@vantran-se/openchamber-web 1.23.0 → 1.24.3

package/server/lib/opencode/settings-runtime.js

@@ -1,4 +1,4 @@
-import { createProjectIdFromPath } from '../projects/project-id.js';
+import { createProjectIdFromPath, projectConfigFileStemOf } from '../projects/project-id.js';
 import {
   buildPreferencesFields,
   flattenPreferences,
@@ -288,10 +288,10 @@ export const createSettingsRuntime = (deps) => {
       return;
     }
 
-    const oldConfigPath = path.join(PROJECTS_ROOT_DIR, `${oldId}.json`);
-    const newConfigPath = path.join(PROJECTS_ROOT_DIR, `${newId}.json`);
-    const oldStorageDir = path.join(PROJECTS_ROOT_DIR, oldId);
-    const newStorageDir = path.join(PROJECTS_ROOT_DIR, newId);
+    const oldConfigPath = path.join(PROJECTS_ROOT_DIR, `${projectConfigFileStemOf(oldId)}.json`);
+    const newConfigPath = path.join(PROJECTS_ROOT_DIR, `${projectConfigFileStemOf(newId)}.json`);
+    const oldStorageDir = path.join(PROJECTS_ROOT_DIR, projectConfigFileStemOf(oldId));
+    const newStorageDir = path.join(PROJECTS_ROOT_DIR, projectConfigFileStemOf(newId));
 
     const [oldConfig, newConfig] = await Promise.all([
       readJsonFile(oldConfigPath),
@@ -308,6 +308,28 @@ export const createSettingsRuntime = (deps) => {
     await fsPromises.rm(oldConfigPath, { force: true });
   };
 
+  /**
+   * A build before the bounded folder name created `<projectId>/` for an id
+   * the filesystem still accepted (201 to 255 characters; longer ids never
+   * got a folder). Only the bounded folder is read now, so that folder's
+   * notes, plans, and memory are moved over once. A raw name the filesystem
+   * cannot hold (ENAMETOOLONG) means no such folder ever existed.
+   */
+  const migrateRawIdStorageFolder = async (projectId) => {
+    const stem = projectConfigFileStemOf(projectId);
+    if (stem === projectId) return;
+    const rawStorageDir = path.join(PROJECTS_ROOT_DIR, projectId);
+    try {
+      await fsPromises.stat(rawStorageDir);
+    } catch (error) {
+      if (error?.code === 'ENOENT' || error?.code === 'ENAMETOOLONG') return;
+      throw error;
+    }
+    const boundedStorageDir = path.join(PROJECTS_ROOT_DIR, stem);
+    await mergeProjectContextFiles(rawStorageDir, boundedStorageDir);
+    await moveDirectoryContents(rawStorageDir, boundedStorageDir);
+  };
+
   const migrateSettingsToDeterministicProjectIds = async (current) => {
     const settings = current && typeof current === 'object' ? current : {};
     const projects = sanitizeProjects(settings.projects) || [];
@@ -328,6 +350,7 @@ export const createSettingsRuntime = (deps) => {
         await migrateProjectScopedStorage({ oldId: project.id, newId: nextId, projectPath: project.path });
         await migrateProjectIconFiles({ oldId: project.id, newId: nextId });
       }
+      await migrateRawIdStorageFolder(nextId);
       nextProjects.push({ ...project, id: nextId });
     }
 
@@ -468,19 +491,23 @@ export const createSettingsRuntime = (deps) => {
     for (const [projectId, orphansForProject] of matches.entries()) {
       const project = canonicalProjects.find((p) => p.id === projectId);
       if (!project) continue;
-      const targetPath = path.join(PROJECTS_ROOT_DIR, `${project.id}.json`);
+      const targetStem = projectConfigFileStemOf(project.id);
+      const targetPath = path.join(PROJECTS_ROOT_DIR, `${targetStem}.json`);
+      const targetStorageDir = path.join(PROJECTS_ROOT_DIR, targetStem);
 
