@orion-agents/orion-code 0.3.2 → 0.3.7

package/dist/terminal-ui/output-queue.js

@@ -86,13 +86,17 @@ class TerminalOutputQueue {
                     try {
                         this.writer.off('drain', drainListener);
                     }
-                    catch { /* ok */ }
+                    catch {
+                        /* ok */
+                    }
                     drainListener = null;
                 }
                 try {
                     this.writer.off('error', onError);
                 }
-                catch { /* ok */ }
+                catch {
+                    /* ok */
+                }
             };
             const onError = (error) => {
                 cleanup();
@@ -114,7 +118,9 @@ class TerminalOutputQueue {
                                 try {
                                     this.writer.off('drain', listener);
                                 }
-                                catch { /* ok */ }
+                                catch {
+                                    /* ok */
+                                }
                                 writeNext();
                             };
                             this.writer.on('drain', drainListener);

package/dist/tools/lsp.js

@@ -32,7 +32,9 @@ class LspClient extends events_1.EventEmitter {
      * Uses spawnSync with `which`/`where` to avoid async ENOENT race.
      */
     static probeBinary(cmd) {
-        const res = (0, child_process_1.spawnSync)(process.platform === 'win32' ? 'where' : 'which', [cmd], { stdio: 'ignore' });
+        const res = (0, child_process_1.spawnSync)(process.platform === 'win32' ? 'where' : 'which', [cmd], {
+            stdio: 'ignore',
+        });
         return res.status === 0;
     }
     async start() {
@@ -267,7 +269,7 @@ class LspManager {
             const client = new LspClient(language, projectRoot);
             // Fallback error listener — ensures the client NEVER crashes the process
             // due to an unhandled 'error' event emission.
-            client.on('error', (msg) => {
+            client.on('error', msg => {
                 console.warn(`[LSP:${language}] ${msg}`);
             });
             try {
@@ -326,12 +328,14 @@ function formatLocationResult(location) {
     const locations = Array.isArray(location) ? location : [location];
     if (locations.length === 0)
         return 'No definition found';
-    return locations.map(loc => {
+    return locations
+        .map(loc => {
         const path = loc.uri.replace('file://', '');
         const line = loc.range.start.line + 1;
         const char = loc.range.start.character + 1;
         return `${path}:${line}:${char}`;
-    }).join('\n');
+    })
+        .join('\n');
 }
 /**
  * 解析 Hover 结果
@@ -543,12 +547,14 @@ exports.lspGetDiagnosticsTool = (0, tool_1.buildTool)({
                 3: 'Information',
                 4: 'Hint',
             };
-            const output = diagnostics.map(d => {
+            const output = diagnostics
+                .map(d => {
                 const sev = severityMap[d.severity] || 'Unknown';
                 const line = d.range.start.line + 1;
                 const char = d.range.start.character + 1;
                 return `[${sev}] ${file_path}:${line}:${char}: ${d.message}`;
-            }).join('\n');
+            })
+                .join('\n');
             return { success: true, output };
         }
         catch (err) {

package/dist/tui-core/frame.js

@@ -58,9 +58,7 @@ function setFrameCursor(frame, row, column, visible = true) {
     };
 }
 function renderFrameRows(frame) {
-    return frame.rows.map(row => row
-        .map(cell => cell.width === 0 ? '' : cell.char)
-        .join(''));
+    return frame.rows.map(row => row.map(cell => (cell.width === 0 ? '' : cell.char)).join(''));
 }
 function diffTuiFrames(previous, next) {
     if (!previous || previous.width !== next.width || previous.height !== next.height) {
@@ -78,9 +76,9 @@ function diffTuiFrames(previous, next) {
     }
     return {
         changedRows,
-        cursorChanged: previous.cursor.row !== next.cursor.row
-            || previous.cursor.column !== next.cursor.column
-            || previous.cursor.visible !== next.cursor.visible,
+        cursorChanged: previous.cursor.row !== next.cursor.row ||
+            previous.cursor.column !== next.cursor.column ||
+            previous.cursor.visible !== next.cursor.visible,
     };
 }
 function rowsDifferent(prev, next) {
@@ -97,7 +95,11 @@ function rowsDifferent(prev, next) {
     return false;
 }
 function createEmptyRow(width) {
-    return Array.from({ length: width }, () => ({ char: ' ', width: 1, style: style_1.DEFAULT_STYLE }));
+    return Array.from({ length: width }, () => ({
+        char: ' ',
+        width: 1,
+        style: style_1.DEFAULT_STYLE,
+    }));
 }
 function charWidth(char) {
     const width = (0, string_width_1.default)(char);

