@selesai/code 0.5.28 → 0.6.1

package/dist/extensions/pi-intercom/broker/extension-state.ts

@@ -0,0 +1,186 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+
+const MAX_STATE_BYTES = 64 * 1024;
+
+export interface StateEnvelope {
+  formatVersion: 1;
+  namespace: string;
+  revision: number;
+  updatedAt: number;
+  payloadSha256: string;
+  payload: unknown;
+}
+
+export interface StateCommitResult {
+  committed: boolean;
+  revision: number;
+  reason?: string;
+  payload?: unknown;
+}
+
+function serializePayload(payload: unknown): string | null {
+  try {
+    const json = JSON.stringify(payload);
+    if (json === undefined || Buffer.byteLength(json, "utf8") > MAX_STATE_BYTES) {
+      return null;
+    }
+    return json;
+  } catch {
+    return null;
+  }
+}
+
+function payloadHash(payloadJson: string): string {
+  return createHash("sha256").update(payloadJson).digest("hex");
+}
+
+export class ExtensionStateManager {
+  private readonly states = new Map<string, { revision: number; payload: unknown }>();
+  private readonly stateDir: string;
+
+  constructor(runtimeDir: string) {
+    this.stateDir = join(runtimeDir, "extension-state");
+    mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
+  }
+
+  private statePath(namespace: string): string {
+    const hash = createHash("sha256").update(namespace).digest("hex");
+    return join(this.stateDir, `${hash}.json`);
+  }
+
+  private backupPath(namespace: string): string {
+    return `${this.statePath(namespace)}.bak`;
+  }
+
+  private readEnvelope(filePath: string, namespace: string): StateEnvelope | null {
+    if (!existsSync(filePath)) return null;
+
+    try {
+      const content = readFileSync(filePath, "utf8");
+      const value: unknown = JSON.parse(content);
+      if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+
+      const envelope = value as Record<string, unknown>;
+      if (
+        envelope.formatVersion !== 1
+        || envelope.namespace !== namespace
+        || !Number.isSafeInteger(envelope.revision)
+        || (envelope.revision as number) < 0
+        || typeof envelope.updatedAt !== "number"
+        || typeof envelope.payloadSha256 !== "string"
+      ) {
+        return null;
+      }
+
+      const payloadJson = serializePayload(envelope.payload);
+      if (payloadJson === null || payloadHash(payloadJson) !== envelope.payloadSha256) {
+        return null;
+      }
+
+      return envelope as unknown as StateEnvelope;
+    } catch {
+      return null;
+    }
+  }
+
+  loadState(namespace: string): { revision: number; payload: unknown } | null {
+    const cached = this.states.get(namespace);
+    if (cached) return cached;
+
+    const envelope = this.readEnvelope(this.statePath(namespace), namespace)
+      ?? this.readEnvelope(this.backupPath(namespace), namespace);
+    if (!envelope) return null;
+
+    const state = { revision: envelope.revision, payload: envelope.payload };
+    this.states.set(namespace, state);
+    return state;
+  }
+
+  commitState(namespace: string, expectedRevision: number, payload: unknown): StateCommitResult {
+    const payloadJson = serializePayload(payload);
+    const current = this.loadState(namespace);
+    const currentRevision = current?.revision ?? 0;
+
+    if (payloadJson === null) {
+      return {
+        committed: false,
+        revision: currentRevision,
+        reason: "Invalid extension state or payload exceeds 64 KiB limit",
+      };
+    }
+    if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0) {
+      return { committed: false, revision: currentRevision, reason: "Invalid expected revision" };
+    }
+    if (expectedRevision !== currentRevision) {
+      return {
+        committed: false,
+        revision: currentRevision,
+        reason: "Revision mismatch",
+        ...(current ? { payload: current.payload } : {}),
+      };
+    }
+
+    const envelope: StateEnvelope = {
+      formatVersion: 1,
+      namespace,
+      revision: currentRevision + 1,
+      updatedAt: Date.now(),
+      payloadSha256: payloadHash(payloadJson),
+      payload,
+    };
+    const statePath = this.statePath(namespace);
+    const backupPath = this.backupPath(namespace);
+    const tempPath = `${statePath}.tmp.${process.pid}.${randomUUID()}`;
+
+    try {
+      writeFileSync(tempPath, JSON.stringify(envelope), { mode: 0o600 });
+      const file = openSync(tempPath, "r");
+      try {
+        fsyncSync(file);
+      } finally {
+        closeSync(file);
+      }
+
+      if (this.readEnvelope(statePath, namespace)) {
+        copyFileSync(statePath, backupPath);
+      }
+      renameSync(tempPath, statePath);
+
+      try {
+        const directory = openSync(dirname(statePath), "r");
+        try {
+          fsyncSync(directory);
+        } finally {
+          closeSync(directory);
+        }
+      } catch {
+        // Directory fsync is unavailable on some platforms.