       for (const orphan of orphansForProject) {
         const targetExisting = (await readJsonFile(targetPath)) || {};
+        // An orphan is named by the file found on disk, so its folder is the raw name.
+        const orphanStorageDir = path.join(PROJECTS_ROOT_DIR, orphan.orphanId);
         const merged = mergeProjectConfigData({
           oldConfig: orphan.content,
           newConfig: targetExisting,
-          oldStorageDir: path.join(PROJECTS_ROOT_DIR, orphan.orphanId),
-          newStorageDir: path.join(PROJECTS_ROOT_DIR, project.id),
+          oldStorageDir: orphanStorageDir,
+          newStorageDir: targetStorageDir,
           projectPath: project.path,
         });
         await writeJsonFile(targetPath, merged);
-        await moveDirectoryContents(path.join(PROJECTS_ROOT_DIR, orphan.orphanId), path.join(PROJECTS_ROOT_DIR, project.id));
+        await moveDirectoryContents(orphanStorageDir, targetStorageDir);
         await fsPromises.rm(orphan.filePath, { force: true });
         orphansConsumed.add(orphan.orphanId);
         console.log(`[projects] Recovered orphan ${orphan.orphanId} -> ${project.id} (${project.path})`);

package/server/lib/opencode/settings-runtime.test.js

@@ -1,9 +1,9 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import crypto from 'crypto';
 import fsPromises from 'fs/promises';
 import os from 'os';
 import path from 'path';
-import { createProjectIdFromPath } from '../projects/project-id.js';
+import { createProjectIdFromPath, projectConfigFileStemOf } from '../projects/project-id.js';
 import { createSettingsRuntime } from './settings-runtime.js';
 
 const createRuntime = async ({ mergePersistedSettings = (_current, changes) => changes } = {}) => {
@@ -39,6 +39,20 @@ const createRuntime = async ({ mergePersistedSettings = (_current, changes) => c
 };
 
 describe('settings runtime', () => {
+  it('round-trips both archived-only retention states through instance settings', async () => {
+    const { runtime, settingsFilePath, cleanup } = await createRuntime();
+    try {
+      for (const sessionRetentionOnlyArchived of [true, false]) {
+        const settings = { sessionRetentionOnlyArchived, sessionRetentionAction: 'delete', autoDeleteAfterDays: 30 };
+        await runtime.persistSettings(settings);
+        expect(await runtime.readSettingsFromDisk()).toEqual(settings);
+        expect(JSON.parse(await fsPromises.readFile(settingsFilePath, 'utf8'))).toEqual(settings);
+      }
+    } finally {
+      await cleanup();
+    }
+  });
+
   it('uses OpenChamber themes when a new install has no theme preferences', async () => {
     const { runtime, cleanup } = await createRuntime();
     try {
@@ -145,6 +159,52 @@ describe('settings runtime', () => {
     }
   });
 
+  it('migrates a legacy id into the bounded file of a project whose path is too long for a file name', async () => {
+    const { runtime, settingsFilePath, tempRoot, cleanup } = await createRuntime();
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      const projectPath = path.join(tempRoot, 'a'.repeat(160));
+      const oldProjectId = 'legacy-project-id';
+      const newProjectId = createProjectIdFromPath(projectPath);
+      expect(newProjectId.length).toBeGreaterThan(200);
+      const projectsRoot = path.join(path.dirname(settingsFilePath), 'projects');
+      const boundedPath = path.join(projectsRoot, `${projectConfigFileStemOf(newProjectId)}.json`);
+      expect(path.basename(boundedPath).startsWith('path_sha256_')).toBe(true);
+
+      await fsPromises.mkdir(projectPath, { recursive: true });
+      await fsPromises.mkdir(projectsRoot, { recursive: true });
+      await fsPromises.writeFile(
+        settingsFilePath,
+        JSON.stringify({
+          projects: [{ id: oldProjectId, path: projectPath, addedAt: 1, lastOpenedAt: 1 }],
+          activeProjectId: oldProjectId,
+        }, null, 2),
+        'utf8',
+      );
+      await fsPromises.writeFile(
+        path.join(projectsRoot, `${oldProjectId}.json`),
+        JSON.stringify({ 'setup-worktree': ['bun install'] }, null, 2),
+        'utf8',
+      );
+
+      const settings = await runtime.readSettingsFromDiskMigrated();
+
+      expect(settings.projects[0].id).toBe(newProjectId);
+      const migratedConfig = JSON.parse(await fsPromises.readFile(boundedPath, 'utf8'));
+      expect(migratedConfig['setup-worktree']).toEqual(['bun install']);
+      await expect(fsPromises.readFile(path.join(projectsRoot, `${oldProjectId}.json`), 'utf8')).rejects.toMatchObject({ code: 'ENOENT' });
+
+      // A second pass sees the bounded file beside the settings; it is the
+      // project's own file, not a stray from the random-id era.
+      await runtime.readSettingsFromDiskMigrated();
+      expect(JSON.parse(await fsPromises.readFile(boundedPath, 'utf8'))['setup-worktree']).toEqual(['bun install']);
+      expect(warn.mock.calls.some((call) => String(call[0]).includes('orphan'))).toBe(false);
+    } finally {
+      warn.mockRestore();
+      await cleanup();
+    }
+  });
+
   it.skipIf(process.platform !== 'win32')('falls back when Windows blocks atomic settings replacement', async () => {
     const tempRoot = await fsPromises.mkdtemp(path.join(os.tmpdir(), 'oc-settings-runtime-'));
     const settingsFilePath = path.join(tempRoot, 'settings.json');
@@ -184,6 +244,102 @@ describe('settings runtime', () => {
     }
   });
 
