@pi-harness/pi-harness 0.1.23 → 0.1.25

package/node_modules/@pi-harness/api-gateway/dist/index.js

@@ -1,10 +1,10 @@
 import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { mkdir, mkdtemp, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { atomicWriteFile } from "@pi-harness/core";
-import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, needsMarketplacePackageInstall, sortMarketplaceByRecommendation, } from "./marketplace.js";
+import { MARKETPLACE_CAPABILITIES, MARKETPLACE_CATEGORIES, MARKETPLACE_PLUGINS, attachMarketplaceStatistics, createMarketplaceStatisticsLoader, paginateMarketplace, searchMarketplace, needsMarketplacePackageInstall, marketplaceNpmPackageName, sortMarketplaceByRecommendation, } from "./marketplace.js";
 import { parseGitWorktrees } from "./workspaces.js";
 const loadMarketplaceStatistics = createMarketplaceStatisticsLoader();
 const DEFAULT_BODY_LIMIT_BYTES = 64 * 1024;
@@ -14,6 +14,8 @@ const IMPORT_BODY_LIMIT_BYTES = 16 * 1024 * 1024;
 // Retained trajectory events are replayed to every SSE client and returned by /api/session, so the array must stay bounded.
 const MAX_RETAINED_EVENTS = 2000;
 const GIT_TIMEOUT_MS = 15_000;
+// Mutating commands run user hooks (pre-commit, lint-staged, test suites) and may stage large trees; killing them part-way leaves index.lock and a half-finished operation behind, so they get a far more generous bound than read-only queries.
+const GIT_MUTATION_TIMEOUT_MS = 120_000;
 class PayloadTooLargeError extends Error {
     constructor() {
         super("Request body is too large");
@@ -25,18 +27,19 @@ function sendJson(response, status, payload) {
     response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "content-length": Buffer.byteLength(body) });
     response.end(body);
 }
+// A multi-byte UTF-8 sequence can straddle a chunk boundary, so the raw bytes are collected and decoded once; decoding each chunk on its own would replace the split sequence with U+FFFD.
 async function bodyText(request, maxBytes = DEFAULT_BODY_LIMIT_BYTES) {
     const chunks = [];
     let length = 0;
     for await (const chunk of request) {
         const input = chunk;
-        const value = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-        length += Buffer.byteLength(value);
+        const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.isBuffer(input) ? input : Buffer.from(input);
+        length += buffer.length;
         if (length > maxBytes)
             throw new PayloadTooLargeError();
-        chunks.push(value);
+        chunks.push(buffer);
     }
-    return chunks.join("");
+    return Buffer.concat(chunks).toString("utf8");
 }
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
@@ -56,10 +59,16 @@ function jsonSafe(value, seen = new WeakSet()) {
         return Object.prototype.toString.call(value);
     if (seen.has(value))
         return "[Circular]";
+    // Only the ancestors of the current node stay marked: a sibling that repeats the same object (Pi pushes one AgentMessage instance into both the message list and its events) is legitimate data, not a cycle.
     seen.add(value);
-    if (Array.isArray(value))
-        return value.map((item) => jsonSafe(item, seen));
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+    try {
+        if (Array.isArray(value))
+            return value.map((item) => jsonSafe(item, seen));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+    }
+    finally {
+        seen.delete(value);
+    }
 }
 function createStatus(services, events) {
     const activeModel = services.runtime.session.model ?? services.models.model;
@@ -120,7 +129,7 @@ function piConfig(services) {
 function sessionMetadataFile(manager) {
     return resolve(manager.getSessionDir(), ".pi-harness-session-meta.json");
 }
-// A missing file is the normal first-run state. Any other read or parse failure means the file exists but is unusable; it is renamed aside so the wreckage survives for recovery and the next write cannot silently replace the only copy.
+// A missing file is the normal first-run state. A parse or shape failure means the file exists but is unusable; it is renamed aside so the wreckage survives for recovery and the next write cannot silently replace the only copy. Any other read error (EMFILE, EBUSY, EISDIR, permissions) says nothing about the content, so it propagates and the caller's write is skipped instead of replacing a valid map with an empty one.
 async function readSessionMetadata(manager, logger) {
     const file = sessionMetadataFile(manager);
     let raw;
@@ -130,8 +139,7 @@ async function readSessionMetadata(manager, logger) {
     catch (error) {
         if (error.code === "ENOENT")
             return {};
-        await quarantineSessionMetadata(file, logger, error);
-        return {};
+        throw error;
     }
     try {
         const parsed = JSON.parse(raw);
@@ -158,25 +166,33 @@ async function writeSessionMetadata(manager, metadata) {
     await mkdir(manager.getSessionDir(), { recursive: true });
     await atomicWriteFile(sessionMetadataFile(manager), JSON.stringify(metadata, null, 2) + "\n", { encoding: "utf8" });
 }
-// Every read-modify-write of the metadata file runs through this chain so concurrent requests cannot interleave and drop each other's updates.