package/dist/tui-ui/transcript-cache.js

@@ -22,9 +22,9 @@ class TranscriptLayoutCache {
     }
     /** Get cached rows for an entry, or null if not cached / stale. */
     get(id, revision, generation, width, themeId = 'default') {
-        if (generation !== this.lastGeneration
-            || width !== this.lastWidth
-            || themeId !== this.lastThemeId) {
+        if (generation !== this.lastGeneration ||
+            width !== this.lastWidth ||
+            themeId !== this.lastThemeId) {
             this.invalidate(generation, width, themeId);
             return null;
         }
@@ -38,9 +38,9 @@ class TranscriptLayoutCache {
     }
     /** Store layout result for an entry. */
     set(id, revision, rows, generation, width, themeId = 'default') {
-        if (generation !== this.lastGeneration
-            || width !== this.lastWidth
-            || themeId !== this.lastThemeId) {
+        if (generation !== this.lastGeneration ||
+            width !== this.lastWidth ||
+            themeId !== this.lastThemeId) {
             this.invalidate(generation, width, themeId);
         }
         // Evict oldest if at capacity.

package/dist/tui-ui/transcript-inspector-layout.js

@@ -15,7 +15,9 @@ function renderTranscriptInspectorFrame(view, options) {
     const width = frame.width;
     const height = frame.height;
     (0, frame_1.writeFrameText)(frame, 0, 0, ' Orion Code Tool Inspector', theme.heading);
-    const search = view.searchQuery ? `search: ${view.searchQuery}` : `${view.entries.length} tools`;
+    const search = view.searchQuery
+        ? `search: ${sanitizeInlineIdentifier(view.searchQuery)}`
+        : `${view.entries.length} tools`;
     (0, frame_1.writeFrameText)(frame, 1, 1, search, theme.toolMeta);
     if (width < 60) {
         const listRows = Math.max(2, Math.min(6, Math.floor((height - 4) / 3)));
@@ -43,10 +45,12 @@ function renderList(frame, view, top, maxRows, width, theme) {
         const entry = view.entries[index];
         const selected = index === view.selectedIndex;
         const marker = entry.state === 'success' ? '✓' : entry.state === 'error' ? '✗' : '-';
-        const text = `${selected ? '›' : ' '} ${marker} #${entry.sequence} ${entry.toolName}`;
+        const text = `${selected ? '›' : ' '} ${marker} #${entry.sequence} ${sanitizeInlineIdentifier(entry.toolName)}`;
         (0, frame_1.writeFrameText)(frame, top + row, 0, truncateWidth(text, Math.max(1, width - 1)), selected
             ? { ...theme.toolName, inverse: true }
-            : entry.state === 'error' ? theme.toolError : theme.toolMeta);
+            : entry.state === 'error'
+                ? theme.toolError
+                : theme.toolMeta);
     }
 }
 function renderDetail(frame, view, top, maxRows, left, width, theme) {
@@ -55,17 +59,17 @@ function renderDetail(frame, view, top, maxRows, left, width, theme) {
     const entry = view.selected;
     if (!entry)
         return;
-    const heading = ` ${entry.toolName} · ${formatBytes(entry.outputBytes)}${entry.artifactId ? '' : ' · legacy'}`;
+    const heading = ` ${sanitizeInlineIdentifier(entry.toolName)} · ${formatBytes(entry.outputBytes)}${entry.artifactId ? '' : ' · legacy'}`;
     (0, frame_1.writeFrameText)(frame, top, left, heading, theme.toolName);
     const expanded = view.expandedCallIds.includes(entry.callId);
     const detail = view.detail;
     const body = !expanded
-        ? entry.summary ?? 'Press Enter to expand detail.'
+        ? (entry.summary ?? 'Press Enter to expand detail.')
         : detail?.loading
             ? 'Loading detail...'
             : detail?.error
                 ? `Detail error: ${detail.error}`
-                : detail?.content ?? entry.summary ?? 'Press Enter to load detail.';
+                : (detail?.content ?? entry.summary ?? 'Press Enter to load detail.');
     const lines = (0, style_1.sanitizeTerminalText)(body).split('\n');
     const detailOffset = expanded ? Math.max(0, view.detailOffset) : 0;
     for (let index = 0; index < maxRows - 1 && detailOffset + index < lines.length; index += 1) {
@@ -82,6 +86,9 @@ function formatBytes(bytes) {
         return `${(bytes / 1024).toFixed(1)} KB`;
     return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
+function sanitizeInlineIdentifier(value) {
+    return (0, style_1.sanitizeTerminalText)(value, 2).replace(/\s+/gu, ' ').trim();
+}
 function truncateWidth(value, maxWidth) {
     let output = '';
     let width = 0;