+  it('moves project storage into the bounded folder when the canonical id is too long for a folder name', async () => {
+    const { runtime, settingsFilePath, tempRoot, cleanup } = await createRuntime();
+    try {
+      const projectPath = path.join(tempRoot, `${'segment-'.repeat(18)}`, 'demo-repo');
+      const oldProjectId = 'legacy-project-id';
+      const newProjectId = createProjectIdFromPath(projectPath);
+      const stem = projectConfigFileStemOf(newProjectId);
+      expect(newProjectId.length).toBeGreaterThan(240);
+      expect(stem).not.toBe(newProjectId);
+      const projectsRoot = path.join(path.dirname(settingsFilePath), 'projects');
+      const oldStorageDir = path.join(projectsRoot, oldProjectId);
+      const newStorageDir = path.join(projectsRoot, stem);
+
+      await fsPromises.mkdir(projectPath, { recursive: true });
+      await fsPromises.mkdir(path.join(oldStorageDir, 'plans'), { recursive: true });
+      await fsPromises.writeFile(path.join(oldStorageDir, 'context.json'), JSON.stringify({ version: 2, notes: [], todos: [{ id: 't1', text: 'keep', completed: false, createdAt: 1 }], plans: [] }), 'utf8');
+      await fsPromises.writeFile(path.join(oldStorageDir, 'plans', 'inside.md'), '# Inside\n', 'utf8');
+      await fsPromises.writeFile(path.join(oldStorageDir, 'memory.json'), JSON.stringify({ version: 1, entries: [] }), 'utf8');
+      await fsPromises.writeFile(
+        settingsFilePath,
+        JSON.stringify({
+          projects: [{ id: oldProjectId, path: projectPath, addedAt: 1, lastOpenedAt: 1 }],
+          activeProjectId: oldProjectId,
+        }, null, 2),
+        'utf8',
+      );
+      await fsPromises.writeFile(
+        path.join(projectsRoot, `${oldProjectId}.json`),
+        JSON.stringify({ projectPlanFiles: [{ id: 'inside', path: path.join(oldStorageDir, 'plans', 'inside.md') }] }, null, 2),
+        'utf8',
+      );
+
+      const settings = await runtime.readSettingsFromDiskMigrated();
+
+      expect(settings.projects.map((project) => project.id)).toEqual([newProjectId]);
+      const migratedConfig = JSON.parse(await fsPromises.readFile(path.join(projectsRoot, `${stem}.json`), 'utf8'));
+      expect(migratedConfig.projectPlanFiles).toEqual([{ id: 'inside', path: path.join(newStorageDir, 'plans', 'inside.md') }]);
+      expect(JSON.parse(await fsPromises.readFile(path.join(newStorageDir, 'context.json'), 'utf8')).todos).toHaveLength(1);
+      await fsPromises.access(path.join(newStorageDir, 'plans', 'inside.md'));
+      await fsPromises.access(path.join(newStorageDir, 'memory.json'));
+      expect((await fsPromises.readdir(projectsRoot)).sort()).toEqual([stem, `${stem}.json`]);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('moves a folder an older build created under a raw id that still fit a folder name into the bounded folder', async () => {
+    const { runtime, settingsFilePath, tempRoot, cleanup } = await createRuntime();
+    try {
+      // Long enough for the bounded name, short enough that an older build
+      // could still have created `<id>/` on this filesystem. The temp root
+      // differs per OS (a few characters on Linux runners, dozens on macOS),
