@orion-agents/orion-code 0.3.22 → 0.3.25

package/dist/services/session-storage.js

@@ -10,9 +10,11 @@ exports.SESSION_TAG_MAX_LENGTH = exports.SESSION_TAG_LIMIT = exports.SessionComp
 exports.resolveProjectPath = resolveProjectPath;
 exports.getProjectKey = getProjectKey;
 exports.isSessionMetaFile = isSessionMetaFile;
+exports.prepareSessionCatalogAsync = prepareSessionCatalogAsync;
 exports.prepareSessionCompactSourceReceipt = prepareSessionCompactSourceReceipt;
 exports.advanceSessionCompactSourceReceipt = advanceSessionCompactSourceReceipt;
 exports.createSession = createSession;
+exports.createSessionAsync = createSessionAsync;
 exports.saveSessionMeta = saveSessionMeta;
 exports.updateSessionEffort = updateSessionEffort;
 exports.updateSessionComposerPreferences = updateSessionComposerPreferences;
@@ -219,7 +221,6 @@ function sanitizeTraceEvent(event) {
 // ============================================================================
 // Project helpers
 // ============================================================================
-const MAX_CACHE_SIZE = 256;
 const SESSION_CATALOG_VERSION = 1;
 let sessionCatalogCache = null;
 function getSessionCatalogPath() {
@@ -228,63 +229,15 @@ function getSessionCatalogPath() {
 function emptySessionCatalog() {
     return { version: SESSION_CATALOG_VERSION, sessions: {} };
 }
-/**
- * Evict the oldest entries when a Map exceeds MAX_CACHE_SIZE.
- * Simple LRU approximation: delete the first (oldest) entries until
- * the map is within bounds. Called after each insertion.
- */
-function evictOldest(map, maxSize) {
-    while (map.size > maxSize) {
-        const firstKey = map.keys().next().value;
-        if (firstKey !== undefined)
-            map.delete(firstKey);
-        else
-            break;
-    }
-}
-const resolvedProjectPathCache = new Map();
 /**
  * Resolve a working directory to the project identity used for session storage.
  * Git repositories share sessions from the repository root; non-git folders use
  * their real absolute path.
  */
 function resolveProjectPath(cwd = process.cwd()) {
-    const absolute = (0, path_1.resolve)(cwd);
-    const cached = resolvedProjectPathCache.get(absolute);
-    if (cached) {
-        return cached;
-    }
-    let resolvedPath = absolute;
-    if ((0, fs_1.existsSync)(absolute)) {
-        try {
-            const root = (0, child_process_1.execFileSync)('git', ['-C', absolute, 'rev-parse', '--show-toplevel'], {
-                encoding: 'utf-8',
-                stdio: ['ignore', 'pipe', 'ignore'],
-            }).trim();
-            if (root) {
-                resolvedPath = (0, fs_1.realpathSync)(root);
-                resolvedProjectPathCache.set(absolute, resolvedPath);
-                evictOldest(resolvedProjectPathCache, MAX_CACHE_SIZE);
-                return resolvedPath;
-            }
-        }
-        catch (error) {
-            // Not a git worktree, or git is unavailable.
-            (0, debug_log_1.debugError)('session-storage.resolveGitRoot', error, absolute);
-        }
-    }
-    try {
-        resolvedPath = (0, fs_1.realpathSync)(absolute);
-    }
-    catch (error) {
-        // Broken symlink or concurrent deletion; the literal path still works
-        // as a stable project key.
-        (0, debug_log_1.debugError)('session-storage.realpath', error, absolute);
-        resolvedPath = absolute;
-    }
-    resolvedProjectPathCache.set(absolute, resolvedPath);
-    evictOldest(resolvedProjectPathCache, MAX_CACHE_SIZE);
-    return resolvedPath;
+    // Storage helpers and Session identity must share the same invalidation
+    // boundary; a second permanent cache could miss a newly initialized repo.