package/dist/tui-ui/transcript-inspector-surface.js

@@ -72,7 +72,10 @@ class TranscriptInspectorSurface {
                 this.output.off('error', onError);
                 this.output.off('close', onClose);
             };
-            const onDrain = () => { cleanup(); resolve(); };
+            const onDrain = () => {
+                cleanup();
+                resolve();
+            };
             const onError = (error) => {
                 cleanup();
                 reject(error instanceof Error ? error : new Error(String(error ?? 'terminal output error')));

package/dist/tui-ui/transcript-inspector.js

@@ -14,12 +14,7 @@ class TranscriptInspectorController {
     view(entries, inspector) {
         const query = inspector.searchQuery.trim().toLowerCase();
         const filtered = query
-            ? entries.filter(entry => [
-                entry.toolName,
-                entry.callId,
-                entry.summary,
-                this.details.get(entry.callId)?.content,
-            ]
+            ? entries.filter(entry => [entry.toolName, entry.callId, entry.summary, this.details.get(entry.callId)?.content]
                 .filter(Boolean)
                 .some(value => String(value).toLowerCase().includes(query)))
             : entries;
@@ -43,7 +38,7 @@ class TranscriptInspectorController {
             return;
         const generation = ++this.requestGeneration;
         this.details.set(entry.callId, {
-            content: append ? current?.content ?? '' : '',
+            content: append ? (current?.content ?? '') : '',
             totalBytes: current?.totalBytes ?? entry.outputBytes,
             nextOffsetBytes: current?.nextOffsetBytes,
             redacted: current?.redacted ?? false,
@@ -72,7 +67,7 @@ class TranscriptInspectorController {
             if (generation !== this.requestGeneration)
                 return;
             this.details.set(entry.callId, {
-                content: append ? current?.content ?? '' : '',
+                content: append ? (current?.content ?? '') : '',
                 totalBytes: current?.totalBytes ?? entry.outputBytes,
                 redacted: current?.redacted ?? false,
                 loading: false,