+      // so pad to a fixed path length instead of a fixed segment.
+      const projectPathLength = 170;
+      const segment = 'x'.repeat(Math.max(1, projectPathLength - path.join(tempRoot, 'demo-repo').length - 1));
+      const projectPath = path.join(tempRoot, segment, 'demo-repo');
+      const projectId = createProjectIdFromPath(projectPath);
+      const stem = projectConfigFileStemOf(projectId);
+      expect(projectId.length).toBeGreaterThan(200);
+      expect(projectId.length).toBeLessThanOrEqual(255);
+      expect(stem).not.toBe(projectId);
+      const projectsRoot = path.join(path.dirname(settingsFilePath), 'projects');
+      const rawStorageDir = path.join(projectsRoot, projectId);
+      const boundedStorageDir = path.join(projectsRoot, stem);
+
+      await fsPromises.mkdir(projectPath, { recursive: true });
+      await fsPromises.mkdir(path.join(rawStorageDir, 'plans'), { recursive: true });
+      await fsPromises.writeFile(path.join(rawStorageDir, 'context.json'), JSON.stringify({ version: 2, notes: [{ id: 'n1', body: 'old note', createdAt: 1, updatedAt: 1 }], todos: [], plans: [] }), 'utf8');
+      await fsPromises.writeFile(path.join(rawStorageDir, 'plans', 'old.md'), '# Old\n', 'utf8');
+      await fsPromises.writeFile(path.join(rawStorageDir, 'memory.json'), JSON.stringify({ version: 1, entries: [{ id: 'm1', title: 'Old memory', body: 'x', type: 'fact', createdAt: 1, updatedAt: 1 }] }), 'utf8');
+      // The bounded folder already holds newer context: both sides survive.
+      await fsPromises.mkdir(boundedStorageDir, { recursive: true });
+      await fsPromises.writeFile(path.join(boundedStorageDir, 'context.json'), JSON.stringify({ version: 2, notes: [{ id: 'n2', body: 'new note', createdAt: 2, updatedAt: 2 }], todos: [], plans: [] }), 'utf8');
+      await fsPromises.writeFile(
+        settingsFilePath,
+        JSON.stringify({ projects: [{ id: projectId, path: projectPath, addedAt: 1, lastOpenedAt: 1 }], activeProjectId: projectId }, null, 2),
+        'utf8',
+      );
+
+      const settings = await runtime.readSettingsFromDiskMigrated();
+
+      expect(settings.projects.map((project) => project.id)).toEqual([projectId]);
+      const context = JSON.parse(await fsPromises.readFile(path.join(boundedStorageDir, 'context.json'), 'utf8'));
+      expect(context.notes.map((note) => note.id).sort()).toEqual(['n1', 'n2']);
+      await fsPromises.access(path.join(boundedStorageDir, 'plans', 'old.md'));
+      expect(JSON.parse(await fsPromises.readFile(path.join(boundedStorageDir, 'memory.json'), 'utf8')).entries).toHaveLength(1);
+      await expect(fsPromises.access(rawStorageDir)).rejects.toMatchObject({ code: 'ENOENT' });
+
+      // A second startup finds nothing left to move.
+      await runtime.readSettingsFromDiskMigrated();
+      expect(JSON.parse(await fsPromises.readFile(path.join(boundedStorageDir, 'context.json'), 'utf8')).notes).toHaveLength(2);
+    } finally {
+      await cleanup();
+    }
+  });
+
   it('cleans up orphaned settings.json.tmp files during startup migration', async () => {
     const { runtime, settingsFilePath, tempRoot, cleanup } = await createRuntime();
     try {

