@vantran-se/openchamber-web 1.23.0 → 1.24.3

package/server/lib/event-stream/global-hub.test.js

@@ -2,6 +2,28 @@ import { describe, expect, it, vi } from 'vitest';
 
 import { createGlobalMessageStreamHub } from './global-hub.js';
 
+it('bounds a contiguous replay suffix by UTF-8 bytes and event count', async () => {
+  const blocks = Array.from({ length: 8 }, (_, i) => `id: e${i}\ndata: ${JSON.stringify({ type: 'message', properties: { text: '界'.repeat(40) } })}\n\n`);
+  const received = [];
+  const hub = createGlobalMessageStreamHub({
+    buildOpenCodeUrl: path => `http://127.0.0.1:4096${path}`,
+    getOpenCodeAuthHeaders: () => ({}), replayLimit: 3, replayByteLimit: 550,
+    upstreamReconnectDelayMs: 60_000,
+    fetchImpl: async () => createSseResponse({ blocks }),
+  });
+  hub.subscribeEvent(event => received.push(event.eventId));
+  try {
+    hub.start();
+    await waitForAssertion(() => expect(received).toHaveLength(8));
+    expect(hub.replayAfter('e0')).toBeNull();
+    expect(hub.replayAfter('e5')).toBeNull();
+    const tail = hub.replayAfter('e6');
+    expect(tail.map(entry => entry.eventId)).toEqual(['e7']);
+    expect(Buffer.byteLength(tail[0].serializedFrame) * 2).toBeLessThanOrEqual(550);
+    expect(Buffer.byteLength(tail[0].serializedFrame) * 3).toBeGreaterThan(550);
+  } finally { hub.stop(); }
+});
+
 function createSseResponse({ blocks = [] } = {}) {
   const encoder = new TextEncoder();
   let index = 0;
@@ -40,6 +62,166 @@ async function waitForAssertion(assertion) {
   throw lastError;
 }
 