package/dist/ui/box.js

@@ -40,18 +40,25 @@ function renderHeaderBox(config) {
     // Model name
     parts.push(ACCENT(config.model));
     // Provider (shortened)
-    const providerShort = config.provider === 'Alibaba Cloud' ? 'Qwen'
-        : config.provider === 'Anthropic' ? 'Anthropic'
-            : config.provider === 'OpenAI' ? 'OpenAI'
+    const providerShort = config.provider === 'Alibaba Cloud'
+        ? 'Qwen'
+        : config.provider === 'Anthropic'
+            ? 'Anthropic'
+            : config.provider === 'OpenAI'
+                ? 'OpenAI'
                 : config.provider;
     if (providerShort) {
         parts.push(DIM(providerShort));
     }
     // Status
-    const statusIcon = config.status === 'ready' ? GREEN('●')
-        : config.status === 'loading' ? YELLOW('○')
-            : config.status === 'error' ? RED('●')
-                : config.status === 'processing' ? ACCENT('◌')
+    const statusIcon = config.status === 'ready'
+        ? GREEN('●')
+        : config.status === 'loading'
+            ? YELLOW('○')
+            : config.status === 'error'
+                ? RED('●')
+                : config.status === 'processing'
+                    ? ACCENT('◌')
                     : DIM('○');
     parts.push(statusIcon);
     return `  ${BRAND('orion')} ${DIM('v' + config.version)}  ${DIM('│')} ${parts.join(` ${DIM('│')} `)}`;

package/dist/ui/markdown.js

@@ -149,8 +149,10 @@ function renderMarkdownFallback(text, maxWidth = DEFAULT_MAX_WIDTH) {
             const level = headingMatch[1].length;
             const headingText = headingMatch[2].trim();
             const prefix = '  '.repeat(level - 1);
-            const styled = level <= 2 ? BOLD(CYAN(prefix + ' ' + headingText))
-                : level <= 4 ? BOLD(CYAN(prefix + headingText))
+            const styled = level <= 2
+                ? BOLD(CYAN(prefix + ' ' + headingText))
+                : level <= 4
+                    ? BOLD(CYAN(prefix + headingText))
                     : BOLD(DIM(headingText));
             result.push(styled);
             result.push(DIM('─'.repeat(Math.min(headingText.length + prefix.length + 2, maxWidth - 2))));

package/dist/ui/shared/input-frame.js

@@ -9,13 +9,15 @@ exports.renderFramedInputFrame = renderFramedInputFrame;
 const chalk_1 = __importDefault(require("chalk"));
 const text_1 = require("./text");
 const NO_COLOR = process.env.NO_COLOR !== undefined || process.env.TERM === 'dumb';
-const colorize = NO_COLOR ? {
-    accent: (s) => s,
-    dim: (s) => s,
-} : {
-    accent: chalk_1.default.hex('#00D4AA'),
-    dim: chalk_1.default.dim,
-};
+const colorize = NO_COLOR
+    ? {
+        accent: (s) => s,
+        dim: (s) => s,
+    }
+    : {
+        accent: chalk_1.default.hex('#00D4AA'),
+        dim: chalk_1.default.dim,
+    };
 const INPUT_BG = '\x1b[48;2;56;56;56m';
 const INPUT_FG = '\x1b[38;2;226;232;240m';
 const RESET_COLORS = '\x1b[39;49m';
@@ -34,7 +36,9 @@ function renderFramedInputFrame(options) {
         const prefix = index === 0 ? firstPrompt : continuationPrompt;
         return renderInputLine((0, text_1.truncateVisible)(prefix + line, inputWidth));
     });
-    const statusLine = options.statusText ? renderInputStatusLine(inputWidth, options.statusText) : undefined;
+    const statusLine = options.statusText
+        ? renderInputStatusLine(inputWidth, options.statusText)
+        : undefined;
     const rowSpans = logicalLines.map((line, index) => {
         const prefix = index === 0 ? firstPrompt : continuationPrompt;
         return terminalRowsFor((0, text_1.visualWidth)(prefix) + (0, text_1.visualWidth)(line), width);

package/dist/ui/stream-markdown.js

@@ -157,7 +157,7 @@ class StreamMarkdownRenderer {
         // Ordered list
         const orderedMatch = line.match(/^(\s*)(\d+)\.\s+(.*)$/);
         if (orderedMatch) {
-            return orderedMatch[1] + CYAN(orderedMatch[2] + '.') + ' ' + this.renderInline(orderedMatch[3]);
+            return (orderedMatch[1] + CYAN(orderedMatch[2] + '.') + ' ' + this.renderInline(orderedMatch[3]));
         }
         return this.renderInline(line);
     }