package/server/lib/opencode/shutdown-runtime.js

@@ -108,6 +108,9 @@ export const createGracefulShutdownRuntime = (dependencies) => {
               console.log('HTTP server closed');
               resolve();
             });
+            // The backend has stopped. Active SSE/HTTP clients must not keep
+            // Desktop waiting for the outer shutdown deadline.
+            server.closeAllConnections?.();
           }),
           new Promise((resolve) => {
             closeTimeout = setTimeout(() => {

package/server/lib/opencode/shutdown-runtime.test.js

@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
+import http from 'node:http';
 
 import { createGracefulShutdownRuntime } from './shutdown-runtime.js';
 
@@ -55,4 +56,27 @@ describe('graceful shutdown runtime', () => {
     expect(warnSpy).not.toHaveBeenCalledWith('Server close timeout reached, forcing shutdown');
     expect(vi.getTimerCount()).toBe(0);
   });
+
+  it('closes an active HTTP stream instead of waiting for the shutdown deadline', async () => {
+    const server = http.createServer((_request, response) => {
+      response.writeHead(200, { 'content-type': 'text/event-stream' });
+      response.write('data: fixture\n\n');
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const request = http.get(`http://127.0.0.1:${server.address().port}`);
+    request.on('error', () => {});
+    const response = await new Promise((resolve) => request.once('response', resolve));
+    response.resume();
+    const closed = new Promise((resolve) => response.once('close', resolve));
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await createRuntime(server).gracefulShutdown({ exitProcess: false });
+      expect(warning).not.toHaveBeenCalledWith('Server close timeout reached, forcing shutdown');
+      await closed;
+    } finally {
+      request.destroy();
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    }
+  });
 });

package/server/lib/opencode/theme-archive.js

@@ -0,0 +1,53 @@
+import { inflateRaw } from 'node:zlib';
+import { promisify } from 'node:util';
+
+const inflate = promisify(inflateRaw);
+const MAX_FILE_BYTES = 512 * 1024;
+
+// Read only selected JSON entries in memory. Nothing from a VSIX is executed or
+// extracted onto the host filesystem.
+export function openThemeArchive(bytes) {
+  let end = bytes.length - 22;
+  const lower = Math.max(0, end - 65535);
+  while (end >= lower && (bytes.readUInt32LE(end) !== 0x06054b50 || end + 22 + bytes.readUInt16LE(end + 20) !== bytes.length)) end--;
+  if (end < lower) throw new Error('Invalid VSIX directory');
+  const count = bytes.readUInt16LE(end + 10);
+  const directorySize = bytes.readUInt32LE(end + 12);
+  let cursor = bytes.readUInt32LE(end + 16);
+  if (count > 5000 || bytes.readUInt16LE(end + 4) || bytes.readUInt16LE(end + 6)
+    || bytes.readUInt16LE(end + 8) !== count || cursor + directorySize !== end) throw new Error('Unsupported VSIX directory');
+  const entries = new Map();
+  let totalSize = 0;
+  for (let index = 0; index < count; index++) {
+    if (cursor + 46 > end || bytes.readUInt32LE(cursor) !== 0x02014b50) throw new Error('Invalid VSIX entry');
+    const flags = bytes.readUInt16LE(cursor + 8);
+    const method = bytes.readUInt16LE(cursor + 10);
+    const compressed = bytes.readUInt32LE(cursor + 20);
+    const size = bytes.readUInt32LE(cursor + 24);
+    const nameLength = bytes.readUInt16LE(cursor + 28);
+    const next = cursor + 46 + nameLength + bytes.readUInt16LE(cursor + 30) + bytes.readUInt16LE(cursor + 32);
+    const offset = bytes.readUInt32LE(cursor + 42);
+    if (next > end || nameLength > 1024 || flags & 1 || ![0, 8].includes(method)) throw new Error('Unsupported VSIX entry');
+    const name = bytes.toString('utf8', cursor + 46, cursor + 46 + nameLength);
+    const parts = name.replace(/\/$/, '').split('/');
+    if (parts.some((part) => !part || part === '.' || part === '..') || /[\\\0:]/.test(name) || entries.has(name)) throw new Error('Unsafe VSIX path');
+    totalSize += size;
+    if (totalSize > 100 * 1024 * 1024) throw new Error('VSIX contents too large');
+    entries.set(name, { offset, compressed, size, method });
+    cursor = next;
+  }
+  if (cursor !== end) throw new Error('Invalid VSIX directory size');
+  return async (name) => {
+    const entry = entries.get(name);
+    if (!entry || entry.size > MAX_FILE_BYTES) throw new Error('Theme file missing or too large');
+    const { offset, compressed, size, method } = entry;
+    if (offset + 30 > bytes.length || bytes.readUInt32LE(offset) !== 0x04034b50 || bytes.readUInt16LE(offset + 8) !== method) throw new Error('Invalid VSIX file');
+    const nameLength = bytes.readUInt16LE(offset + 26);
+    const start = offset + 30 + nameLength + bytes.readUInt16LE(offset + 28);
+    if (start + compressed > bytes.length || bytes.toString('utf8', offset + 30, offset + 30 + nameLength) !== name) throw new Error('Invalid VSIX file bounds');
+    const data = bytes.subarray(start, start + compressed);
+    const result = method === 0 ? data : await inflate(data, { maxOutputLength: MAX_FILE_BYTES });
+    if (result.length !== size) throw new Error('Invalid VSIX file size');
+    return result.toString('utf8');
+  };
+}