+const deltaBlock = (id, text, partID = 'prt_a') => `id: ${id}\ndata: ${JSON.stringify({
+  id, type: 'message.part.delta',
+  properties: { sessionID: 'ses_1', messageID: 'msg_1', partID, field: 'text', delta: text },
+})}\n\n`;
+
+const createDeltaHub = ({ blocks, deltaCoalesceWindowMs }) => createGlobalMessageStreamHub({
+  buildOpenCodeUrl: (pathname) => `http://127.0.0.1:4096${pathname}`,
+  getOpenCodeAuthHeaders: () => ({}),
+  upstreamReconnectDelayMs: 60_000,
+  deltaCoalesceWindowMs,
+  fetchImpl: async () => createSseResponse({ blocks }),
+});
+
+// What a browser holds after applying frames in order: text per part, and the
+// text each part had when a snapshot barrier passed.
+const applyFrames = (frames) => {
+  const text = {};
+  const barriers = [];
+  for (const frame of frames) {
+    const payload = frame.payload;
+    if (payload.type === 'message.part.delta') {
+      text[payload.properties.partID] = (text[payload.properties.partID] ?? '') + payload.properties.delta;
+    } else {
+      barriers.push({ id: payload.id, seen: { ...text } });
+    }
+  }
+  return { text, barriers };
+};
+
+describe('delta coalescing in the global hub', () => {
+  it('delivers the same text in far fewer frames', async () => {
+    const words = Array.from({ length: 120 }, (_, index) => `w${index} `);
+    const hub = createDeltaHub({ blocks: words.map((word, index) => deltaBlock(`e${String(index).padStart(4, '0')}`, word)) });
+    const received = [];
+    hub.subscribeEvent((event) => received.push(event));
+    try {
+      hub.start();
+      await waitForAssertion(() => expect(applyFrames(received).text.prt_a).toBe(words.join('')));
+      expect(received.length).toBeLessThanOrEqual(3);
+      expect(received.at(-1).eventId).toBe('e0119');
+    } finally { hub.stop(); }
+  });
+
+  it('resumes from any cursor without losing or repeating text', async () => {
+    const blocks = [];
+    let id = 0;
+    const nextId = () => `e${String(id++).padStart(4, '0')}`;
+    for (let index = 0; index < 40; index += 1) blocks.push(deltaBlock(nextId(), `a${index}.`, index % 3 === 0 ? 'prt_b' : 'prt_a'));
+    const snapshotId = nextId();
+    blocks.push(`id: ${snapshotId}\ndata: ${JSON.stringify({ id: snapshotId, type: 'message.part.updated', properties: { part: { id: 'prt_a', messageID: 'msg_1' } } })}\n\n`);
+    for (let index = 0; index < 40; index += 1) blocks.push(deltaBlock(nextId(), `b${index}.`));
+
+    const hub = createDeltaHub({ blocks });
+    const received = [];
+    hub.subscribeEvent((event) => received.push(event));
+    try {
+      hub.start();
+      const expectedA = [...Array(40).keys()].filter((index) => index % 3 !== 0).map((index) => `a${index}.`).join('')
+        + [...Array(40).keys()].map((index) => `b${index}.`).join('');
+      await waitForAssertion(() => expect(applyFrames(received).text.prt_a).toBe(expectedA));
+      expect(received.length).toBeLessThan(blocks.length / 4);
+
+      const complete = applyFrames(received);
+      // The snapshot barrier saw exactly the text that arrived before it.
+      expect(complete.barriers).toHaveLength(1);
+      expect(complete.barriers[0].seen.prt_a).toBe([...Array(40).keys()].filter((index) => index % 3 !== 0).map((index) => `a${index}.`).join(''));
+
+      // A socket that drops after any frame reconnects with that frame's id.
+      for (let cut = 0; cut < received.length; cut += 1) {
+        const tail = hub.replayAfter(received[cut].eventId);
+        expect(tail).not.toBeNull();
+        const replayed = tail.map((entry) => JSON.parse(entry.serializedFrame));
+        expect(applyFrames([...received.slice(0, cut + 1), ...replayed])).toEqual(complete);
+      }
+    } finally { hub.stop(); }
+  });
+
+  // OpenCode 1.18 sends no SSE ids at all. Before the hub numbered such events
+  // itself the replay buffer stayed empty and every reconnect lost its gap.
+  it('numbers id-less upstream events so a reconnect resumes from any cursor', async () => {
+    const idless = (type, properties) => `data: ${JSON.stringify({ type, properties })}\n\n`;
+    const blocks = [];
+    for (let index = 0; index < 30; index += 1) {
+      blocks.push(idless('message.part.delta', { sessionID: 'ses_1', messageID: 'msg_1', partID: 'prt_a', field: 'text', delta: `a${index}.` }));
+    }
+    blocks.push(idless('message.part.updated', { part: { id: 'prt_a', messageID: 'msg_1' } }));
+    for (let index = 0; index < 30; index += 1) {
+      blocks.push(idless('message.part.delta', { sessionID: 'ses_1', messageID: 'msg_1', partID: 'prt_a', field: 'text', delta: `b${index}.` }));
+    }
+
+    const hub = createDeltaHub({ blocks });
+    const received = [];
+    hub.subscribeEvent((event) => received.push(event));
+    try {
+      hub.start();
+      const expected = [...Array(30).keys()].map((index) => `a${index}.`).join('') + [...Array(30).keys()].map((index) => `b${index}.`).join('');
+      await waitForAssertion(() => expect(applyFrames(received).text.prt_a).toBe(expected));
+
+      const ids = received.map((event) => event.eventId);
+      expect(ids.every((eventId) => typeof eventId === 'string' && eventId.length > 0)).toBe(true);
+      expect(new Set(ids).size).toBe(ids.length);
+      expect(ids).toEqual([...ids].sort());
+
+      const complete = applyFrames(received);
+      for (let cut = 0; cut < received.length; cut += 1) {
+        const tail = hub.replayAfter(received[cut].eventId);
+        expect(tail).not.toBeNull();
+        const replayed = tail.map((entry) => JSON.parse(entry.serializedFrame));
+        expect(replayed.every((frame) => typeof frame.eventId === 'string')).toBe(true);
+        expect(applyFrames([...received.slice(0, cut + 1), ...replayed])).toEqual(complete);
+      }
+
+      // A cursor minted by another server process must miss, never match by
+      // sequence number: the bridge then reports replayReset and the client
+      // repairs from HTTP instead of trusting a wrong tail.
+      const foreign = ids[0].replace(/^oc-[^-]+-/, 'oc-00000000-');
+      expect(foreign).not.toBe(ids[0]);
+      expect(hub.replayAfter(foreign)).toBeNull();
+    } finally { hub.stop(); }
+  });
+
+  it('keeps pending text for replay when the hub stops', async () => {
+    const hub = createDeltaHub({
+      deltaCoalesceWindowMs: 60_000,
+      blocks: ['one ', 'two ', 'three'].map((text, index) => deltaBlock(`e${index}`, text)),
+    });
+    const received = [];
+    hub.subscribeEvent((event) => received.push(event));
+    hub.start();
+    // The window is a minute, so only the leading delta has been delivered.
+    await waitForAssertion(() => expect(received).toHaveLength(1));
+    await new Promise((resolve) => setTimeout(resolve, 20));
+
+    hub.stop();
+
+    const tail = hub.replayAfter('e0').map((entry) => JSON.parse(entry.serializedFrame));
+    expect(applyFrames(tail).text.prt_a).toBe('two three');
+    expect(tail.at(-1).eventId).toBe('e2');
+  });
+
+  it('commits pending text on demand, so a client readied later starts after it', async () => {
+    const hub = createDeltaHub({
+      deltaCoalesceWindowMs: 60_000,
+      blocks: ['one ', 'two ', 'three'].map((text, index) => deltaBlock(`e${index}`, text)),
+    });
+    const received = [];
+    hub.subscribeEvent((event) => received.push(event));
+    try {
+      hub.start();
+      await waitForAssertion(() => expect(received).toHaveLength(1));
+      await new Promise((resolve) => setTimeout(resolve, 20));
+
+      hub.flushPending();
+
+      expect(applyFrames(received).text.prt_a).toBe('one two three');
+      expect(hub.replayAfter('e2')).toEqual([]);
+    } finally { hub.stop(); }
+  });
+});
+
 describe('createGlobalMessageStreamHub', () => {
   it('continues fanout when an event subscriber throws', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});

