@pi-harness/pi-harness 0.1.23 → 0.1.24

package/apps/web/test/bin.test.ts

@@ -1,7 +1,11 @@
 import { spawn } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { request as httpRequest } from "node:http";
+import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { afterEach, describe, expect, test } from "vitest";
 
 const BIN = join(import.meta.dirname, "..", "server-dist", "bin.js");
@@ -14,18 +18,35 @@ interface LauncherRun {
   readonly stderr: string;
 }
 
+interface LauncherExit {
+  readonly code: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
 const directories: string[] = [];
 
 afterEach(async () => {
   await Promise.all(directories.splice(0).map(async (directory) => rm(directory, { recursive: true, force: true })));
 });
 
-// Boots the built launcher on an ephemeral port with an isolated agent directory, waits for the console URL, sends the signal, and reports how the process exited.
-async function runLauncher(signal: NodeJS.Signals, extraEnv: Record<string, string> = {}): Promise<LauncherRun> {
-  const agentDir = await mkdtemp(join(tmpdir(), "pi-harness-web-bin-"));
-  directories.push(agentDir);
+async function makeTempDir(label: string): Promise<string> {
+  const directory = await mkdtemp(join(tmpdir(), `pi-harness-web-bin-${label}-`));
+  directories.push(directory);
+  return directory;
+}
+
+// Boots the built launcher on an ephemeral port with an isolated agent directory, waits for the console URL, runs the optional probe against the live server, sends the signal, and reports how the process exited.
+async function runLauncher(
+  signal: NodeJS.Signals,
+  extraEnv: Record<string, string> = {},
+  spawnCwd?: string,
+  probe?: (consoleUrl: string) => Promise<void>,
+): Promise<LauncherRun> {
+  const agentDir = await makeTempDir("agent");
   const child = spawn(process.execPath, [BIN], {
     stdio: ["ignore", "pipe", "pipe"],
+    ...(spawnCwd === undefined ? {} : { cwd: spawnCwd }),
     env: {
       ...process.env,
       PI_HARNESS_PORT: "0",
@@ -57,6 +78,12 @@ async function runLauncher(signal: NodeJS.Signals, extraEnv: Record<string, stri
     child.stdout.on("data", check);
     void exit.then(({ code }) => reject(new Error("launcher exited before printing the console URL (code " + String(code) + "): " + stderr)));
   });
+  try {
+    await probe?.(consoleUrl);
+  } catch (error) {
+    child.kill("SIGKILL");
+    throw error;
+  }
   const started = Date.now();
   child.kill(signal);
   const timeout = setTimeout(() => child.kill("SIGKILL"), 15_000);
@@ -65,6 +92,59 @@ async function runLauncher(signal: NodeJS.Signals, extraEnv: Record<string, stri
   return { consoleUrl, ...result, elapsedMs: Date.now() - started, stderr };
 }
 
+// Runs the built launcher until it exits on its own, for the startup guards that must abort before a console URL is ever printed.
+async function runLauncherToExit(extraEnv: Record<string, string>): Promise<LauncherExit> {
+  const agentDir = await makeTempDir("guard");
+  const child = spawn(process.execPath, [BIN], {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      PI_HARNESS_PORT: "0",
+      PI_AGENT_DIR: agentDir,
+      PI_HARNESS_PROVIDER: "anthropic",
+      PI_HARNESS_MODEL: "claude-sonnet-4-5",
+      PI_HARNESS_DISABLE_UPDATE_CHECK: "1",
+      ...extraEnv,
+    },
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk: string) => {
+    stdout += chunk;
+  });
+  child.stderr.on("data", (chunk: string) => {
+    stderr += chunk;
+  });
+  const timeout = setTimeout(() => child.kill("SIGKILL"), 30_000);
+  const code = await new Promise<number | null>((resolve) => child.once("exit", (exitCode) => resolve(exitCode)));
+  clearTimeout(timeout);
+  return { code, stdout, stderr };
+}
+
+// fetch() drops a caller-supplied Host header because "host" is a forbidden header name, so a request that has to carry a proxy hostname goes out over node:http instead.