+      }
+
+      const state = { revision: envelope.revision, payload };
+      this.states.set(namespace, state);
+      return { committed: true, revision: envelope.revision };
+    } catch {
+      return { committed: false, revision: currentRevision, reason: "Failed to persist extension state" };
+    } finally {
+      rmSync(tempPath, { force: true });
+    }
+  }
+
+  getCurrentRevision(namespace: string): number {
+    return this.loadState(namespace)?.revision ?? 0;
+  }
+}

package/dist/extensions/pi-intercom/broker/extension.test.ts

@@ -0,0 +1,387 @@
+import assert from "node:assert/strict";
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { once } from "node:events";
+import { mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import type { BrokerMessage, SessionRegistration } from "../types.ts";
+import { IntercomClient } from "./client.ts";
+import { ExtensionStateManager } from "./extension-state.ts";
+import { getTsxCliPath } from "./spawn.ts";
+
+const repoDir = process.cwd();
+
+function registration(name: string, startedAt: number, ownerEligible?: boolean): SessionRegistration {
+  return {
+    name,
+    cwd: "/test",
+    model: "test-model",
+    pid: process.pid,
+    startedAt,
+    lastActivity: Date.now(),
+    ...(ownerEligible === undefined
+      ? {}
+      : { extensions: [{ namespace: "test/v1", ownerEligible }] }),
+  };
+}
+
+async function waitFor(
+  messages: BrokerMessage[],
+  predicate: (message: BrokerMessage) => boolean,
+  timeoutMs = 3000,
+): Promise<BrokerMessage> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const message = messages.find(predicate);
+    if (message) return message;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error("Timed out waiting for broker message");
+}
+
+async function startBroker(agentDir: string): Promise<ChildProcessWithoutNullStreams> {
+  const broker = spawn(
+    process.execPath,
+    [getTsxCliPath(repoDir), path.join(repoDir, "broker", "broker.ts")],
+    {
+      cwd: repoDir,
+      env: { ...process.env, SELESAI_CODING_AGENT_DIR: agentDir },
+      stdio: ["pipe", "pipe", "pipe"],
+    },
+  );
+  const ready = new Promise<void>((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error("Broker startup timed out")), 10_000);
+    broker.stdout.on("data", (chunk: Buffer) => {
+      if (chunk.toString().includes("Intercom broker started")) {
+        clearTimeout(timeout);
+        resolve();
+      }
+    });
+    broker.once("exit", (code, signal) => {
+      clearTimeout(timeout);
+      reject(new Error(`Broker exited before startup (${code ?? signal})`));
+    });
+  });
+  await ready;
+  return broker;
+}
+
+async function stopBroker(broker: ChildProcessWithoutNullStreams): Promise<void> {
+  if (broker.exitCode !== null) return;
+  broker.kill("SIGTERM");
+  await once(broker, "exit");
+}
+
+test("extension bus negotiates, routes, elects an owner, and persists state", { concurrency: false, timeout: 30_000 }, async () => {
+  const agentDir = mkdtempSync(path.join(tmpdir(), "pi-intercom-extension-"));
+  const previousAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+  process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+  const broker = await startBroker(agentDir);
+  const clients: IntercomClient[] = [];
+
+  try {
+    const invalidNamespace = new IntercomClient();
+    await assert.rejects(
+      invalidNamespace.connect({
+        ...registration("invalid", Date.now()),
+        extensions: [{ namespace: "Invalid Namespace", ownerEligible: true }],
+      }),
+    );
+
+    const tooManyExtensions = new IntercomClient();
+    await assert.rejects(
+      tooManyExtensions.connect({
+        ...registration("too-many", Date.now()),
+        extensions: Array.from({ length: 33 }, (_, index) => ({
+          namespace: `test-${index}/v1`,
+          ownerEligible: true,
+        })),
+      }),
+    );
+
+    const owner = new IntercomClient();
+    const peer = new IntercomClient();
+    const legacy = new IntercomClient();
+    const late = new IntercomClient();
+    const peerOnlyA = new IntercomClient();
