured, so Files/Search/Git/Terminal silently showed the
+ * app root while the agent wrote to the worktree. The rule is deliberately
+ * narrow: the candidate's own REPOSITORY ROOT must be a registered project, so a
+ * registered project never becomes a filesystem grant. A SUBDIRECTORY is still
+ * refused — the allow-list stays exact roots, and a panel is pointed at the
+ * worktree root, never at a folder inside it.
  */
 export async function resolveRoot(
   rawRoot: string | null | undefined,
@@ -134,22 +146,39 @@ export async function resolveRoot(
   if (!rawRoot || !rawRoot.trim()) return fallback;
 
   const resolved = path.resolve(rawRoot.trim());
+  if (!(await pathExists(resolved))) return fallback;
 
   // Fast path: the app root and anything beneath it are always allowed.
   if (resolved === APP_ROOT || resolved.startsWith(APP_ROOT + path.sep)) {
-    return (await pathExists(resolved)) ? resolved : fallback;
+    return resolved;
   }
 
-  // Registered workspaces are user-opted project roots — allow exact matches.
+  // Registered workspaces are user-opted project roots — allow exact matches,
+  // compared by canonical path so a `/tmp` vs `/private/tmp` spelling of one
+  // directory is not read as two.
   try {
     const db = await getDb();
-    const row = await db.get(
-      'SELECT project_path FROM workspace_folders WHERE project_path IS NOT NULL AND project_path = ? LIMIT 1',
-      [resolved]
-    );
-    if (row && (await pathExists(resolved))) return resolved;
+    const rows = (await db.all(
+      'SELECT project_path FROM workspace_folders WHERE project_path IS NOT NULL'
+    )) as { project_path: string }[];
+    const canonical = await canonicalPath(resolved);
+    for (const row of rows) {
+      if ((await canonicalPath(row.project_path)) === canonical) return resolved;
+    }
+
+    // A worktree ROOT: `resolveProjectRoot` only asks git when the candidate
+    // holds a `.git` entry, so a linked checkout resolves to the main repository
+    // while an ordinary subdirectory resolves to ITSELF and stays refused. That
+    // is what keeps this rule at "the roots of registered repositories" instead
+    // of "anything beneath one".
+    if (rows.length > 0) {
+      const projectRoot = await canonicalPath(await resolveProjectRoot(resolved));
+      for (const row of rows) {
+        if ((await canonicalPath(row.project_path)) === projectRoot) return resolved;
+      }
+    }
   } catch {
-    // Database unavailable — fall through to the safe fallback.
+    // Database or git unavailable — fall through to the safe fallback.
   }
 
   return fallback;