+function statusWithHostHeader(port: number, hostHeader: string): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const outgoing = httpRequest({ host: "127.0.0.1", port, path: "/api/status", headers: { host: hostHeader } }, (response) => {
+      response.resume();
+      resolve(response.statusCode ?? 0);
+    });
+    outgoing.once("error", reject);
+    outgoing.end();
+  });
+}
+
+// Takes a loopback port from the kernel and releases it again, so a launcher run can be probed over HTTP without reading the console URL from stdout.
+async function reserveLoopbackPort(): Promise<number> {
+  const server = createServer();
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : 0;
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  return port;
+}
+
 describe("web launcher", () => {
   test("completes graceful shutdown on SIGINT and exits with code 130 instead of dying by signal", async () => {
     const run = await runLauncher("SIGINT");
@@ -87,4 +167,147 @@ describe("web launcher", () => {
     expect(run.consoleUrl).toMatch(/^http:\/\/\[::1\]:\d+$/u);
     expect(run.code).toBe(130);
   }, 30_000);
+
+  test("resolves a relative PI_AGENT_DIR against the working directory and ignores surrounding whitespace", async () => {
+    const workingDir = await makeTempDir("cwd");
+    const home = await makeTempDir("home");
+    await mkdir(join(workingDir, "agent-state"));
+
+    const run = await runLauncher("SIGINT", { PI_AGENT_DIR: "  ./agent-state  ", HOME: home }, workingDir);
+
+    expect(run.consoleUrl).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/u);
+    expect(run.stderr).not.toContain("must be an absolute path");
+    // Booting writes the model store into the agent directory, so these two paths pin which base the relative value resolved against: the working directory, not the home directory.
+    expect(existsSync(join(workingDir, "agent-state", "models-store.json"))).toBe(true);
+    expect(existsSync(join(home, "agent-state"))).toBe(false);
+    expect(run.code).toBe(130);
+  }, 60_000);
+
+  test("treats a blank PI_AGENT_DIR as unset and falls back to the home agent directory", async () => {
+    const workingDir = await makeTempDir("cwd");
+    const home = await makeTempDir("home");
+    await mkdir(join(home, ".pi", "agent"), { recursive: true });
+
+    const run = await runLauncher("SIGINT", { PI_AGENT_DIR: "   ", HOME: home }, workingDir);
+
+    expect(run.stderr).not.toContain("must be an absolute path");
+    expect(existsSync(join(home, ".pi", "agent", "models-store.json"))).toBe(true);
+    expect(existsSync(join(workingDir, ".pi"))).toBe(false);
+    expect(run.code).toBe(130);
+  }, 60_000);
+
+  test("keeps serving and shuts down gracefully when a closed stdout pipe breaks the console URL write", async () => {
+    const agentDir = await makeTempDir("epipe");
+    const port = await reserveLoopbackPort();
+    const child = spawn(process.execPath, [BIN], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        PI_HARNESS_PORT: String(port),
+        PI_AGENT_DIR: agentDir,
+        PI_HARNESS_PROVIDER: "anthropic",
+        PI_HARNESS_MODEL: "claude-sonnet-4-5",
+        PI_HARNESS_DISABLE_UPDATE_CHECK: "1",
+      },
+    });
+    let stderr = "";
+    let exited = false;
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk: string) => {
+      stderr += chunk;
+    });
+    const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
+      child.once("exit", (code, signal) => {
+        exited = true;
+        resolve({ code, signal });
+      }),
+    );
+    // Closing the read end of the pipe is what `pi-harness | head -1` does: the launcher's next write raises EPIPE on process.stdout.