+    const peerOnlyB = new IntercomClient();
+    clients.push(owner, peer, legacy, late, peerOnlyA, peerOnlyB);
+
+    const ownerMessages: BrokerMessage[] = [];
+    const peerMessages: BrokerMessage[] = [];
+    const legacyMessages: BrokerMessage[] = [];
+    const lateMessages: BrokerMessage[] = [];
+    const peerOnlyBMessages: BrokerMessage[] = [];
+    const ownerErrors: Error[] = [];
+    const legacyErrors: Error[] = [];
+    owner.onBrokerMessage((message) => ownerMessages.push(message));
+    peer.onBrokerMessage((message) => peerMessages.push(message));
+    legacy.onBrokerMessage((message) => legacyMessages.push(message));
+    late.onBrokerMessage((message) => lateMessages.push(message));
+    peerOnlyB.onBrokerMessage((message) => peerOnlyBMessages.push(message));
+    owner.on("error", (error) => ownerErrors.push(error));
+    peer.on("error", () => {});
+    legacy.on("error", (error) => legacyErrors.push(error));
+    late.on("error", () => {});
+    peerOnlyA.on("error", () => {});
+    peerOnlyB.on("error", () => {});
+
+    const now = Date.now();
+    await owner.connect(registration("owner", now - 1000, true), "owner-id");
+
+    const invalidReplacement = new IntercomClient();
+    await assert.rejects(invalidReplacement.connect({
+      ...registration("invalid-replacement", now),
+      extensions: [{ namespace: "Invalid Namespace", ownerEligible: true }],
+    }, "owner-id"));
+    assert.equal((await owner.listSessions()).some((session) => session.id === "owner-id"), true);
+    await invalidReplacement.disconnect().catch(() => undefined);
+
+    await peer.connect(registration("peer", now, false), "peer-id");
+    await legacy.connect(registration("legacy", now), "legacy-id");
+    await late.connect(registration("late", 0), "late-id");
+    await peerOnlyA.connect({
+      ...registration("peer-only-a", now + 2),
+      extensions: [{ namespace: "peer-only/v1", ownerEligible: false }],
+    }, "peer-only-a-id");
+    await peerOnlyB.connect({
+      ...registration("peer-only-b", now + 3),
+      extensions: [{ namespace: "peer-only/v1", ownerEligible: false }],
+    }, "peer-only-b-id");
+
+    assert.equal(owner.supportsFeature("extension-bus-v1"), true);
+    assert.equal(legacy.supportsFeature("extension-bus-v1"), true, "new broker advertises support even to clients without capabilities");
+
+    const ownerEvent = await waitFor(ownerMessages, (message) => message.type === "extension_owner");
+    assert.equal(ownerEvent.type, "extension_owner");
+    assert.equal(ownerEvent.ownerId, "owner-id");
+    assert.ok(ownerEvent.ownerEpoch);
+    const peerOwnerEvent = await waitFor(peerMessages, (message) => message.type === "extension_owner");
+    assert.equal(peerOwnerEvent.type, "extension_owner");
+    assert.equal(peerOwnerEvent.ownerId, "owner-id");
+
+    late.updateExtensionCapabilities([{ namespace: "test/v1", ownerEligible: true }]);
+    const lateOwnerEvent = await waitFor(lateMessages, (message) => message.type === "extension_owner");
+    assert.equal(lateOwnerEvent.type, "extension_owner");
+    assert.equal(lateOwnerEvent.ownerId, "owner-id", "backdated client must not seize namespace ownership");
+    late.updateExtensionCapabilities([{ namespace: "test/v1", ownerEligible: false }]);
+
+    legacy.updateExtensionCapabilities([{ namespace: "other/v1", ownerEligible: false }]);
+    legacy.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "capable",
+      payload: { unauthorized: true },
+    });
+    const unauthorizedDeadline = Date.now() + 3000;
+    while (Date.now() < unauthorizedDeadline && legacyErrors.length === 0) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    assert.match(legacyErrors[0]?.message ?? "", /does not have capability for this namespace/);
+    legacy.sendExtensionMessage({
+      type: "extension_state_commit",
+      namespace: "test/v1",
+      ownerEpoch: "unauthorized",
+      expectedRevision: 0,
+      payload: {},
+    });
+    const unauthorizedState = await waitFor(
+      legacyMessages,
+      (message) => message.type === "extension_state_result",