package/server/lib/event-stream/global-ws-bridge.js

@@ -1,4 +1,4 @@
-import { sendMessageStreamWsEvent, sendMessageStreamWsFrame } from './protocol.js';
+import { sendMessageStreamWsEvent, sendMessageStreamWsFrame, sendSerializedMessageStreamWsFrame, serializeMessageStreamWsEvent } from './protocol.js';
 
 function shouldTriggerUpstreamHealthCheck(upstream) {
   if (!upstream) {
@@ -31,12 +31,9 @@ export function createGlobalMessageStreamWsBridge({
     wsClients.delete(socket);
   };
 
-  const replayEvents = (socket, requestedLastEventId) => {
-    for (const entry of globalHub.replayAfter(requestedLastEventId)) {
-      const sent = sendMessageStreamWsEvent(socket, entry.payload, {
-        directory: entry.directory,
-        eventId: entry.eventId,
-      });
+  const replayEvents = (socket, entries) => {
+    for (const entry of entries) {
+      const sent = sendSerializedMessageStreamWsFrame(socket, entry.serializedFrame);
       if (!sent) {
         removeClient(socket);
         return;
@@ -49,10 +46,11 @@ export function createGlobalMessageStreamWsBridge({
       return;
     }
 
-    const sent = sendMessageStreamWsFrame(socket, {
-      type: 'ready',
-      scope: 'global',
-    });
+    globalHub.flushPending();
+    const replay = globalHub.replayAfter(requestedLastEventId);
+    const ready = { type: 'ready', scope: 'global' };
+    if (replay === null) ready.replayReset = true;
+    const sent = sendMessageStreamWsFrame(socket, ready);
     if (!sent) {
       removeClient(socket);
       return;
@@ -60,7 +58,7 @@ export function createGlobalMessageStreamWsBridge({
 
     readyClients.add(socket);
     wsClients.add(socket);
-    replayEvents(socket, requestedLastEventId);
+    if (replay !== null) replayEvents(socket, replay);
   };
 
   const stopHubIfUnused = () => {
@@ -88,26 +86,26 @@ export function createGlobalMessageStreamWsBridge({
     }
   };
 