+    child.stdout.destroy();
+
+    await expect
+      .poll(
+        async () => {
+          if (exited) return "exited";
+          try {
+            await fetch(`http://127.0.0.1:${String(port)}/`);
+            return "listening";
+          } catch {
+            return "starting";
+          }
+        },
+        { interval: 200, timeout: 40_000 },
+      )
+      .not.toBe("starting");
+    // The console URL is written shortly after the server starts listening, so wait past that point before deciding the process survived the broken pipe.
+    await delay(3_000);
+
+    expect(stderr).not.toContain("EPIPE");
+    expect(exited).toBe(false);
+    child.kill("SIGINT");
+    const result = await exit;
+    expect(result.code).toBe(130);
+  }, 60_000);
+});
+
+describe("web launcher startup guards", () => {
+  test("refuses a non-loopback PI_HARNESS_HOST while remote access is not opted in", async () => {
+    for (const remoteHost of ["0.0.0.0", "192.0.2.10"]) {
+      const run = await runLauncherToExit({ PI_HARNESS_HOST: remoteHost });
+
+      expect(run.stderr).toContain("Refusing non-loopback PI_HARNESS_HOST");
+      expect(run.stdout).not.toContain("Pi Harness web console:");
+      expect(run.code).not.toBe(0);
+    }
+  }, 60_000);
+
+  test("binds a host outside the loopback allowlist once PI_HARNESS_ALLOW_REMOTE opts in", async () => {
+    // "LOCALHOST" is not one of the literals the launcher treats as loopback, so it takes the opt-in path, yet getaddrinfo still resolves it to the loopback address: the bind succeeds without putting the console on the network.
+    const run = await runLauncher("SIGINT", { PI_HARNESS_HOST: "LOCALHOST", PI_HARNESS_ALLOW_REMOTE: "1" });
+
+    expect(run.stderr).not.toContain("Refusing non-loopback PI_HARNESS_HOST");
+    expect(run.consoleUrl).toMatch(/^http:\/\/LOCALHOST:\d+$/u);
+    expect(run.code).toBe(130);
+  }, 60_000);
+
+  test("hands an opted-in host to listen and reports the bind failure when no interface owns it", async () => {
+    // 192.0.2.10 is TEST-NET-1 and is assigned to no interface, so this pins that the guard let the host through: the run dies in listen rather than in the guard.
+    const run = await runLauncherToExit({ PI_HARNESS_HOST: "192.0.2.10", PI_HARNESS_ALLOW_REMOTE: "1" });
+
+    expect(run.stderr).not.toContain("Refusing non-loopback PI_HARNESS_HOST");
+    expect(run.stderr).toContain("EADDRNOTAVAIL");
+    expect(run.code).toBe(1);
+  }, 60_000);
+
+  test("accepts a proxy hostname in the Host header only when PI_HARNESS_ALLOWED_HOSTS names it", async () => {
+    const statuses: number[] = [];
+    const run = await runLauncher("SIGINT", { PI_HARNESS_ALLOWED_HOSTS: " proxy.internal.example , " }, undefined, async (consoleUrl) => {
+      const port = Number(new URL(consoleUrl).port);
+      statuses.push(await statusWithHostHeader(port, `proxy.internal.example:${String(port)}`));
+      statuses.push(await statusWithHostHeader(port, `other.internal.example:${String(port)}`));
+    });
+
+    expect(statuses).toEqual([200, 400]);
+    expect(run.code).toBe(130);
+  }, 60_000);
+
+  test("rejects a PI_HARNESS_ALLOWED_HOSTS entry that is not a bare hostname", async () => {
+    for (const entry of ["https://proxy.example", "proxy.example:8443", "proxy.example/app"]) {
+      const run = await runLauncherToExit({ PI_HARNESS_ALLOWED_HOSTS: entry });
+
+      expect(run.stderr).toContain("PI_HARNESS_ALLOWED_HOSTS entries must be bare hostnames");
+      expect(run.stdout).not.toContain("Pi Harness web console:");
+      expect(run.code).not.toBe(0);
+    }
+  }, 60_000);
+
+  test("rejects a PI_HARNESS_PORT that is not an integer inside the valid range", async () => {
+    for (const badPort of ["70000", "-1", "abc"]) {
+      const run = await runLauncherToExit({ PI_HARNESS_PORT: badPort });
+
+      expect(run.stderr).toContain("PI_HARNESS_PORT must be an integer between 0 and 65535");
+      expect(run.stdout).not.toContain("Pi Harness web console:");
+      expect(run.code).not.toBe(0);
+    }
+  }, 60_000);
 });