package/dist/ui/tool-preview.js

@@ -46,7 +46,9 @@ function renderToolCard(tool) {
         lines.push(DIM('│ ') + truncated.padEnd(maxWidth - 4) + DIM(' │'));
     }
     if (tool.result.split('\n').length > 6) {
-        lines.push(DIM('│ ') + DIM(`... ${tool.result.split('\n').length - 6} more lines`).padEnd(maxWidth - 4) + DIM(' │'));
+        lines.push(DIM('│ ') +
+            DIM(`... ${tool.result.split('\n').length - 6} more lines`).padEnd(maxWidth - 4) +
+            DIM(' │'));
     }
     // 底部
     lines.push(DIM('└') + '─'.repeat(maxWidth - 2) + DIM('┘'));
@@ -92,7 +94,11 @@ function renderReadPreview(path, content, success) {
     const maxWidth = 60;
     const icon = success ? SUCCESS('📖') : ERROR('📖');
     const title = `${icon} Read: ${path}`;
-    lines.push(DIM('┌─ ') + title.slice(0, maxWidth - 5) + DIM(' ') + '─'.repeat(Math.max(0, maxWidth - title.length - 5)) + DIM('┐'));
+    lines.push(DIM('┌─ ') +
+        title.slice(0, maxWidth - 5) +
+        DIM(' ') +
+        '─'.repeat(Math.max(0, maxWidth - title.length - 5)) +
+        DIM('┐'));
     if (success && content) {
         const contentLines = content.split('\n').slice(0, 8);
         for (const line of contentLines) {
@@ -100,7 +106,9 @@ function renderReadPreview(path, content, success) {
             lines.push(DIM('│ ') + truncated.padEnd(maxWidth - 4) + DIM(' │'));
         }
         if (content.split('\n').length > 8) {
-            lines.push(DIM('│ ') + DIM(`... ${content.split('\n').length - 8} more lines`).padEnd(maxWidth - 4) + DIM(' │'));
+            lines.push(DIM('│ ') +
+                DIM(`... ${content.split('\n').length - 8} more lines`).padEnd(maxWidth - 4) +
+                DIM(' │'));
         }
     }
     lines.push(DIM('└') + '─'.repeat(maxWidth - 2) + DIM('┘'));

package/dist/ui/user-input.js

@@ -33,16 +33,22 @@ function visualWidth(text) {
     let width = 0;
     for (const ch of text) {
         const cp = ch.codePointAt(0) || 0;
-        width += (cp >= 0x1100 && (cp <= 0x115f || cp === 0x2329 || cp === 0x232a ||
-            (cp >= 0x2e80 && cp <= 0xa4cf && cp !== 0x303f) ||
-            (cp >= 0xac00 && cp <= 0xd7a3) ||
-            (cp >= 0xf900 && cp <= 0xfaff) ||
-            (cp >= 0xfe10 && cp <= 0xfe19) ||
-            (cp >= 0xfe30 && cp <= 0xfe6f) ||
-            (cp >= 0xff01 && cp <= 0xff60) ||
-            (cp >= 0xffe0 && cp <= 0xffe6) ||
-            (cp >= 0x20000 && cp <= 0x2fffd) ||
-            (cp >= 0x30000 && cp <= 0x3fffd))) ? 2 : 1;
+        width +=
+            cp >= 0x1100 &&
+                (cp <= 0x115f ||
+                    cp === 0x2329 ||
+                    cp === 0x232a ||
+                    (cp >= 0x2e80 && cp <= 0xa4cf && cp !== 0x303f) ||
+                    (cp >= 0xac00 && cp <= 0xd7a3) ||
+                    (cp >= 0xf900 && cp <= 0xfaff) ||
+                    (cp >= 0xfe10 && cp <= 0xfe19) ||
+                    (cp >= 0xfe30 && cp <= 0xfe6f) ||
+                    (cp >= 0xff01 && cp <= 0xff60) ||
+                    (cp >= 0xffe0 && cp <= 0xffe6) ||
+                    (cp >= 0x20000 && cp <= 0x2fffd) ||
+                    (cp >= 0x30000 && cp <= 0x3fffd))
+                ? 2
+                : 1;
     }
     return width;
 }