-  const unsubscribeEvent = globalHub.subscribeEvent(({ payload, directory, eventId }) => {
+  const unsubscribeEvent = globalHub.subscribeEvent((event) => {
+    const { payload } = event;
     for (const socket of Array.from(clients)) {
       if (!readyClients.has(socket)) {
         continue;
       }
-      const sent = sendMessageStreamWsEvent(socket, payload, {
-        directory,
-        eventId,
-      });
+      const sent = sendSerializedMessageStreamWsFrame(socket, event.serialize());
       if (!sent) {
         removeClient(socket);
       }
     }
 
     processForwardedEventPayload(payload, (syntheticPayload) => {
+      if (readyClients.size === 0) return;
+      const serializedFrame = serializeMessageStreamWsEvent(syntheticPayload, { directory: 'global' });
       for (const socket of Array.from(clients)) {
         if (!readyClients.has(socket)) {
           continue;
         }
-        const sent = sendMessageStreamWsEvent(socket, syntheticPayload, { directory: 'global' });
+        const sent = sendSerializedMessageStreamWsFrame(socket, serializedFrame);
         if (!sent) {
           removeClient(socket);
         }

package/server/lib/event-stream/index.js

@@ -7,6 +7,10 @@ export {
   createGlobalMessageStreamHub,
 } from './global-hub.js';
 
+export {
+  resolveDeltaCoalesceWindowMs,
+} from './delta-coalescer.js';
+
 export {
   DEFAULT_UPSTREAM_STALL_TIMEOUT_MS,
   UPSTREAM_STALL_TIMEOUT_CONCURRENT_MS,

package/server/lib/event-stream/protocol.js

@@ -71,6 +71,14 @@ export function parseSseEventEnvelope(block) {
 }
 
 export function sendMessageStreamWsFrame(socket, payload) {
+  try {
+    return sendSerializedMessageStreamWsFrame(socket, JSON.stringify(payload));
+  } catch {
+    return false;
+  }
+}
+
+export function sendSerializedMessageStreamWsFrame(socket, serializedFrame) {
   if (!socket || socket.readyState !== 1) {
     return false;
   }
@@ -86,7 +94,7 @@ export function sendMessageStreamWsFrame(socket, payload) {
   }
 
   try {
-    socket.send(JSON.stringify(payload));
+    socket.send(serializedFrame);
     const bufferedAfter = typeof socket.bufferedAmount === 'number' ? socket.bufferedAmount : 0;
     if (bufferedAfter > MESSAGE_STREAM_WS_MAX_BUFFERED_BYTES) {
       try {
@@ -124,10 +132,16 @@ export function sendMessageStreamWsFrame(socket, payload) {
 }
 
 export function sendMessageStreamWsEvent(socket, payload, options = {}) {
-  return sendMessageStreamWsFrame(socket, {
-    type: 'event',
-    payload,
-    ...(typeof options.eventId === 'string' && options.eventId.length > 0 ? { eventId: options.eventId } : {}),
-    ...(typeof options.directory === 'string' && options.directory.length > 0 ? { directory: options.directory } : {}),
-  });
+  try {
+    return sendSerializedMessageStreamWsFrame(socket, serializeMessageStreamWsEvent(payload, options));
+  } catch {
+    return false;
+  }
+}
+
+export function serializeMessageStreamWsEvent(payload, options = {}) {
+  const frame = { type: 'event', payload };
+  if (typeof options.eventId === 'string' && options.eventId.length > 0) frame.eventId = options.eventId;
+  if (typeof options.directory === 'string' && options.directory.length > 0) frame.directory = options.directory;
+  return JSON.stringify(frame);
 }

package/server/lib/event-stream/runtime.js

@@ -5,7 +5,8 @@ import {
   MESSAGE_STREAM_DIRECTORY_WS_PATH,
   MESSAGE_STREAM_GLOBAL_WS_PATH,
   MESSAGE_STREAM_WS_HEARTBEAT_INTERVAL_MS,
-  sendMessageStreamWsEvent,
+  serializeMessageStreamWsEvent,
+  sendSerializedMessageStreamWsFrame,
 } from './protocol.js';
 import { createGlobalMessageStreamHub } from './global-hub.js';
 import { createGlobalMessageStreamWsBridge } from './global-ws-bridge.js';
@@ -28,20 +29,22 @@ export function createGlobalUiEventBroadcaster({
     }
 