package/node_modules/@pi-harness/api-gateway/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;;;;mBAmoBlC,OAAO;;AAHxB,wBA+2CE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;;;;mBAkqBlC,OAAO;;AAHxB,wBAg5CE"}

package/node_modules/@pi-harness/api-gateway/dist/index.js

@@ -1,10 +1,10 @@
 import { execFile } from "node:child_process";
 import { mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { atomicWriteFile } from "@pi-harness/core";
-import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, needsMarketplacePackageInstall, sortMarketplaceByRecommendation, } from "./marketplace.js";
+import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, needsMarketplacePackageInstall, marketplaceNpmPackageName, sortMarketplaceByRecommendation, } from "./marketplace.js";
 import { parseGitWorktrees } from "./workspaces.js";
 const loadMarketplaceStatistics = createMarketplaceStatisticsLoader();
 const DEFAULT_BODY_LIMIT_BYTES = 64 * 1024;
@@ -25,18 +25,19 @@ function sendJson(response, status, payload) {
     response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "content-length": Buffer.byteLength(body) });
     response.end(body);
 }
+// A multi-byte UTF-8 sequence can straddle a chunk boundary, so the raw bytes are collected and decoded once; decoding each chunk on its own would replace the split sequence with U+FFFD.
 async function bodyText(request, maxBytes = DEFAULT_BODY_LIMIT_BYTES) {
     const chunks = [];
     let length = 0;
     for await (const chunk of request) {
         const input = chunk;
-        const value = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-        length += Buffer.byteLength(value);
+        const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.isBuffer(input) ? input : Buffer.from(input);
+        length += buffer.length;
         if (length > maxBytes)
             throw new PayloadTooLargeError();
-        chunks.push(value);
+        chunks.push(buffer);
     }
-    return chunks.join("");
+    return Buffer.concat(chunks).toString("utf8");
 }
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
@@ -56,10 +57,16 @@ function jsonSafe(value, seen = new WeakSet()) {
         return Object.prototype.toString.call(value);
     if (seen.has(value))
         return "[Circular]";
+    // Only the ancestors of the current node stay marked: a sibling that repeats the same object (Pi pushes one AgentMessage instance into both the message list and its events) is legitimate data, not a cycle.
     seen.add(value);
-    if (Array.isArray(value))
-        return value.map((item) => jsonSafe(item, seen));
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+    try {
+        if (Array.isArray(value))
+            return value.map((item) => jsonSafe(item, seen));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+    }
+    finally {
+        seen.delete(value);
+    }
 }
 function createStatus(services, events) {
     const activeModel = services.runtime.session.model ?? services.models.model;
@@ -306,6 +313,7 @@ function sanitizeLogValue(value, state, depth = 0) {
         return "[Max Depth]";
     if (state.seen.has(value))
         return "[Circular]";
+    // Unmarked once its subtree is done, so an object logged twice as a sibling is rendered twice instead of being mistaken for a cycle.
     state.seen.add(value);
     try {
         if (value instanceof Date)
@@ -339,6 +347,9 @@ function sanitizeLogValue(value, state, depth = 0) {
     catch {
         return "[Unavailable]";
     }
+    finally {
+        state.seen.delete(value);
+    }
 }
 function sanitizeLogArguments(args) {
     const sanitized = sanitizeLogValue(args, { remaining: loggerPanelNodeLimit, seen: new WeakSet() });
@@ -478,17 +489,18 @@ function gitTerminationMessage(command, termination) {
         ? `git ${command} timed out after ${GIT_TIMEOUT_MS / 1000} seconds`
         : `git ${command} produced more output than the buffer limit allows`;
 }
+// `-z` is what makes the paths usable: without it git wraps any path holding a space, a quote or a non-ASCII byte in C-style quoting, and the quoted form is not a pathspec git will accept back on diff, add or ls-files.