+    );
+    assert.equal(unauthorizedState.type, "extension_state_result");
+    assert.equal(unauthorizedState.committed, false);
+    assert.match(unauthorizedState.reason ?? "", /does not have capability for this namespace/);
+
+    owner.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "capable",
+      payload: "x".repeat(16 * 1024),
+    });
+    const oversizedDeadline = Date.now() + 3000;
+    while (Date.now() < oversizedDeadline && !ownerErrors.some((error) => /16 KiB/.test(error.message))) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    assert.equal(ownerErrors.some((error) => /16 KiB/.test(error.message)), true);
+    ownerErrors.length = 0;
+
+    peerOnlyA.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "peer-only/v1",
+      audience: "capable",
+      payload: { kind: "peer-broadcast" },
+    });
+    const peerBroadcast = await waitFor(peerOnlyBMessages, (message) => message.type === "extension_message");
+    assert.equal(peerBroadcast.type, "extension_message");
+    assert.equal(peerBroadcast.ownerId, undefined);
+    assert.equal(peerBroadcast.ownerEpoch, undefined);
+    assert.deepEqual(peerBroadcast.payload, { kind: "peer-broadcast" });
+
+    peer.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "owner",
+      payload: { kind: "owner-target" },
+    });
+    const ownerTarget = await waitFor(
+      ownerMessages,
+      (message) => message.type === "extension_message"
+        && (message.payload as { kind?: string }).kind === "owner-target",
+    );
+    assert.equal(ownerTarget.type, "extension_message");
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    assert.equal(
+      peerMessages.some((message) => message.type === "extension_message"
+        && (message.payload as { kind?: string }).kind === "owner-target"),
+      false,
+    );
+
+    owner.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "capable",
+      ownerOnly: true,
+      ownerEpoch: ownerEvent.ownerEpoch,
+      payload: { kind: "assignment" },
+    });
+    const received = await waitFor(peerMessages, (message) => message.type === "extension_message");
+    assert.equal(received.type, "extension_message");
+    assert.deepEqual(received.payload, { kind: "assignment" });
+    const lateReceived = await waitFor(lateMessages, (message) => message.type === "extension_message");
+    assert.equal(lateReceived.type, "extension_message");
+    assert.deepEqual(lateReceived.payload, { kind: "assignment" });
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    assert.equal(legacyMessages.some((message) => message.type === "extension_message"), false);
+
+    owner.sendExtensionMessage({
+      type: "extension_state_commit",
+      namespace: "test/v1",
+      ownerEpoch: ownerEvent.ownerEpoch!,
+      expectedRevision: 0,
+      payload: { groups: ["alpha"] },
+    });
+    const committed = await waitFor(ownerMessages, (message) => message.type === "extension_state_result");
+    assert.equal(committed.type, "extension_state_result");
+    assert.equal(committed.committed, true);
+    assert.equal(committed.revision, 1);
+    const state = await waitFor(peerMessages, (message) => message.type === "extension_state");
+    assert.equal(state.type, "extension_state");
+    assert.deepEqual(state.payload, { groups: ["alpha"] });
+
+    owner.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "capable",
+      ownerOnly: true,
+      payload: {},
+    });
+    const missingEpochDeadline = Date.now() + 3000;
+    while (Date.now() < missingEpochDeadline && !ownerErrors.some((error) => /ownerEpoch required/.test(error.message))) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    assert.equal(ownerErrors.some((error) => /ownerEpoch required/.test(error.message)), true);
+    ownerErrors.length = 0;
+
+    owner.sendExtensionMessage({
+      type: "extension_publish",
+      namespace: "test/v1",
+      audience: "capable",
+      ownerOnly: true,
+      ownerEpoch: "stale",
+      payload: {},
+    });
+    await waitFor(
+      ownerMessages,