+    return (0, config_dir_1.resolveProjectStoragePath)(cwd);
 }
 function getProjectKey(projectPath) {
     return (0, config_dir_1.encodeProjectPath)(resolveProjectPath(projectPath));
@@ -307,8 +260,8 @@ function getGitBranch(projectPath) {
         return undefined;
     }
 }
-function normalizeSessionMeta(session) {
-    const projectPath = resolveProjectPath(session.projectPath);
+function normalizeSessionMeta(session, persistedStorage) {
+    const projectPath = persistedStorage?.projectPath ?? resolveProjectPath(session.projectPath);
     const startTime = session.startTime ?? Date.now();
     const updatedAt = session.updatedAt ?? session.endTime ?? startTime;
     return {
@@ -321,15 +274,20 @@ function normalizeSessionMeta(session) {
         updatedAt,
         updatedAtIso: session.updatedAtIso ?? new Date(updatedAt).toISOString(),
         messageCount: session.messageCount ?? 0,
-        historySizeBytes: session.historySizeBytes ?? computeSessionHistorySizeBytes({ id: session.id, projectPath }),
+        historySizeBytes: session.historySizeBytes ??
+            (persistedStorage
+                ? (safeFileSize(persistedStorage.historyPath) ?? 0)
+                : computeSessionHistorySizeBytes({ id: session.id, projectPath })),
         tokenCount: session.tokenCount ?? 0,
         cost: session.cost ?? 0,
-        gitBranch: session.gitBranch ?? getGitBranch(projectPath),
+        // Normalization is a read-model operation. Missing optional metadata must
+        // not spawn Git on every read/save of a non-repository Session.
+        gitBranch: session.gitBranch,
     };
 }
-function tryNormalizeSessionMeta(session, sourcePath) {
+function tryNormalizeSessionMeta(session, sourcePath, persistedStorage) {
     try {
-        return normalizeSessionMeta(session);
+        return normalizeSessionMeta(session, persistedStorage);
     }
     catch (error) {
         (0, debug_log_1.debugError)('session-storage.normalizeSessionMeta', error, sourcePath);
@@ -479,6 +437,109 @@ function updateSessionCatalog(update) {
         return catalog;
     }, { waitMs: 10000 });
 }
+function catalogSourceStamp(path) {
+    try {
+        const stat = (0, fs_1.statSync)(path);
+        return [stat.dev, stat.ino, stat.mode, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 'missing';
+        throw error;
+    }
+}
+async function scanSessionCatalogAsync() {
+    const catalog = emptySessionCatalog();
+    const stamps = new Map();
+    const projectsDir = (0, config_dir_1.getProjectsDir)();
+    stamps.set(projectsDir, catalogSourceStamp(projectsDir));
+    if (!(0, fs_1.existsSync)(projectsDir))
+        return { catalog, stamps };
+    let sinceYield = 0;
+    for (const projectKey of await fs_1.promises.readdir(projectsDir)) {
+        const sessionsDir = (0, path_1.join)(projectsDir, projectKey, 'sessions');
+        stamps.set(sessionsDir, catalogSourceStamp(sessionsDir));
+        if (!(0, fs_1.existsSync)(sessionsDir))
+            continue;
+        for (const file of (await fs_1.promises.readdir(sessionsDir)).filter(isSessionMetaFile)) {
+            const path = (0, path_1.join)(sessionsDir, file);
+            // Stamp before reading. A concurrent atomic replacement between these
+            // steps must invalidate the scan rather than bless stale bytes.
+            stamps.set(path, catalogSourceStamp(path));
+            let raw;
+            try {
+                raw = JSON.parse(await fs_1.promises.readFile(path, 'utf8'));
+            }
+            catch (error) {
+                (0, debug_log_1.debugError)('session-storage.scanCatalogAsync', error, path);
+                continue;
+            }
+            if (!raw || typeof raw.id !== 'string' || !raw.id || !raw.projectPath)