 function gitStatus(cwd) {
     return new Promise((resolveStatus, rejectStatus) => {
-        execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
+        execFile("git", ["status", "--short", "-z", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
             if (error === null) {
                 resolveStatus({ output: stdout, truncated: false });
                 return;
             }
             const termination = gitTermination(error);
             if (termination === "output-limit") {
-                // Keep the complete lines that arrived before the kill; the final line may have been cut mid-path.
-                resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\n") + 1), truncated: true });
+                // Keep the complete records that arrived before the kill; the final one may have been cut mid-path.
+                resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\0") + 1), truncated: true });
                 return;
             }
             if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
@@ -539,6 +551,26 @@ async function isDirectory(path) {
         return false;
     }
 }
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+// The loader resolves a bare plugin specifier from the profile file upwards (`createRequire(profilePath).resolve(name)`), never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load.
+async function marketplaceInstallDirectory(configPath, fallback) {
+    let directory = dirname(resolve(configPath));
+    let parent = dirname(directory);
+    while (parent !== directory) {
+        if (await isFile(join(directory, "package.json")))
+            return directory;
+        directory = parent;
+        parent = dirname(directory);
+    }
+    return fallback;
+}
 function pickDirectory() {
     return new Promise((resolvePath, reject) => {
         execFile("osascript", ["-e", 'POSIX path of (choose folder with prompt "选择 Pi 工作区")'], { timeout: 120_000, maxBuffer: 64 * 1024 }, (error, stdout, stderr) => {
@@ -989,15 +1021,17 @@ export default {
                         sendJson(response, 409, { error: "Plugin is already installed", plugin });
                         return;
                     }
-                    const packageJsonPath = join(services.launch.cwd, "package.json");
-                    const packageLockPath = join(services.launch.cwd, "package-lock.json");
+                    const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+                    const packageJsonPath = join(installDirectory, "package.json");
+                    const packageLockPath = join(installDirectory, "package-lock.json");
                     const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
                     const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
                     let profileBefore;
                     let entryId;
                     try {
                         if (needsMarketplacePackageInstall(plugin)) {
-                            await runProcess("npm", ["install", "--save-exact", "--package-lock=false", `${plugin.packageName}@${plugin.version}`], services.launch.cwd);
+                            const specifier = `${marketplaceNpmPackageName(plugin.packageName)}@${plugin.version}`;
+                            await runProcess("npm", ["install", "--save-exact", "--package-lock=false", specifier], installDirectory);
                         }
                         profileBefore = await appendMarketplaceProfile(configPath, plugin);
                         if (!needsMarketplacePackageInstall(plugin)) {
@@ -1021,9 +1055,14 @@ export default {
                             await loader.remove(entryId).catch(() => { });
                         if (profileBefore !== undefined)
                             await writeFile(configPath, profileBefore, "utf8").catch(() => { });
-                        if (packageJsonBefore !== undefined)
+                        // A manifest npm created for this install is removed rather than left behind; restoring is only possible when one existed before.