+// Every access to the metadata file runs through this chain so concurrent requests cannot interleave and drop each other's updates. Plain reads take the lock too: a read that finds corrupt bytes quarantines the file, and doing that outside the lock could rename away a valid map that a concurrent mutation had just written.
 let sessionMetadataQueue = Promise.resolve();
+function withSessionMetadataLock(operation) {
+    const next = sessionMetadataQueue.catch(() => undefined).then(operation);
+    sessionMetadataQueue = next;
+    return next;
+}
+function readSessionMetadataLocked(manager, logger) {
+    return withSessionMetadataLock(() => readSessionMetadata(manager, logger));
+}
 function mutateSessionMetadata(manager, logger, mutate) {
-    const operation = sessionMetadataQueue
-        .catch(() => undefined)
-        .then(async () => {
+    return withSessionMetadataLock(async () => {
         const metadata = await readSessionMetadata(manager, logger);
         const result = await mutate(metadata);
         await writeSessionMetadata(manager, metadata);
         return result;
     });
-    sessionMetadataQueue = operation;
-    return operation;
+}
+// True when a path.relative() result points outside the directory it was computed from. All containment checks share this predicate so they agree on every platform separator.
+function escapesRoot(relativePath) {
+    return isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + sep);
 }
 function sessionPathInDirectory(path, manager) {
     const root = resolve(manager.getSessionDir());
     const target = resolve(path);
     const relativePath = relative(root, target);
-    return relativePath !== "" && !isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(".." + sep) && target.endsWith(".jsonl");
+    return relativePath !== "" && !escapesRoot(relativePath) && target.endsWith(".jsonl");
 }
 const webSessionUi = {
     select: (_title, options) => Promise.resolve(options[0]),
@@ -306,6 +322,7 @@ function sanitizeLogValue(value, state, depth = 0) {
         return "[Max Depth]";
     if (state.seen.has(value))
         return "[Circular]";
+    // Unmarked once its subtree is done, so an object logged twice as a sibling is rendered twice instead of being mistaken for a cycle.
     state.seen.add(value);
     try {
         if (value instanceof Date)
@@ -339,6 +356,9 @@ function sanitizeLogValue(value, state, depth = 0) {
     catch {
         return "[Unavailable]";
     }
+    finally {
+        state.seen.delete(value);
+    }
 }
 function sanitizeLogArguments(args) {
     const sanitized = sanitizeLogValue(args, { remaining: loggerPanelNodeLimit, seen: new WeakSet() });
@@ -473,22 +493,38 @@ function gitTermination(error) {
         return "timeout";
     return undefined;
 }
-function gitTerminationMessage(command, termination) {
+function gitTerminationMessage(command, termination, timeoutMs = GIT_TIMEOUT_MS) {
     return termination === "timeout"
-        ? `git ${command} timed out after ${GIT_TIMEOUT_MS / 1000} seconds`
+        ? `git ${command} timed out after ${timeoutMs / 1000} seconds`
         : `git ${command} produced more output than the buffer limit allows`;
 }
-function gitStatus(cwd) {
+// `-z` output is NUL-separated and never C-quoted, so non-ASCII names arrive verbatim and a rename carries its original path as the following field instead of an `old -> new` pair. The paths are relative to the repository root regardless of cwd, so they are rebased onto the cwd prefix to keep the contract with /api/files/diff, /api/files/commit and /api/files/revert, which resolve paths against the same cwd.