+                continue;
+            if (typeof raw.projectPath !== 'string')
+                continue;
+            // Historical metadata already owns its persisted root. Rediscovering
+            // Git here could migrate it, or let an unrelated broken repo deny Host
+            // startup. Rebuild the index without probing any historical repository.
+            const normalized = tryNormalizeSessionMeta(raw, path, {
+                projectPath: (0, path_1.resolve)(raw.projectPath),
+                historyPath: path.slice(0, -'.json'.length) + '.jsonl',
+            });
+            if (normalized) {
+                const previous = catalog.sessions[normalized.id];
+                if (!previous ||
+                    (normalized.updatedAt ?? normalized.startTime) >
+                        (previous.updatedAt ?? previous.startTime)) {
+                    catalog.sessions[normalized.id] = normalized;
+                }
+            }
+            if (++sinceYield >= 16) {
+                sinceYield = 0;
+                await new Promise(resolveYield => setImmediate(resolveYield));
+            }
+        }
+    }
+    return { catalog, stamps };
+}
+/** Warm/rebuild the global read model without synchronous lock retry or scan. */
+async function prepareSessionCatalogAsync(waitMs = 10000) {
+    (0, config_dir_1.ensureConfigDir)();
+    const path = getSessionCatalogPath();
+    if (readCachedSessionCatalog(path))
+        return;
+    const deadline = Date.now() + waitMs;
+    let scanned = await scanSessionCatalogAsync();
+    const scanChanged = new Error('Session Catalog sources changed during scan.');
+    while (true) {
+        try {
+            (0, file_lock_1.withFileLockSync)(path, () => {
+                // A writer may have published a newer Catalog while the scan ran.
+                if (readCachedSessionCatalog(path))
+                    return;
+                for (const [sourcePath, stamp] of scanned.stamps) {
+                    if (catalogSourceStamp(sourcePath) !== stamp)
+                        throw scanChanged;
+                }
+                writeSessionCatalog(path, scanned.catalog);
+            }, { waitMs: 0 });
+            return;
+        }
+        catch (error) {
+            if (Date.now() >= deadline)
+                throw error;
+            if (error === scanChanged) {
+                scanned = await scanSessionCatalogAsync();
+            }
+            else if (error instanceof Error &&
+                error.message === `Timed out waiting for file lock ${path}.lock`) {
+                await new Promise(resolveWait => setTimeout(resolveWait, 10));
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+}
 function parseHarnessSidecarFile(path) {
     try {
         const content = (0, fs_1.readFileSync)(path, 'utf-8');
@@ -913,8 +974,9 @@ function computeSessionHistorySizeBytes(session) {
 // ============================================================================
 /**
  * 创建新会话
+ * @param options Optional pre-probed Git metadata. Supplying this object skips synchronous Git.
  */
-function createSession(projectPath, model) {
+function createSession(projectPath, model, options) {
     (0, config_dir_1.ensureConfigDir)();
     const canonicalProjectPath = resolveProjectPath(projectPath);
     const now = Date.now();
@@ -929,13 +991,87 @@ function createSession(projectPath, model) {
         updatedAt: now,
         updatedAtIso: new Date(now).toISOString(),
         messageCount: 0,
-        gitBranch: getGitBranch(canonicalProjectPath),
+        // Interactive Hosts can supply an asynchronously probed branch. Passing
+        // options (including an unavailable branch) deliberately skips the legacy