package/dist/web/event-hub.d.ts

@@ -18,6 +18,7 @@ export declare class WebEventHub {
     private nextCursor;
     private retainedBytes;
     private discardedDurableThrough;
+    private replayResetCount;
     constructor(options?: WebEventHubOptions);
     emitRuntime(event: AgentRuntimeEvent, context?: {
         readonly sessionId?: string;
@@ -35,6 +36,7 @@ export declare class WebEventHub {
         readonly earliest: number;
         readonly latest: number;
         readonly retained: number;
+        readonly replayResets: number;
     };
     private trim;
     private compactRuntimeEvent;

package/dist/web/event-hub.js

@@ -31,12 +31,16 @@ class WebEventHub {
         this.nextCursor = 1;
         this.retainedBytes = 0;
         this.discardedDurableThrough = 0;
+        this.replayResetCount = 0;
         this.maxEvents = positiveInteger(options.maxEvents ?? DEFAULT_MAX_EVENTS, 'maxEvents');
         this.maxBytes = positiveInteger(options.maxBytes ?? DEFAULT_MAX_BYTES, 'maxBytes');
         this.now = options.now ?? Date.now;
     }
     emitRuntime(event, context = {}) {
-        return this.emit({ type: 'runtime_event', value: this.compactRuntimeEvent(sanitizeRuntimeEvent(event)) }, isDurableRuntimeEvent(event), context);
+        return this.emit({
+            type: 'runtime_event',
+            value: this.compactRuntimeEvent(sanitizeRuntimeEvent(event), context.sessionId),
+        }, isDurableRuntimeEvent(event), context);
     }
     emitThread(event, sessionId) {
         return this.emit({ type: 'thread_event', value: sanitizeThreadEvent(event) }, true, {
@@ -73,6 +77,7 @@ class WebEventHub {
     attach(response, cursor) {
         const latest = this.nextCursor - 1;
         if (cursor > latest || cursor < this.discardedDurableThrough) {
+            this.replayResetCount += 1;
             const reset = {
                 apiVersion: protocol_1.WEB_API_VERSION,
                 eventId: (0, crypto_1.randomUUID)(),
@@ -117,6 +122,7 @@ class WebEventHub {
             earliest: this.retained[0]?.envelope.cursor ?? this.nextCursor,
             latest: this.nextCursor - 1,
             retained: this.retained.length,
+            replayResets: this.replayResetCount,
         });
     }
     trim() {
@@ -128,11 +134,12 @@ class WebEventHub {
             this.discardedDurableThrough = Math.max(this.discardedDurableThrough, removed.envelope.cursor);
         }
     }
-    compactRuntimeEvent(event) {
+    compactRuntimeEvent(event, sessionId) {
         if (event.type === 'transcript_update' && typeof event.patch.content === 'string') {
             const content = event.patch.content;
-            const previous = this.transcriptContents.get(event.id);
-            this.rememberTranscriptContent(event.id, content);
+            const key = transcriptContentKey(sessionId, event.id);
+            const previous = this.transcriptContents.get(key);
+            this.rememberTranscriptContent(key, content);
             if (previous !== undefined && content.startsWith(previous)) {
                 const patch = { ...event.patch };
                 delete patch.content;
@@ -146,10 +153,14 @@ class WebEventHub {
             return event;
         }
         if (event.type === 'transcript_finalize' || event.type === 'transcript_remove') {
-            this.transcriptContents.delete(event.id);
+            this.transcriptContents.delete(transcriptContentKey(sessionId, event.id));
         }
         else if (event.type === 'transcript_clear' || event.type === 'transcript_replace') {
-            this.transcriptContents.clear();
+            const prefix = transcriptSessionPrefix(sessionId);
+            for (const key of this.transcriptContents.keys()) {
+                if (key.startsWith(prefix))
+                    this.transcriptContents.delete(key);
+            }
         }
         return event;
     }
@@ -165,6 +176,12 @@ class WebEventHub {
     }
 }
 exports.WebEventHub = WebEventHub;
+function transcriptSessionPrefix(sessionId) {
+    return `${sessionId ?? '<surface>'}\u0000`;
+}
+function transcriptContentKey(sessionId, id) {
+    return `${transcriptSessionPrefix(sessionId)}${id}`;
+}
 function toEnvelope(base, event) {
     switch (event.type) {
         case 'runtime_event':
@@ -232,6 +249,26 @@ function toEnvelope(base, event) {
                 type: event.type,
                 payload: { state: event.state },
             };
+        case 'session_runtime_changed':
+            if (!base.sessionId)
+                throw new Error('Session Runtime events require Session identity');
+            return {
+                ...base,
+                sessionId: base.sessionId,
+                durable: true,
+                type: event.type,
+                payload: { runtime: event.runtime },
+            };
+        case 'workspace_mutation_changed':
+            if (!base.sessionId)
+                throw new Error('Workspace mutation events require Session identity');
+            return {
+                ...base,
+                sessionId: base.sessionId,
+                durable: false,
+                type: event.type,
+                payload: { state: event.state },
+            };
         case 'replay_reset':
             return {
                 ...base,