+function parseGitStatus(output, prefix) {
+    const fields = output.split("\0");
+    const entries = [];
+    for (let index = 0; index < fields.length; index += 1) {
+        const field = fields[index] ?? "";
+        if (field.length < 4)
+            continue;
+        const code = field.slice(0, 2);
+        const path = field.slice(3);
+        if (code.startsWith("R") || code.startsWith("C"))
+            index += 1;
+        entries.push({ path: prefix === "" ? path : posix.relative("/" + prefix, "/" + path), status: code.trim() || "??" });
+    }
+    return entries;
+}
+function gitStatusOutput(cwd) {
     return new Promise((resolveStatus, rejectStatus) => {
-        execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
+        execFile("git", ["status", "--porcelain", "-z", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
             if (error === null) {
                 resolveStatus({ output: stdout, truncated: false });
                 return;
             }
             const termination = gitTermination(error);
             if (termination === "output-limit") {
-                // Keep the complete lines that arrived before the kill; the final line may have been cut mid-path.
-                resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\n") + 1), truncated: true });
+                // Keep the complete entries that arrived before the kill; the final entry may have been cut mid-path.
+                resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\0") + 1), truncated: true });
                 return;
             }
             if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
@@ -499,14 +535,21 @@ function gitStatus(cwd) {
         });
     });
 }
+async function gitStatus(cwd) {
+    const { output, truncated } = await gitStatusOutput(cwd);
+    if (output === "")
+        return { entries: [], truncated };
+    const prefix = await gitCommand(cwd, ["rev-parse", "--show-prefix"]);
+    return { entries: parseGitStatus(output, prefix.code === 0 ? prefix.stdout.trim() : ""), truncated };
+}
 function gitDiff(cwd, path) {
     return new Promise((resolveOutput) => {
         execFile("git", ["diff", "--no-ext-diff", "--", path], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) => resolveOutput(error && stdout.length === 0 ? "" : stdout));
     });
 }
-function gitCommand(cwd, args) {
+function gitCommand(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
     return new Promise((resolveResult) => {
-        execFile("git", [...args], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
+        execFile("git", [...args], { cwd, timeout: timeoutMs, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
             const code = error && typeof error.code === "number" ? error.code : error ? 1 : 0;
             resolveResult({ stdout, stderr, code, terminated: gitTermination(error) });
         });
@@ -539,6 +582,26 @@ async function isDirectory(path) {
         return false;
     }
 }
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+// The loader resolves a bare plugin specifier from the profile file upwards (`createRequire(profilePath).resolve(name)`), never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load.
+async function marketplaceInstallDirectory(configPath, fallback) {
+    let directory = dirname(resolve(configPath));
+    let parent = dirname(directory);
+    while (parent !== directory) {
+        if (await isFile(join(directory, "package.json")))
+            return directory;
+        directory = parent;
+        parent = dirname(directory);
+    }
+    return fallback;
+}
 function pickDirectory() {
     return new Promise((resolvePath, reject) => {
         execFile("osascript", ["-e", 'POSIX path of (choose folder with prompt "选择 Pi 工作区")'], { timeout: 120_000, maxBuffer: 64 * 1024 }, (error, stdout, stderr) => {
@@ -562,7 +625,7 @@ function workspacePaths(root, paths) {
         const requested = path;
         const absolute = resolve(root, requested);
         const relativePath = relative(root, absolute);
-        if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith("../"))
+        if (escapesRoot(relativePath))
             return new Error("path must stay inside the workspace");
         normalized.push(relativePath);
     }
@@ -725,8 +788,8 @@ export default {
                         sendJson(response, 400, { error: "settings source must contain a JSON object" });
                         return;
                     }
-                    const path = join(services.launch.agentDir, "settings.json");
-                    // Replace the file atomically so an interrupted write never leaves a truncated settings.json behind; keep the existing permission bits.
+                    // Replace the file atomically so an interrupted write never leaves a truncated settings.json behind; keep the existing permission bits. The rename must land on the resolved target, otherwise a symlinked settings.json (dotfiles repositories) would be replaced by a detached regular file.