+        // synchronous Git probe; CLI/TUI callers retain their existing behavior.
+        gitBranch: options ? options.gitBranch : getGitBranch(canonicalProjectPath),
         tokenCount: 0,
         cost: 0,
     };
     saveSessionMeta(session);
     return session;
 }
+/**
+ * Web creation waits for cross-process metadata/catalog locks asynchronously.
+ * Both locks are acquired before any Session bytes are written. The original
+ * synchronous lock owner/recovery and atomic publication remain authoritative.
+ */
+async function createSessionAsync(projectPath, model, options = {}) {
+    (0, config_dir_1.ensureConfigDir)();
+    const deadline = Date.now() + (options.waitMs ?? 10000);
+    options.beforeCommit?.();
+    const storageIdentity = await (0, paths_1.resolveProjectStorageIdentityAsync)(projectPath);
+    const canonicalProjectPath = storageIdentity.canonicalPath;
+    await prepareSessionCatalogAsync(Math.max(0, deadline - Date.now()));
+    const now = Date.now();
+    const session = {
+        id: (0, crypto_1.randomUUID)(),
+        projectPath: canonicalProjectPath,
+        projectKey: (0, config_dir_1.encodeProjectPath)(canonicalProjectPath),
+        cwd: (0, path_1.resolve)(projectPath),
+        model,
+        startTime: now,
+        createdAt: new Date(now).toISOString(),
+        updatedAt: now,
+        updatedAtIso: new Date(now).toISOString(),
+        messageCount: 0,
+        historySizeBytes: 0,
+        gitBranch: options.gitBranch,
+        tokenCount: 0,
+        cost: 0,
+        ...(options.name?.trim() ? { name: options.name.trim() } : {}),
+    };
+    const sessionsDir = (0, paths_1.ensureResolvedProjectDir)(storageIdentity);
+    const metaPath = (0, path_1.join)(sessionsDir, `${session.id}.json`);
+    const catalogPath = getSessionCatalogPath();
+    const lockTimeoutMessages = new Set([metaPath, catalogPath].map(path => `Timed out waiting for file lock ${path}.lock`));
+    while (true) {
+        options.beforeCommit?.();
+        (0, paths_1.assertProjectStorageIdentity)(storageIdentity);
+        try {
+            return (0, file_lock_1.withFileLockSync)(metaPath, () => (0, file_lock_1.withFileLockSync)(catalogPath, () => {
+                options.beforeCommit?.();
+                (0, paths_1.assertProjectStorageIdentity)(storageIdentity);
+                const catalog = readSessionCatalogFile(catalogPath);
+                if (!catalog) {
+                    throw new Error('Session Catalog changed before creation. Retry.');
+                }
+                if ((0, fs_1.existsSync)(metaPath))
+                    throw new Error('Session identity already exists.');
+                (0, atomic_write_1.atomicWriteFileSync)(metaPath, JSON.stringify(session, null, 2), { mode: 0o600 });
+                try {
+                    catalog.sessions[session.id] = session;
+                    writeSessionCatalog(catalogPath, catalog);
+                }
+                catch (error) {
+                    // This identity was not exposed to a caller or Catalog yet.
+                    // Roll back its metadata while both locks are still ours.
+                    (0, fs_1.unlinkSync)(metaPath);
+                    throw error;
+                }
+                return session;
+            }, { waitMs: 0 }), { waitMs: 0 });
+        }
+        catch (error) {
+            if (!(error instanceof Error) ||
+                !lockTimeoutMessages.has(error.message) ||
+                Date.now() >= deadline) {
+                throw error;
+            }
+            await new Promise(resolveWait => setTimeout(resolveWait, 10));
+        }
+    }
+}
 /**
  * 保存会话元数据
  */