+      (message) => message.type === "error" && message.error === "Owner validation failed",
+    ).catch(async () => {
+      const deadline = Date.now() + 3000;
+      while (Date.now() < deadline && ownerErrors.length === 0) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      assert.match(ownerErrors[0]?.message ?? "", /Owner validation failed/);
+      return { type: "error", error: ownerErrors[0]!.message } as BrokerMessage;
+    });
+
+    await owner.disconnect();
+    const noOwner = await waitFor(
+      peerMessages,
+      (message) => message.type === "extension_owner" && message.ownerId === undefined,
+    );
+    assert.equal(noOwner.type, "extension_owner");
+
+    const replacement = new IntercomClient();
+    clients.push(replacement);
+    const replacementMessages: BrokerMessage[] = [];
+    replacement.onBrokerMessage((message) => replacementMessages.push(message));
+    replacement.on("error", () => {});
+    await replacement.connect(registration("replacement", now + 1, true), "owner-id");
+    const replacementOwner = await waitFor(replacementMessages, (message) => message.type === "extension_owner");
+    assert.equal(replacementOwner.type, "extension_owner");
+    assert.notEqual(replacementOwner.ownerEpoch, ownerEvent.ownerEpoch);
+    const restored = await waitFor(replacementMessages, (message) => message.type === "extension_state");
+    assert.equal(restored.type, "extension_state");
+    assert.equal(restored.revision, 1);
+  } finally {
+    await Promise.all(clients.map((client) => client.disconnect().catch(() => undefined)));
+    await stopBroker(broker);
+    if (previousAgentDir === undefined) delete process.env.SELESAI_CODING_AGENT_DIR;
+    else process.env.SELESAI_CODING_AGENT_DIR = previousAgentDir;
+    rmSync(agentDir, { recursive: true, force: true });
+  }
+});
+
+test("extension state compare-and-swap rejects stale and invalid revisions", () => {
+  const runtimeDir = mkdtempSync(path.join(tmpdir(), "pi-intercom-state-cas-"));
+  try {
+    const manager = new ExtensionStateManager(runtimeDir);
+    assert.deepEqual(manager.commitState("test/v1", 0, { version: 1 }), { committed: true, revision: 1 });
+    assert.deepEqual(manager.commitState("test/v1", 0, { version: 2 }), {
+      committed: false,
+      revision: 1,
+      reason: "Revision mismatch",
+      payload: { version: 1 },
+    });
+    assert.deepEqual(manager.commitState("test/v1", -1, { version: 2 }), {
+      committed: false,
+      revision: 1,
+      reason: "Invalid expected revision",
+    });
+    assert.deepEqual(manager.commitState("test/v1", 1, { version: 2 }), { committed: true, revision: 2 });
+    assert.deepEqual(manager.commitState("test/v1", 2, "x".repeat(64 * 1024)), {
+      committed: false,
+      revision: 2,
+      reason: "Invalid extension state or payload exceeds 64 KiB limit",
+    });
+    const circular: { self?: unknown } = {};
+    circular.self = circular;
+    assert.deepEqual(manager.commitState("test/v1", 2, circular), {
+      committed: false,
+      revision: 2,
+      reason: "Invalid extension state or payload exceeds 64 KiB limit",
+    });
+  } finally {
+    rmSync(runtimeDir, { recursive: true, force: true });
+  }
+});
+
+test("extension state falls back to a valid backup", () => {
+  const runtimeDir = mkdtempSync(path.join(tmpdir(), "pi-intercom-state-"));
+  try {
+    const manager = new ExtensionStateManager(runtimeDir);
+    assert.equal(manager.commitState("test/v1", 0, { version: 1 }).committed, true);
+    assert.equal(manager.commitState("test/v1", 1, { version: 2 }).committed, true);
+
+    const stateDir = path.join(runtimeDir, "extension-state");
+    const files = readdirSync(stateDir);
+    const primary = files.find((file) => file.endsWith(".json"));
+    assert.ok(primary);
+    writeFileSync(path.join(stateDir, primary!), "corrupt", "utf8");
+
+    const recovered = new ExtensionStateManager(runtimeDir).loadState("test/v1");
+    assert.deepEqual(recovered, { revision: 1, payload: { version: 1 } });
+  } finally {
+    rmSync(runtimeDir, { recursive: true, force: true });
+  }