package/dist/web/file-read-service.d.ts

@@ -5,6 +5,8 @@ export interface WebFileNodeV1 {
     /** Sanitized Workspace-relative display path. Requests must continue to use the opaque id. */
     readonly displayPath: string;
     readonly kind: WebFileKindV1;
+    /** Effective target kind for a readable symbolic link. */
+    readonly targetKind?: 'file' | 'directory';
     readonly sizeBytes?: number;
     readonly modifiedAt: string;
     readonly sensitive: boolean;

package/dist/web/file-read-service.js

@@ -114,7 +114,7 @@ class FileReadServiceV1 {
         if (!node.stat.isFile()) {
             throw new errors_1.WebWorkbenchError(409, 'File node is not a regular file.', 'file_not_regular');
         }
-        const sensitive = (0, redaction_1.isSensitiveFilePath)(node.relativePath);
+        const sensitive = isSensitiveResolvedPath(this.root, node.relativePath, node.canonicalPath);
         if (sensitive) {
             throw new errors_1.WebWorkbenchError(403, 'Sensitive file content is not available in the Web Workbench.', 'sensitive_file_blocked');
         }
@@ -152,6 +152,19 @@ class FileReadServiceV1 {
             const remaining = Math.max(0, Number(before.size) - offset);
             const page = readLineSafePage(descriptor, offset, remaining, limitBytes);
             this.performance.bytesRead += page.bytesRead;
+            if (isBinary(page.content)) {
+                return Object.freeze({
+                    fileId: input.fileId,
+                    name: (0, path_1.basename)(node.relativePath),
+                    revision,
+                    sizeBytes: Number(before.size),
+                    binary: true,
+                    sensitive: false,
+                    mediaType: 'application/octet-stream',
+                    offsetBytes: offset,
+                    nextCursor: null,
+                });
+            }
             const contentBuffer = validUtf8Prefix(page.content);
             if (page.consumedBytes > 0 && contentBuffer.length === 0) {
                 throw new errors_1.WebWorkbenchError(415, 'File is not valid UTF-8 text.', 'file_binary');
@@ -192,25 +205,32 @@ class FileReadServiceV1 {
         const symlink = lexicalStat.isSymbolicLink();
         let readable = true;
         let effectiveStat = lexicalStat;
-        if (symlink) {
-            try {
-                const canonicalPath = (0, fs_1.realpathSync)(lexicalPath);
-                readable = isWithinRoot(canonicalPath, this.root);
-                if (readable)
-                    effectiveStat = (0, fs_1.statSync)(canonicalPath, { bigint: true });
-            }
-            catch {
-                readable = false;
-            }
+        let canonicalPath;
+        try {
+            canonicalPath = (0, fs_1.realpathSync)(lexicalPath);
+            readable = isWithinRoot(canonicalPath, this.root);
+            if (readable)
+                effectiveStat = (0, fs_1.statSync)(canonicalPath, { bigint: true });
         }