package/dist/services/workspace-registry.d.ts

@@ -3,6 +3,15 @@ export interface WorkspaceRegistryEntryV1 {
     readonly canonicalPath: string;
     readonly label: string;
     readonly lastActivatedAt: string;
+    /**
+     * v0.3.25 #272 — when the workspace was first registered. Navigation order is
+     * derived from this stable timestamp; `lastActivatedAt` no longer reorders
+     * the tree when sessions are activated. Documents persisted before this field
+     * existed are backfilled from `lastActivatedAt` on parse (and persisted with
+     * the backfilled value on the next write), which keeps the migration
+     * deterministic.
+     */
+    readonly registeredAt: string;
     readonly pinnedOrder?: number;
 }
 export interface WorkspaceRegistryOptions {

package/dist/services/workspace-registry.js

@@ -47,6 +47,7 @@ class WorkspaceRegistryV1 {
                 canonicalPath,
                 label: workspaceLabel(canonicalPath),
                 lastActivatedAt: options.activated ? now : (existing?.lastActivatedAt ?? now),
+                registeredAt: existing?.registeredAt ?? now,
                 ...(existing?.pinnedOrder !== undefined ? { pinnedOrder: existing.pinnedOrder } : {}),
             });
             const entries = existing
@@ -74,6 +75,7 @@ class WorkspaceRegistryV1 {
                     canonicalPath: path,
                     label: workspaceLabel(path),
                     lastActivatedAt: path === active ? now : (existing?.lastActivatedAt ?? now),
+                    registeredAt: existing?.registeredAt ?? now,
                     ...(existing?.pinnedOrder !== undefined ? { pinnedOrder: existing.pinnedOrder } : {}),
                 }));
             }
@@ -102,6 +104,7 @@ class WorkspaceRegistryV1 {
                 canonicalPath: target.canonicalPath,
                 label: target.label,
                 lastActivatedAt: target.lastActivatedAt,
+                registeredAt: target.registeredAt,
                 ...(pinned ? { pinnedOrder: target.pinnedOrder ?? currentMax + 1 } : {}),
             });
             this.writeDocument(document.entries.map(entry => (entry.id === id ? updated : entry)));
@@ -189,6 +192,11 @@ function parseEntry(value) {
         !row.label.trim() ||
         typeof row.lastActivatedAt !== 'string' ||
         !Number.isFinite(Date.parse(row.lastActivatedAt)) ||
+        // v0.3.25 #272 — older documents have no registeredAt; backfill from
+        // lastActivatedAt so the migration is deterministic and the write-back
+        // persists the stable value.
+        (row.registeredAt !== undefined &&
+            (typeof row.registeredAt !== 'string' || !Number.isFinite(Date.parse(row.registeredAt)))) ||
         (row.pinnedOrder !== undefined &&
             (!Number.isSafeInteger(row.pinnedOrder) || Number(row.pinnedOrder) < 1))) {
         return invalidDocument();
@@ -198,6 +206,7 @@ function parseEntry(value) {
         canonicalPath: row.canonicalPath,
         label: row.label,
         lastActivatedAt: row.lastActivatedAt,
+        registeredAt: typeof row.registeredAt === 'string' ? row.registeredAt : row.lastActivatedAt,
         ...(row.pinnedOrder !== undefined ? { pinnedOrder: Number(row.pinnedOrder) } : {}),
     });
 }
@@ -209,8 +218,10 @@ function compareEntries(left, right) {
     const rightPinned = right.pinnedOrder ?? Number.MAX_SAFE_INTEGER;
     if (leftPinned !== rightPinned)
         return leftPinned - rightPinned;
-    const recent = Date.parse(right.lastActivatedAt) - Date.parse(left.lastActivatedAt);
-    return recent || left.label.localeCompare(right.label) || left.id.localeCompare(right.id);
+    // v0.3.25 #272 — stable registration order: activating a session must not
+    // reorder the navigation tree, so lastActivatedAt no longer participates.
+    const registration = Date.parse(left.registeredAt) - Date.parse(right.registeredAt);
+    return registration || left.label.localeCompare(right.label) || left.id.localeCompare(right.id);
 }
 function freezeEntries(entries) {
     return Object.freeze([...entries].sort(compareEntries).map(entry => Object.freeze({ ...entry })));

package/dist/web/git-history-service.js

@@ -572,11 +572,14 @@ function createGitHistoryReader(options) {
             // `--follow` only accepts a single path, which is exactly this case. It explains its own
             // limits for copies and complex merges (plan G6) — we surface `followed` rather than
             // pretending tracking is complete.
+            // v0.3.25 #270 — the validated revision must reach the log command: it was
+            // previously used only for the existence check, so every query walked HEAD.
             const raw = await runGit([
                 'log',
                 `--max-count=${limit + 1}`,
                 `--format=${LIST_FORMAT}${RECORD_SEPARATOR}`,
                 '--follow',
+                target,
                 '--',
                 path,
             ]);

package/dist/web/git-read-model-service.d.ts

@@ -207,6 +207,15 @@ export declare class GitReadModelServiceV1 {
     }): Promise<GitDiffDocumentV2>;
     private versionReaderInstance?;
     private versionReader;
+    /**
+     * v0.3.25 #269 — reads one working-tree file for the conflict view, refusing
+     * to leave the repository: the requested relative path (already guarded as
+     * relative and non-sensitive by the version reader) is resolved against the
+     * repository root and both the file's real path and its parent's real path
+     * must stay inside the root's real path. Returns null instead of throwing so
+     * a missing or unreadable file reads as an absent worktree version.
+     */
+    private readContainedWorktreeFile;
     /**
      * v0.3.17 S5 — base / ours / theirs / worktree for a conflicted file.
      *