+});

package/dist/extensions/pi-intercom/broker/framing.test.ts

@@ -0,0 +1,114 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createMessageReader, writeMessage } from "./framing.ts";
+
+function framePayload(payload: Buffer): Buffer {
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(payload.length, 0);
+  return Buffer.concat([header, payload]);
+}
+
+test("createMessageReader handles normal fragmented frames", () => {
+  const messages: unknown[] = [];
+  const errors: Error[] = [];
+  const reader = createMessageReader(
+    (message) => messages.push(message),
+    (error) => errors.push(error),
+    64,
+  );
+  const frameA = framePayload(Buffer.from(JSON.stringify({ type: "one" }), "utf-8"));
+  const frameB = framePayload(Buffer.from(JSON.stringify({ type: "two" }), "utf-8"));
+  const combined = Buffer.concat([frameA, frameB]);
+
+  reader(combined.subarray(0, 2));
+  reader(combined.subarray(2, 7));
+  reader(combined.subarray(7));
+
+  assert.deepEqual(messages, [{ type: "one" }, { type: "two" }]);
+  assert.deepEqual(errors, []);
+});
+
+test("createMessageReader reassembles a fragmented frame after a header-boundary fast-path frame", () => {
+  const messages: unknown[] = [];
+  const errors: Error[] = [];
+  const reader = createMessageReader(
+    (message) => messages.push(message),
+    (error) => errors.push(error),
+    64,
+  );
+  const frameA = framePayload(Buffer.from(JSON.stringify({ a: 1 }), "utf-8"));
+  const frameB = framePayload(Buffer.from(JSON.stringify({ bb: "1234567890" }), "utf-8"));
+
+  reader(frameA.subarray(0, 4)); // chunk ends exactly at the end of frame A's header
+  reader(frameA.subarray(4)); // frame A's payload arrives whole (zero-copy fast path)
+  reader(frameB.subarray(0, 6)); // frame B header + partial payload (buffered path)
+  reader(frameB.subarray(6));
+
+  assert.deepEqual(messages, [{ a: 1 }, { bb: "1234567890" }]);
+  assert.deepEqual(errors, []);
+});
+
+test("createMessageReader rejects an oversized declared frame", () => {
+  const messages: unknown[] = [];
+  const errors: Error[] = [];
+  const reader = createMessageReader(
+    (message) => messages.push(message),
+    (error) => errors.push(error),
+    8,
+  );
+  const oversizedFrame = framePayload(Buffer.from(JSON.stringify({ text: "too large" }), "utf-8"));
+
+  reader(oversizedFrame);
+
+  assert.deepEqual(messages, []);
+  assert.equal(errors.length, 1);
+  assert.match(errors[0].message, /Intercom frame length \d+ exceeds maximum 8 bytes/);
+});
+
+test("createMessageReader rejects an oversized frame before retaining same-chunk payload bytes", () => {
+  const messages: unknown[] = [];
+  const errors: Error[] = [];
+  const reader = createMessageReader(
+    (message) => messages.push(message),
+    (error) => errors.push(error),
+    8,
+  );
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(9, 0);
+
+  reader(Buffer.concat([header, Buffer.alloc(1024 * 1024)]));
+
+  assert.deepEqual(messages, []);
+  assert.equal(errors.length, 1);
+  assert.equal(errors[0].message, "Intercom frame length 9 exceeds maximum 8 bytes");
+});
+
+test("createMessageReader rejects a partial oversized frame before buffering the payload", () => {
+  const messages: unknown[] = [];
+  const errors: Error[] = [];
+  const reader = createMessageReader(
+    (message) => messages.push(message),
+    (error) => errors.push(error),
+    8,
+  );
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(9, 0);
+
+  reader(header);
+
+  assert.deepEqual(messages, []);
+  assert.equal(errors.length, 1);
+  assert.equal(errors[0].message, "Intercom frame length 9 exceeds maximum 8 bytes");
+});
+
+test("writeMessage emits frames accepted by createMessageReader", () => {
+  const chunks: Buffer[] = [];
+  const socket = { write: (chunk: Buffer) => chunks.push(chunk) };
+  const messages: unknown[] = [];
+  const reader = createMessageReader((message) => messages.push(message), assert.fail, 64);
+
+  writeMessage(socket as never, { ok: true });
+  reader(Buffer.concat(chunks));
+
+  assert.deepEqual(messages, [{ ok: true }]);
+});