     if (hasSseClients) {
+      const serializedPayload = JSON.stringify(payload);
       for (const res of sseClients) {
         try {
-          writeSseEvent(res, payload);
+          writeSseEvent(res, payload, serializedPayload);
         } catch {
         }
       }
     }
 
     if (hasWsClients) {
+      const serializedFrame = serializeMessageStreamWsEvent(payload, {
+        directory: typeof options.directory === 'string' && options.directory.length > 0 ? options.directory : 'global',
+        eventId: typeof options.eventId === 'string' && options.eventId.length > 0 ? options.eventId : undefined,
+      });
       for (const socket of Array.from(wsClients)) {
-        const sent = sendMessageStreamWsEvent(socket, payload, {
-          directory: typeof options.directory === 'string' && options.directory.length > 0 ? options.directory : 'global',
-          eventId: typeof options.eventId === 'string' && options.eventId.length > 0 ? options.eventId : undefined,
-        });
+        const sent = sendSerializedMessageStreamWsFrame(socket, serializedFrame);
         if (!sent) {
           wsClients.delete(socket);
         }

package/server/lib/event-stream/runtime.test.js

@@ -2,6 +2,66 @@ import { EventEmitter } from 'node:events';
 import { describe, expect, it } from 'vitest';
 
 import { createGlobalUiEventBroadcaster, createMessageStreamWsRuntime } from './runtime.js';
+import { createGlobalMessageStreamHub } from './global-hub.js';
+import { createNotificationEmitterRuntime } from '../notifications/emitter-runtime.js';
+
+it('serializes a UI broadcast once per wire format and isolates failed clients', () => {
+  let serializations = 0;
+  const payload = { toJSON() { serializations++; return { type: 'openchamber:test', properties: { value: 'same' } }; } };
+  const writes = [];
+  const sseClients = new Set(Array.from({ length: 4 }, () => ({ write: text => writes.push(text) })));
+  const sockets = Array.from({ length: 4 }, () => ({ readyState: 1, bufferedAmount: 0, send: text => writes.push(text) }));
+  const failed = { readyState: 1, bufferedAmount: 0, send() { throw new Error('closed'); } };
+  const wsClients = new Set([...sockets, failed]);
+  const { writeSseEvent } = createNotificationEmitterRuntime({});
+  const broadcast = createGlobalUiEventBroadcaster({ sseClients, wsClients, writeSseEvent });
+  broadcast(payload);
+  expect(serializations).toBe(2);
+  expect(writes).toHaveLength(8);
+  expect(wsClients.has(failed)).toBe(false);
+  expect(wsClients.size).toBe(4);
+  expect(writes[0]).toBe(writes[3]);
+  expect(writes[4]).toBe(writes[7]);
+  sseClients.clear(); wsClients.clear();
+  broadcast(payload);
+  expect(serializations).toBe(2);
+});
+
+it('delivers oversized events live, but reports a replay gap instead of replaying across it', async () => {
+  const hub = createGlobalMessageStreamHub({
+    buildOpenCodeUrl: path => `http://127.0.0.1:4096${path}`,
+    getOpenCodeAuthHeaders: () => ({}),
+    replayByteLimit: 512,
+    fetchImpl: async (_url, options) => createSseResponse({
+      signal: options.signal, holdOpen: true,
+      blocks: [
+        'id: first\ndata: {"type":"first","properties":{}}\n\n',
+        `id: large\ndata: ${JSON.stringify({ type: 'large', properties: { text: '界'.repeat(1024) } })}\n\n`,
+        'id: last\ndata: {"type":"last","properties":{}}\n\n',
+      ],
+    }),
+  });
+  const runtime = createMessageStreamWsRuntime({
+    server: new EventEmitter(), globalEventHub: hub, wsClients: new Set(),
+    uiAuthController: null, isRequestOriginAllowed: async () => true,
+    rejectWebSocketUpgrade() {}, buildOpenCodeUrl: path => `http://127.0.0.1:4096${path}`,
+    getOpenCodeAuthHeaders: () => ({}), processForwardedEventPayload() {},
+  });
+  const first = new FakeSocket();
+  const reconnect = new FakeSocket();
+  try {
+    runtime.wsServer.emit('connection', first, { url: '/api/global/event/ws' });
+    await expect.poll(() => first.sent.filter(frame => frame.type === 'event').length).toBe(3);
+    expect(first.sent.find(frame => frame.eventId === 'large').payload.properties.text).toHaveLength(1024);
+    expect(hub.replayAfter('first')).toBeNull();
+    expect(hub.replayAfter('last')).toEqual([]);
+    runtime.wsServer.emit('connection', reconnect, { url: '/api/global/event/ws?lastEventId=first' });
+    await expect.poll(() => reconnect.sent.length).toBeGreaterThan(0);
+    expect(reconnect.sent).toEqual([{ type: 'ready', scope: 'global', replayReset: true }]);
+  } finally {
+    first.close(); reconnect.close(); hub.stop(); await runtime.close();
+  }
+});
 