+                    const path = await realpath(join(services.launch.agentDir, "settings.json")).catch(() => join(services.launch.agentDir, "settings.json"));
                     const mode = await stat(path).then((info) => info.mode & 0o777, () => 0o644);
                     await atomicWriteFile(path, JSON.stringify(parsed, null, 2) + "\n", { encoding: "utf8", mode });
                     await services.runtime.session.settingsManager.reload();
@@ -989,15 +1052,17 @@ export default {
                         sendJson(response, 409, { error: "Plugin is already installed", plugin });
                         return;
                     }
-                    const packageJsonPath = join(services.launch.cwd, "package.json");
-                    const packageLockPath = join(services.launch.cwd, "package-lock.json");
+                    const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+                    const packageJsonPath = join(installDirectory, "package.json");
+                    const packageLockPath = join(installDirectory, "package-lock.json");
                     const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
                     const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
                     let profileBefore;
                     let entryId;
                     try {
                         if (needsMarketplacePackageInstall(plugin)) {
-                            await runProcess("npm", ["install", "--save-exact", "--package-lock=false", `${plugin.packageName}@${plugin.version}`], services.launch.cwd);
+                            const specifier = `${marketplaceNpmPackageName(plugin.packageName)}@${plugin.version}`;
+                            await runProcess("npm", ["install", "--save-exact", "--package-lock=false", specifier], installDirectory);
                         }
                         profileBefore = await appendMarketplaceProfile(configPath, plugin);
                         if (!needsMarketplacePackageInstall(plugin)) {
@@ -1021,9 +1086,14 @@ export default {
                             await loader.remove(entryId).catch(() => { });
                         if (profileBefore !== undefined)
                             await writeFile(configPath, profileBefore, "utf8").catch(() => { });
-                        if (packageJsonBefore !== undefined)
+                        // A manifest npm created for this install is removed rather than left behind; restoring is only possible when one existed before.
+                        if (packageJsonBefore === undefined)
+                            await unlink(packageJsonPath).catch(() => { });
+                        else
                             await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => { });
-                        if (packageLockBefore !== undefined)
+                        if (packageLockBefore === undefined)
+                            await unlink(packageLockPath).catch(() => { });
+                        else
                             await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => { });
                         sendJson(response, 502, { error: errorText(error) });
                     }
@@ -1125,8 +1195,9 @@ export default {
                     }
                     const profileEntryId = entry.options.id;
                     const profileBefore = await readFile(configPath, "utf8");
-                    const packageJsonPath = join(services.launch.cwd, "package.json");
-                    const packageLockPath = join(services.launch.cwd, "package-lock.json");
+                    const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+                    const packageJsonPath = join(installDirectory, "package.json");
+                    const packageLockPath = join(installDirectory, "package-lock.json");
                     const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
                     const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
                     await entry.parent.remove(entry.options.id);
@@ -1134,7 +1205,7 @@ export default {
                     try {
                         await updateMarketplaceProfile(configPath, profileEntryId, { remove: true });
                         if (needsMarketplacePackageInstall(plugin))
-                            await runProcess("npm", ["uninstall", "--package-lock=false", plugin.packageName], services.launch.cwd);
+                            await runProcess("npm", ["uninstall", "--package-lock=false", marketplaceNpmPackageName(plugin.packageName)], installDirectory);
                         sendJson(response, 200, { uninstalled: true, id: payload.id });
                     }
                     catch (error) {
@@ -1246,18 +1317,11 @@ export default {
                     sendJson(response, 500, { error: errorText(error) });
                     return;
                 }
-                const items = status.output
-                    .split("\n")
-                    .map((line) => line.trimEnd())
-                    .filter((line) => line.length > 0)
-                    .map((line) => {
-                    const status = line.slice(0, 2).trim() || "??";
-                    return {
-                        path: line.slice(3),
-                        status,
-                        label: status === "??" ? "untracked" : status.includes("D") ? "deleted" : status.includes("A") ? "added" : "modified",
-                    };
-                });
+                const items = status.entries.map((entry) => ({
+                    path: entry.path,
+                    status: entry.status,
+                    label: entry.status === "??" ? "untracked" : entry.status.includes("D") ? "deleted" : entry.status.includes("A") ? "added" : "modified",
+                }));
                 sendJson(response, 200, { items, ...(status.truncated ? { truncated: true } : {}) });
             },
         });
@@ -1277,7 +1341,7 @@ export default {
                 const root = resolve(activeCwd(services));
                 const absolute = resolve(root, requested);
                 const relativePath = relative(root, absolute);
-                if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + sep)) {
+                if (escapesRoot(relativePath)) {
                     sendJson(response, 400, { error: "path must stay inside the workspace" });
                     return;
                 }
@@ -1303,18 +1367,18 @@ export default {
                         return;
                     }
                     const root = resolve(activeCwd(services));