package/dist/web/git-read-model-service.js

@@ -6,6 +6,7 @@ exports.assertRelativeGitPath = assertRelativeGitPath;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const redaction_1 = require("../services/redaction");
 const errors_1 = require("./errors");
@@ -349,9 +350,43 @@ class GitReadModelServiceV1 {
         this.versionReaderInstance ?? (this.versionReaderInstance = (0, git_version_service_1.createGitVersionReader)({
             runGit: async (args) => this.runGit(args, await this.requireRepositoryRoot()),
             runGitBytes: async (args) => this.runGitBytes(args, await this.requireRepositoryRoot()),
+            readWorktreeFile: async (relativePath) => this.readContainedWorktreeFile(relativePath),
         }));
         return this.versionReaderInstance;
     }
+    /**
+     * v0.3.25 #269 — reads one working-tree file for the conflict view, refusing
+     * to leave the repository: the requested relative path (already guarded as
+     * relative and non-sensitive by the version reader) is resolved against the
+     * repository root and both the file's real path and its parent's real path
+     * must stay inside the root's real path. Returns null instead of throwing so
+     * a missing or unreadable file reads as an absent worktree version.
+     */
+    async readContainedWorktreeFile(relativePath) {
+        let root;
+        try {
+            root = (0, fs_1.realpathSync)(await this.requireRepositoryRoot());
+        }
+        catch {
+            return null;
+        }
+        try {
+            const absolute = (0, path_1.resolve)(root, relativePath);
+            const fileReal = (0, fs_1.realpathSync)(absolute);
+            const parentReal = (0, fs_1.realpathSync)((0, path_1.resolve)(fileReal, '..'));
+            if (fileReal !== root && !fileReal.startsWith(root + path_1.sep))
+                return null;
+            if (parentReal !== root && !parentReal.startsWith(root + path_1.sep))
+                return null;
+            const stat = (0, fs_1.statSync)(fileReal);
+            if (!stat.isFile())
+                return null;
+            return await (0, promises_1.readFile)(fileReal);
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * v0.3.17 S5 — base / ours / theirs / worktree for a conflicted file.
      *

package/dist/web/git-version-service.d.ts

@@ -66,6 +66,14 @@ export interface GitVersionReaderOptions {
     readonly runGit: (args: readonly string[]) => Promise<string>;
     /** Runs git and returns raw bytes, for content that may not be valid UTF-8. */
     readonly runGitBytes: (args: readonly string[]) => Promise<Buffer>;
+    /**
+     * v0.3.25 #269 — reads one working-tree file relative to the repository root,
+     * returning null when it does not exist or cannot be read safely. The
+     * `worktree` conflict version must come from the filesystem: `hash-object`
+     * without `-w` computes an OID that is not in the object database, so any
+     * edited working file made `cat-file` fail the whole conflict response.
+     */
+    readonly readWorktreeFile?: (relativePath: string) => Promise<Buffer | null>;
 }
 export declare function createGitVersionReader(options: GitVersionReaderOptions): GitVersionReader;
 //# sourceMappingURL=git-version-service.d.ts.map