 class FakeSocket extends EventEmitter {
   constructor() {

package/server/lib/fs/DOCUMENTATION.md

@@ -36,6 +36,14 @@ Own filesystem API behavior for the web server runtime, including workspace-boun
   - Returns `{ searchFilesystemFiles(rootPath, options) }`.
   - Supports fuzzy matching, hidden-file handling, and optional `git check-ignore` filtering.
 
+Both search and directory listing discard `git check-ignore` stderr at spawn.
+They consume stdout for ignore matches. Never create an unread stderr pipe:
+Git diagnostics can fill it and block the child indefinitely, so repeated
+searches accumulate live Git processes. `git-process.test.js` exercises both
+paths with real OS pipes, twelve concurrent checks, and 2 MiB of diagnostics
+per child. Successful completion must preserve ignore filtering and reap all
+twelve children.
+
 ## Composition contract with `index.js`
 - `index.js` provides composition-time dependencies only (platform primitives + callbacks such as `resolveProjectDirectory`, `normalizeDirectoryPath`, and `buildAugmentedPath`).
 - `index.js` no longer owns FS route handlers or FS exec job state.
@@ -43,7 +51,8 @@ Own filesystem API behavior for the web server runtime, including workspace-boun
 ## Notes for contributors
 - Keep filesystem policy (workspace root checks, error mapping, exec timeout behavior) inside this module, not in the composition root.
 - Workspace checks accept, besides the active workspace and its worktrees, the **managed roots**: the OpenChamber config root and the managed chats root (`managedChatsRoot` dependency; `OPENCHAMBER_CHATS_DIR` upstream, default `<config root>/chats`). Chat worktrees may legitimately live outside every project workspace.
-- `GET /api/fs/home` answers `{ home, chatsRoot }`. `chatsRoot` is the server-resolved managed chats root; clients must use it instead of joining `home` + the well-known segment (a relocated root does not contain that segment).
+- `GET /api/fs/home` preserves `{ home, chatsRoot }` and adds `canonicalChatsRoot` and `canonicalLegacyChatsRoot`, resolved by the server's filesystem. If a root does not exist yet, it resolves the nearest existing ancestor and appends the missing segments, without creating directories. Errors resolving the configured root fail the request. A failed legacy lookup warns and omits only that optional alias, retaining exact legacy matching without blocking an accessible relocated root. Clients use confirmed aliases for exact membership while keeping the original roots as folder/scope identities. `chatsRoot` is the server-resolved managed chats root; clients must use it instead of joining `home` + the well-known segment (a relocated root does not contain that segment).
+- Workspace authorization accepts both the configured managed paths and their filesystem-confirmed canonical roots. Canonical lookup runs only when lexical workspace/managed-root checks fail. One failed managed-root lookup cannot reject an independently authorized root or worktree. Path comparisons remain case-sensitive on POSIX: distinct Linux directories named `chats` and `Chats` never become aliases through string folding. Shared UI keeps exact root membership for classification and directory cleanup.
 - Filesystem `EPERM`/`EACCES` failures use the stable `reason: "os-permission"` response marker. Policy denials such as workspace-boundary or missing-grant failures must not use that marker because a native folder picker cannot remediate them.
 - `GET /api/fs/directory-stat?path=...` uses one `stat` without listing contents or resolving project topology. It follows the same authenticated directory-discovery path policy as `/api/fs/list`, including targets outside the active workspace. A directory returns `{ isDirectory: true }`; `ENOENT` returns `not-found`, and a file or `ENOTDIR` returns `not-directory`. Permission and other failures remain distinct from a missing path. VS Code explicitly returns 501, so the shared client treats its probe as unknown.
 - Read-only routes authorize the requested path against the workspace before resolving symlinks. A symlink reached through the workspace may therefore target a file outside it, while a directly requested outside path still requires an exact-path grant. Write routes keep canonical-target boundary checks.