package/server/lib/opencode/theme-catalog.js

@@ -0,0 +1,171 @@
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { parse } from 'jsonc-parser';
+import { z } from 'zod';
+import { openThemeArchive } from './theme-archive.js';
+
+const identifier = z.string().min(1).max(160).regex(/^[\w-]+$/);
+const version = z.string().min(1).max(80).regex(/^[\w.+-]+$/);
+const settings = z.object({ foreground: z.string().optional() });
+const tokenRules = z.array(z.object({ scope: z.union([z.string(), z.array(z.string())]).optional(), settings }));
+const sourceSchema = z.object({
+  name: z.string().optional(), type: z.string().optional(), include: z.string().optional(),
+  colors: z.record(z.string(), z.string().nullable()).default({}),
+  tokenColors: z.union([z.string(), tokenRules]).optional(),
+  semanticHighlighting: z.boolean().optional(),
+  semanticTokenColors: z.record(z.string(), z.union([z.string(), settings])).optional(),
+});
+const extensionSchema = z.object({
+  namespace: identifier, name: identifier, version,
+  displayName: z.string().optional(), files: z.object({ icon: z.string().optional() }),
+});
+const detailSchema = extensionSchema.extend({ files: z.object({ download: z.string(), sha256: z.string() }) });
+const manifestSchema = z.object({
+  publisher: identifier, name: identifier, version,
+  contributes: z.object({ themes: z.array(z.object({
+    label: z.string().min(1).max(160), path: z.string().min(1).max(1024),
+    uiTheme: z.enum(['vs', 'vs-dark', 'hc-black', 'hc-light']).optional(),
+  })).min(1).max(40) }),
+});
+const querySchema = z.object({ query: z.string().trim().min(1).max(160) });
+const packageSchema = z.object({ namespace: identifier, name: identifier, version });
+const hosts = new Set(['open-vsx.org', 'openvsx.eclipsecontent.org']);
+
+function trustedUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== 'https:' || !hosts.has(url.hostname) || url.port || url.username || url.password) throw new Error('Unexpected catalog host');
+  return url;
+}
+
+async function download(url, maxBytes, signal, fetchImpl) {
+  for (let redirects = 0; redirects < 4; redirects++) {
+    const response = await fetchImpl(trustedUrl(url), { signal, redirect: 'manual' });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      await response.body?.cancel();
+      url = new URL(response.headers.get('location') ?? '', url).href;
+      continue;
+    }
+    if (!response.ok || !response.body || Number(response.headers.get('content-length')) > maxBytes) {
+      await response.body?.cancel();
+      throw new Error('Catalog request failed');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        length += value.byteLength;
+        if (length > maxBytes) throw new Error('Catalog response too large');
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    return Buffer.concat(chunks, length);
+  }
+  throw new Error('Too many catalog redirects');
+}
+
+function parseJsonc(text, schema) {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length) throw new Error('Invalid theme JSON');
+  return schema.parse(value);
+}
+
+function themePath(from, reference) {
+  if (/[\\\0:]/.test(reference) || reference.startsWith('/')) throw new Error('Invalid theme reference');
+  const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(from), reference));
+  if (!resolved.startsWith('extension/')) throw new Error('Theme reference escapes package');
+  return resolved;
+}
+
+export function createThemeCatalog({ fetchImpl = fetch } = {}) {
+  const search = async (input, signal = AbortSignal.timeout(15000)) => {
+    const { query } = querySchema.parse(input);
+    const url = new URL('https://open-vsx.org/api/-/search');
+    url.search = new URLSearchParams({ query, category: 'Themes', size: '24', sortBy: 'relevance' }).toString();
+    const bytes = await download(url.href, 1024 * 1024, signal, fetchImpl);
+    const result = z.object({ extensions: z.array(extensionSchema).max(24) }).parse(JSON.parse(bytes.toString('utf8')));
+    return result.extensions.map((extension) => ({
+      namespace: extension.namespace, name: extension.name, version: extension.version,