-                    const add = await gitCommand(root, ["add", "-A", "--", ...paths]);
+                    const add = await gitCommand(root, ["add", "-A", "--", ...paths], GIT_MUTATION_TIMEOUT_MS);
                     if (add.terminated) {
-                        sendJson(response, 500, { error: gitTerminationMessage("add", add.terminated) });
+                        sendJson(response, 500, { error: gitTerminationMessage("add", add.terminated, GIT_MUTATION_TIMEOUT_MS) });
                         return;
                     }
                     if (add.code !== 0) {
                         sendJson(response, 409, { error: add.stderr.trim() || "Unable to stage workspace files" });
                         return;
                     }
-                    const commit = await gitCommand(root, ["commit", "-m", payload.message.trim(), "--", ...paths]);
+                    const commit = await gitCommand(root, ["commit", "-m", payload.message.trim(), "--", ...paths], GIT_MUTATION_TIMEOUT_MS);
                     if (commit.terminated) {
-                        sendJson(response, 500, { error: gitTerminationMessage("commit", commit.terminated) });
+                        sendJson(response, 500, { error: gitTerminationMessage("commit", commit.terminated, GIT_MUTATION_TIMEOUT_MS) });
                         return;
                     }
                     if (commit.code !== 0) {
@@ -1370,9 +1434,9 @@ export default {
                         return;
                     }
                     if (trackedPaths.length > 0) {
-                        const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...trackedPaths]);
+                        const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...trackedPaths], GIT_MUTATION_TIMEOUT_MS);
                         if (restore.terminated) {
-                            sendJson(response, 500, { error: gitTerminationMessage("restore", restore.terminated) });
+                            sendJson(response, 500, { error: gitTerminationMessage("restore", restore.terminated, GIT_MUTATION_TIMEOUT_MS) });
                             return;
                         }
                         if (restore.code !== 0) {
@@ -1744,21 +1808,48 @@ export default {
                         sendJson(response, 409, { error: "Cannot batch-delete the active session" });
                         return;
                     }
-                    await mutateSessionMetadata(manager, context.logger, async (metadata) => {
+                    if (action === "delete") {
+                        // The unlinks run outside the metadata mutation: a failure halfway through must not discard the key removals for the files that are already gone from disk.
+                        const removed = [];
+                        const failed = [];
                         for (const path of paths) {
-                            if (action === "delete") {
+                            try {
                                 await unlink(path);
-                                delete metadata[path];
+                                removed.push(path);
                             }
-                            else {
-                                const current = metadata[path] ?? {};
-                                metadata[path] = {
-                                    ...current,
-                                    ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
-                                    ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
-                                };
+                            catch (error) {
+                                // A session another tab already deleted leaves nothing to unlink, but its metadata entry still has to go.
+                                if (error.code === "ENOENT")
+                                    removed.push(path);
+                                else
+                                    failed.push({ path, error: errorText(error) });
                             }
                         }
+                        await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                            for (const path of removed)
+                                delete metadata[path];
+                        });
+                        if (failed.length > 0) {
+                            sendJson(response, 409, {
+                                error: `Some sessions could not be deleted: ${failed.map((item) => item.path).join(", ")}`,
+                                action,
+                                count: removed.length,
+                                failed,
+                            });
+                            return;
+                        }
+                        sendJson(response, 200, { action, count: removed.length });
+                        return;
+                    }
+                    await mutateSessionMetadata(manager, context.logger, (metadata) => {
+                        for (const path of paths) {
+                            const current = metadata[path] ?? {};
+                            metadata[path] = {
+                                ...current,
+                                ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
+                                ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
+                            };
+                        }
                     });
                     sendJson(response, 200, { action, count: paths.length });
                 }
@@ -1899,7 +1990,7 @@ export default {
                     const page = Math.max(0, Number.parseInt(url.searchParams.get("page") ?? "0", 10) || 0);
                     const pageSize = Math.min(100, Math.max(1, Number.parseInt(url.searchParams.get("pageSize") ?? "50", 10) || 50));
                     const includeArchived = url.searchParams.get("includeArchived") === "true";
-                    const metadata = await readSessionMetadata(manager, context.logger);
+                    const metadata = await readSessionMetadataLocked(manager, context.logger);
                     const items = typeof manager.isPersisted === "function" && manager.isPersisted() ? await SessionManager.list(services.launch.cwd, manager.getSessionDir()) : [];
                     const filtered = items.filter((item) => includeArchived || metadata[item.path]?.archived !== true);
                     const sorted = filtered.sort((a, b) => Number(metadata[b.path]?.pinned === true) - Number(metadata[a.path]?.pinned === true) || b.modified.getTime() - a.modified.getTime());