package/server/lib/fs/git-process.test.js

@@ -0,0 +1,77 @@
+import { spawn } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { createFsSearchRuntime } from './search.js';
+import { registerFsRoutes } from './routes.js';
+
+// Use real OS pipes. A mocked data event cannot reproduce a full stderr pipe.
+const noisyGit = `
+  const fs = require('node:fs');
+  const chunk = Buffer.alloc(65536, 'x');
+  for (let i = 0; i < 32; i++) fs.writeSync(2, chunk);
+  fs.writeSync(1, 'ignored.txt\\n');
+`;
+
+describe('filesystem Git process ownership', () => {
+  for (const operation of ['search', 'list']) {
+    it(`${operation} completes repeated checks with more diagnostics than an OS pipe can hold`, async () => {
+      const root = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-git-pipes-'));
+      const children = [];
+      const exits = [];
+      const launch = (binary, args, options) => {
+        expect(binary).toBe('git');
+        expect(args).toContain('check-ignore');
+        expect(args).toContain('ignored.txt');
+        const child = spawn(process.execPath, ['-e', noisyGit], options);
+        children.push(child);
+        exits.push(new Promise((resolve) => child.once('close', (code) => resolve(code))));
+        return child;
+      };
+      let deadline;
+      try {
+        await fs.writeFile(path.join(root, 'ignored.txt'), 'ignored');
+        await fs.writeFile(path.join(root, 'visible.txt'), 'visible');
+        const dependencies = { fsPromises: fs, path, spawn: launch, resolveGitBinaryForSpawn: () => 'git' };
+        const search = createFsSearchRuntime(dependencies);
+        const routes = new Map();
+        registerFsRoutes({
+          get(route, handler) { routes.set(route, handler); }, post() {}, put() {}, delete() {},
+        }, {
+          ...dependencies, os, crypto, normalizeDirectoryPath: (value) => value,
+          resolveProjectDirectory: async () => ({ directory: root }),
+          buildAugmentedPath: () => process.env.PATH,
+          openchamberUserConfigRoot: root,
+          gitCheckIgnoreTimeoutMs: 10_000,
+        });
+        const work = Array.from({ length: 12 }, async () => {
+          if (operation === 'search') {
+            const files = await search.searchFilesystemFiles(root, { query: '', limit: 10, respectGitignore: true });
+            expect(files.map((file) => file.name)).toEqual(['visible.txt']);
+          } else {
+            const response = { status() { return this; }, json(value) { this.body = value; } };
+            await routes.get('/api/fs/list')({ query: { path: root, respectGitignore: 'true' } }, response);
+            expect(response.body.entries.map((entry) => entry.name)).toEqual(['visible.txt']);
+          }
+        });
+        await Promise.race([
+          Promise.all(work),
+          new Promise((_, reject) => { deadline = setTimeout(() => reject(new Error('Git blocked on unread diagnostics')), 5000); }),
+        ]);
+        expect(children).toHaveLength(12);
+        expect(await Promise.all(exits)).toEqual(Array(12).fill(0));
+        for (const child of children) expect(child.exitCode).toBe(0);
+      } finally {
+        clearTimeout(deadline);
+        for (const child of children) {
+          child.stderr?.resume();
+          if (child.exitCode === null && child.signalCode === null) child.kill('SIGKILL');
+        }
+        await Promise.all(exits);
+        await fs.rm(root, { recursive: true, force: true });
+      }
+    }, 15_000);
+  }
+});