+      label: extension.displayName || extension.name,
+      icon: extension.files.icon && URL.canParse(extension.files.icon) && hosts.has(new URL(extension.files.icon).hostname)
+        ? trustedUrl(extension.files.icon).href : null,
+    }));
+  };
+
+  const readPackage = async (input, signal = AbortSignal.timeout(45000)) => {
+    const requested = packageSchema.parse(input);
+    const url = `https://open-vsx.org/api/${requested.namespace}/${requested.name}/${requested.version}`;
+    const detail = detailSchema.parse(JSON.parse((await download(url, 512 * 1024, signal, fetchImpl)).toString('utf8')));
+    const bytes = await download(detail.files.download, 20 * 1024 * 1024, signal, fetchImpl);
+    const checksum = (await download(detail.files.sha256, 256, signal, fetchImpl)).toString('utf8').trim().split(/\s+/)[0];
+    if (createHash('sha256').update(bytes).digest('hex') !== checksum?.toLowerCase()) throw new Error('VSIX checksum mismatch');
+    const read = openThemeArchive(bytes);
+    const manifest = parseJsonc(await read('extension/package.json'), manifestSchema);
+    if (manifest.publisher.toLowerCase() !== requested.namespace.toLowerCase() || manifest.name !== requested.name || manifest.version !== requested.version) throw new Error('VSIX identity mismatch');
+    let reads = 0;
+    const load = async (file, ancestors = []) => {
+      signal.throwIfAborted();
+      if (ancestors.includes(file) || ancestors.length >= 8 || ++reads > 320) throw new Error('Too many theme references');
+      const source = parseJsonc(await read(file), sourceSchema);
+      const parent = source.include ? await load(themePath(file, source.include), [...ancestors, file]) : null;
+      const reference = z.string().safeParse(source.tokenColors);
+      const rules = reference.success
+        ? parseJsonc(await read(themePath(file, reference.data)), tokenRules) : tokenRules.parse(source.tokenColors ?? []);
+      const { include: _include, ...own } = source;
+      return {
+        ...parent, ...own,
+        colors: { ...parent?.colors, ...source.colors },
+        tokenColors: [...(parent?.tokenColors ?? []), ...(rules ?? [])],
+        semanticTokenColors: { ...parent?.semanticTokenColors, ...source.semanticTokenColors },
+      };
+    };
+    const themes = [];
+    let totalBytes = 0;
+    for (const contribution of manifest.contributes.themes) {
+      try {
+        const file = themePath('extension/package.json', contribution.path);
+        const source = await load(file);
+        source.name = contribution.label;
+        if (contribution.uiTheme) source.type = contribution.uiTheme === 'vs' ? 'light' : contribution.uiTheme === 'vs-dark' ? 'dark' : contribution.uiTheme;
+        const text = JSON.stringify(source);
+        totalBytes += Buffer.byteLength(text);
+        if (Buffer.byteLength(text) > 512 * 1024 || totalBytes > 10 * 1024 * 1024) throw new Error('Resolved themes too large');
+        themes.push({ path: contribution.path, name: contribution.label, text, error: false });
+      } catch {
+        signal.throwIfAborted();
+        themes.push({ path: contribution.path, name: contribution.label, text: '', error: true });
+      }
+    }
+    return themes;
+  };
+  return { search, readPackage };
+}
+
+export function registerThemeCatalogRoutes(app, catalog = createThemeCatalog()) {
+  for (const [route, operation, schema] of [
+    ['/api/config/themes/catalog/search', catalog.search, querySchema],
+    ['/api/config/themes/catalog/package', catalog.readPackage, packageSchema],
+  ]) {
+    app.post(route, async (req, res) => {
+      const input = schema.safeParse(req.body);
+      if (!input.success) return res.status(400).json({ error: 'invalid' });
+      const controller = new AbortController();
+      const cancel = () => controller.abort();
+      res.on('close', cancel);
+      try {
+        const items = await operation(input.data, AbortSignal.any([controller.signal, AbortSignal.timeout(45000)]));
+        res.json({ items });
+      } catch {
+        if (!res.destroyed) res.status(502).json({ error: 'catalog' });
+      } finally {
+        res.off('close', cancel);
+      }
+    });
+  }
+}