+                        if (packageJsonBefore === undefined)
+                            await unlink(packageJsonPath).catch(() => { });
+                        else
                             await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => { });
-                        if (packageLockBefore !== undefined)
+                        if (packageLockBefore === undefined)
+                            await unlink(packageLockPath).catch(() => { });
+                        else
                             await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => { });
                         sendJson(response, 502, { error: errorText(error) });
                     }
@@ -1125,8 +1164,9 @@ export default {
                     }
                     const profileEntryId = entry.options.id;
                     const profileBefore = await readFile(configPath, "utf8");
-                    const packageJsonPath = join(services.launch.cwd, "package.json");
-                    const packageLockPath = join(services.launch.cwd, "package-lock.json");
+                    const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+                    const packageJsonPath = join(installDirectory, "package.json");
+                    const packageLockPath = join(installDirectory, "package-lock.json");
                     const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
                     const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
                     await entry.parent.remove(entry.options.id);
@@ -1134,7 +1174,7 @@ export default {
                     try {
                         await updateMarketplaceProfile(configPath, profileEntryId, { remove: true });
                         if (needsMarketplacePackageInstall(plugin))
-                            await runProcess("npm", ["uninstall", "--package-lock=false", plugin.packageName], services.launch.cwd);
+                            await runProcess("npm", ["uninstall", "--package-lock=false", marketplaceNpmPackageName(plugin.packageName)], installDirectory);
                         sendJson(response, 200, { uninstalled: true, id: payload.id });
                     }
                     catch (error) {
@@ -1246,18 +1286,22 @@ export default {
                     sendJson(response, 500, { error: errorText(error) });
                     return;
                 }
-                const items = status.output
-                    .split("\n")
-                    .map((line) => line.trimEnd())
-                    .filter((line) => line.length > 0)
-                    .map((line) => {
-                    const status = line.slice(0, 2).trim() || "??";
-                    return {
-                        path: line.slice(3),
-                        status,
-                        label: status === "??" ? "untracked" : status.includes("D") ? "deleted" : status.includes("A") ? "added" : "modified",
-                    };
-                });
+                const records = status.output.split("\0");
+                const items = [];
+                for (let index = 0; index < records.length; index += 1) {
+                    const record = records[index] ?? "";
+                    if (record.length < 4)
+                        continue;
+                    const code = record.slice(0, 2).trim() || "??";
+                    // Rename and copy records carry the original path in a second NUL-terminated field, which is not a workspace change of its own.
+                    if (code.startsWith("R") || code.startsWith("C"))
+                        index += 1;
+                    items.push({
+                        path: record.slice(3),
+                        status: code,
+                        label: code === "??" ? "untracked" : code.includes("D") ? "deleted" : code.includes("A") ? "added" : "modified",
+                    });
+                }
                 sendJson(response, 200, { items, ...(status.truncated ? { truncated: true } : {}) });
             },
         });
@@ -1744,21 +1788,48 @@ export default {
                         sendJson(response, 409, { error: "Cannot batch-delete the active session" });
                         return;
                     }
-                    await mutateSessionMetadata(manager, context.logger, async (metadata) => {
+                    if (action === "delete") {
+                        // The unlinks run outside the metadata mutation: a failure halfway through must not discard the key removals for the files that are already gone from disk.
+                        const removed = [];
+                        const failed = [];
                         for (const path of paths) {
-                            if (action === "delete") {
+                            try {
                                 await unlink(path);
-                                delete metadata[path];
+                                removed.push(path);
                             }
-                            else {
-                                const current = metadata[path] ?? {};
-                                metadata[path] = {
-                                    ...current,
-                                    ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
-                                    ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
-                                };
+                            catch (error) {
+                                // A session another tab already deleted leaves nothing to unlink, but its metadata entry still has to go.
+                                if (error.code === "ENOENT")
+                                    removed.push(path);
+                                else
+                                    failed.push({ path, error: errorText(error) });
                             }
                         }
+                        await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                            for (const path of removed)
+                                delete metadata[path];
+                        });
+                        if (failed.length > 0) {
+                            sendJson(response, 409, {
+                                error: `Some sessions could not be deleted: ${failed.map((item) => item.path).join(", ")}`,
+                                action,
+                                count: removed.length,
+                                failed,
+                            });
+                            return;
+                        }
+                        sendJson(response, 200, { action, count: removed.length });
+                        return;
+                    }
+                    await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                        for (const path of paths) {
+                            const current = metadata[path] ?? {};
+                            metadata[path] = {
+                                ...current,
+                                ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
+                                ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
+                            };
+                        }
                     });
                     sendJson(response, 200, { action, count: paths.length });
                 }