+        catch {
+            readable = false;
+        }
+        const targetKind = readable
+            ? effectiveStat.isDirectory()
+                ? 'directory'
+                : effectiveStat.isFile()
+                    ? 'file'
+                    : undefined
+            : undefined;
         return Object.freeze({
             id: this.remember(relativePath),
             name: (0, path_1.basename)(relativePath),
             displayPath: normalizeRelativePath(relativePath),
             kind: symlink ? 'symlink' : effectiveStat.isDirectory() ? 'directory' : 'file',
+            ...(symlink && targetKind ? { targetKind } : {}),
             ...(effectiveStat.isFile() ? { sizeBytes: Number(effectiveStat.size) } : {}),
             modifiedAt: new Date(Number(effectiveStat.mtimeMs)).toISOString(),
-            sensitive: (0, redaction_1.isSensitiveFilePath)(relativePath),
+            sensitive: isSensitiveResolvedPath(this.root, relativePath, canonicalPath),
             readable,
         });
     }
@@ -360,6 +380,13 @@ function isWithinRoot(candidate, root) {
     const rel = (0, path_1.relative)(root, candidate);
     return rel === '' || (!rel.startsWith(`..${path_1.sep}`) && rel !== '..' && !(0, path_1.isAbsolute)(rel));
 }
+function isSensitiveResolvedPath(root, aliasRelativePath, canonicalPath) {
+    if ((0, redaction_1.isSensitiveFilePath)(aliasRelativePath))
+        return true;
+    if (!canonicalPath || !isWithinRoot(canonicalPath, root))
+        return false;
+    return (0, redaction_1.isSensitiveFilePath)((0, path_1.relative)(root, canonicalPath));
+}
 function fingerprintStat(stat) {
     return (0, crypto_1.createHash)('sha256')
         .update([stat.dev, stat.ino, stat.mode, stat.size, stat.mtimeNs, stat.ctimeNs]

package/dist/web/git-read-model-service.js

@@ -122,6 +122,9 @@ class GitReadModelServiceV1 {
         if (!record) {
             throw new errors_1.WebWorkbenchError(409, 'Git file changed before diff.', 'git_revision_conflict');
         }
+        if (isSensitiveGitRecord(record)) {
+            throw new errors_1.WebWorkbenchError(403, 'Sensitive file content is not available in the Web Workbench.', 'sensitive_file_blocked');
+        }
         const lineLimit = boundedInteger(input.lineLimit ?? DEFAULT_DIFF_LINES, 1, MAX_DIFF_LINES, 'lineLimit');
         const byteLimit = boundedInteger(input.byteLimit ?? DEFAULT_DIFF_BYTES, 1024, MAX_DIFF_BYTES, 'byteLimit');
         const offset = input.cursor
@@ -440,6 +443,10 @@ function isConflictRecord(record) {
         `${record.indexStatus}${record.worktreeStatus}` === 'AA' ||
         `${record.indexStatus}${record.worktreeStatus}` === 'DD');
 }
+function isSensitiveGitRecord(record) {
+    return ((0, redaction_1.isSensitiveFilePath)(record.path) ||
+        (record.renamedFrom !== undefined && (0, redaction_1.isSensitiveFilePath)(record.renamedFrom)));
+}
 async function streamDiffPage(input) {
     const lines = [];
     let virtualLine = 0;