package/dist/web/git-version-service.js

@@ -85,28 +85,25 @@ function parseLfsPointer(head) {
     });
 }
 function createGitVersionReader(options) {
-    const { runGit, runGitBytes } = options;
+    const { runGit, runGitBytes, readWorktreeFile } = options;
+    /** Absent version — the label legitimately has no content for this shape. */
+    const absentVersion = (label) => Object.freeze({
+        label,
+        oid: null,
+        exists: false,
+        binary: false,
+        byteSize: 0,
+        truncated: false,
+        content: null,
+        lfs: null,
+    });
     /**
-     * Reads one blob by OID, bounded, with binary and LFS detection.
-     *
-     * The size is read first so an enormous historical file is reported by its size instead of
-     * being pulled into memory just to be truncated.
+     * v0.3.25 #269 — decodes already-fetched bytes into a version, shared by the
+     * object-database reader and the working-tree reader so both apply the same
+     * size bound, binary probe and LFS-pointer detection.
      */
-    const readVersion = async (label, oid) => {
-        if (oid === null) {
-            return Object.freeze({
-                label,
-                oid: null,
-                exists: false,
-                binary: false,
-                byteSize: 0,
-                truncated: false,
-                content: null,
-                lfs: null,
-            });
-        }
-        const sizeRaw = (await runGit(['cat-file', '-s', oid])).trim();
-        const byteSize = Number(sizeRaw) || 0;
+    const versionFromBytes = (label, oid, bytes) => {
+        const byteSize = bytes.length;
         if (byteSize > MAX_VERSION_BYTES) {
             return Object.freeze({
                 label,
@@ -119,7 +116,6 @@ function createGitVersionReader(options) {
                 lfs: null,
             });
         }
-        const bytes = await runGitBytes(['cat-file', 'blob', oid]);
         const probe = bytes.subarray(0, LFS_PROBE_BYTES).toString('utf8');
         const lfs = parseLfsPointer(probe);
         if (lfs) {
@@ -149,6 +145,31 @@ function createGitVersionReader(options) {
             dataUrl,
         });
     };
+    /**
+     * Reads one blob by OID, bounded, with binary and LFS detection.
+     *
+     * The size is read first so an enormous historical file is reported by its size instead of
+     * being pulled into memory just to be truncated.
+     */
+    const readVersion = async (label, oid) => {
+        if (oid === null)
+            return absentVersion(label);
+        const sizeRaw = (await runGit(['cat-file', '-s', oid])).trim();
+        const byteSize = Number(sizeRaw) || 0;
+        if (byteSize > MAX_VERSION_BYTES) {
+            return Object.freeze({
+                label,
+                oid,
+                exists: true,
+                binary: false,
+                byteSize,
+                truncated: true,
+                content: null,
+                lfs: null,
+            });
+        }
+        return versionFromBytes(label, oid, await runGitBytes(['cat-file', 'blob', oid]));
+    };
     return {
         async conflict(pathInput) {
             const path = assertRelativePath(pathInput);
@@ -168,15 +189,18 @@ function createGitVersionReader(options) {
                     continue;
                 stageOids.set(Number(stage), oid);
             }
-            const worktreeOid = (await runGit(['hash-object', '--path=' + path, '--', path]).catch(() => ''))
-                .toString()
-                .trim();
-            const worktreeExists = /^[0-9a-f]{7,64}$/iu.test(worktreeOid);
+            // v0.3.25 #269 — the working file is read from the filesystem. The previous
+            // `hash-object` (without -w) → `cat-file` chain only worked while the edited
+            // content happened to match an object git already stored; any real edit made
+            // `cat-file` fail the entire conflict response.
+            const worktreeBytes = await readWorktreeFile?.(path);
             const [base, ours, theirs, worktree] = await Promise.all([
                 readVersion('base', stageOids.get(1) ?? null),
                 readVersion('ours', stageOids.get(2) ?? null),
                 readVersion('theirs', stageOids.get(3) ?? null),
-                worktreeExists ? readVersion('worktree', worktreeOid) : readVersion('worktree', null),
+                worktreeBytes
+                    ? Promise.resolve(versionFromBytes('worktree', null, worktreeBytes))
+                    : Promise.resolve(absentVersion('worktree')),
             ]);
             const hasBase = stageOids.has(1);
             const hasOurs = stageOids.has(2);

package/dist/web/protocol.d.ts

@@ -361,6 +361,11 @@ export interface WebWorkspaceSummaryV1 {
     readonly available: boolean;
     readonly sessionCount: number;
     readonly lastActivatedAt: string;
+    /**
+     * v0.3.25 #272 — when the workspace was first registered. The navigation's
+     * stable default order is derived from this; optional for older Hosts.
+     */
+    readonly registeredAt?: string;
     readonly pinnedOrder?: number;
 }
 export interface WebWorkspaceProjectSummaryV1 {
@@ -471,6 +476,14 @@ export interface WebBootstrapV1 {
     readonly workspace: string;
     readonly configured: boolean;
     readonly activeSessionId: string | null;
+    /**
+     * v0.3.24 — the Host's latest durable event cursor at bootstrap time. Clients
+     * use it as the replay anchor: durable envelopes at or below this cursor are
+     * already reflected by the baseline and must not be re-applied (a reloaded
+     * tab otherwise replays pre-baseline `workbench_state` broadcasts that would
+     * clear its restored foreground Session). Older clients ignore it.
+     */
+    readonly eventCursor?: number;
     readonly settings: WebSettingsSnapshotV1;
     readonly capabilities: {
         readonly goal: true;