@vantran-se/openchamber-web 1.23.1 → 1.24.3

package/server/lib/opencode/settings-helpers.js

@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 
 import { isAgentMemoryFeatureAvailable } from '../agent-memory/feature-flag.js';
+import { isRoutingFeatureAvailable } from '../routing/feature-flag.js';
 
 // Generated from packages/ui/src/lib/settings/registry.ts by
 // `bun run settings-registry:generate`; `registry.test.ts` fails when stale.
@@ -233,6 +234,11 @@ export const createSettingsHelpers = (dependencies) => {
     if (typeof candidate.workStatusHiddenSectionsExplicit === 'boolean') {
       result.workStatusHiddenSectionsExplicit = candidate.workStatusHiddenSectionsExplicit;
     }
+    if (Array.isArray(candidate.workStatusSectionOrder)) {
+      result.workStatusSectionOrder = [
+        ...new Set(candidate.workStatusSectionOrder.filter((entry) => typeof entry === 'string' && entry.length > 0)),
+      ];
+    }
     if (typeof candidate.desktopLanAccessEnabled === 'boolean') {
       result.desktopLanAccessEnabled = candidate.desktopLanAccessEnabled;
     }
@@ -1008,6 +1014,8 @@ export const createSettingsHelpers = (dependencies) => {
       // Tells the client whether agent memory exists in this build at all, so
       // its settings row and panel tab can be absent rather than merely off.
       agentMemoryFeatureAvailable: isAgentMemoryFeatureAvailable(),
+      // Same idea for Jev routing: absent from the picker and Settings unless the build has it.
+      routingFeatureAvailable: isRoutingFeatureAvailable(),
       ...(pwaAppName ? { pwaAppName } : {}),
       pwaOrientation,
       mobileKeyboardMode,

package/server/lib/opencode/settings-helpers.test.js

@@ -69,6 +69,18 @@ const createTestHelpersWithRealSanitizers = () => {
 };
 
 describe('settings helpers', () => {
+  it('round-trips section order and preserves it across unrelated writes', () => {
+    const helpers = createTestHelpers();
+    const changes = helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: ['mcp', 'session', 'mcp', null, ''] });
+    expect(changes.workStatusSectionOrder).toEqual(['mcp', 'session']);
+    const saved = helpers.mergePersistedSettings({}, changes);
+    const reloaded = helpers.formatSettingsResponse(JSON.parse(JSON.stringify(saved)));
+    expect(reloaded.workStatusSectionOrder).toEqual(['mcp', 'session']);
+    const next = helpers.mergePersistedSettings(reloaded, helpers.sanitizeSettingsUpdate({ workStatusPanelEnabled: false }));
+    expect(helpers.formatSettingsResponse(next).workStatusSectionOrder).toEqual(['mcp', 'session']);
+    expect(helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: 'bad' }).workStatusSectionOrder).toBeUndefined();
+    expect(helpers.sanitizeSettingsUpdate({ workStatusSectionOrder: [] }).workStatusSectionOrder).toEqual([]);
+  });
   it('round-trips telemetry opt-in with the hidden list and preserves it across unrelated writes', () => {
     const helpers = createTestHelpers();
     const legacy = helpers.sanitizeSettingsUpdate({ workStatusHiddenSections: [] });
@@ -762,7 +774,7 @@ describe('settings registry gate', () => {
     managedRemoteTunnelHostname: 'x.example', managedRemoteTunnelToken: 'token', managedRemoteTunnelPresets: [{ id: 'a', name: 'A', hostname: 'a.example' }],
     managedRemoteTunnelSelectedPresetId: 'a', managedRemoteTunnelPresetTokens: { a: 'token' },
     sidebarProjectDisplayMode: 'all', sidebarSessionGroupingMode: 'flat', sidebarProjectSortOrder: 'manual', sidebarShowRecentSection: true,
-    workStatusPanelEnabled: true, workStatusHiddenSections: ['mcp'], workStatusHiddenSectionsExplicit: true,
+    workStatusPanelEnabled: true, workStatusHiddenSections: ['mcp'], workStatusHiddenSectionsExplicit: true, workStatusSectionOrder: ['mcp', 'session'],
     showReasoningTraces: true, streamingAutoFollowEnabled: true, collapsibleThinkingBlocks: true, showTextJustificationActivity: true,
     chatRenderMode: 'live', activityRenderMode: 'summary', mermaidRenderingMode: 'svg', userMessageRenderingMode: 'markdown', collapsibleUserMessages: true,
     stickyUserHeader: true, promptNavigatorEnabled: true, wideChatLayoutEnabled: true, showSplitAssistantMessageActions: true, showToolFileIcons: true,

package/server/lib/opencode/settings-normalization-runtime.js

@@ -154,6 +154,7 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
         : null;
       const iconBackground = normalizeIconBackground(candidate.iconBackground);
       const color = typeof candidate.color === 'string' ? candidate.color.trim() : '';
+      const defaultAgent = typeof candidate.defaultAgent === 'string' ? candidate.defaultAgent.trim() : '';
       const defaultModel = typeof candidate.defaultModel === 'string' ? candidate.defaultModel.trim() : '';
       const defaultVariant = typeof candidate.defaultVariant === 'string' ? candidate.defaultVariant.trim() : '';
       const addedAt = Number.isFinite(candidate.addedAt) ? Number(candidate.addedAt) : null;
@@ -175,6 +176,7 @@ export const createSettingsNormalizationRuntime = (dependencies) => {
         ...(icon ? { icon } : {}),
         ...(iconBackground ? { iconBackground } : {}),
         ...(color ? { color } : {}),
+        ...(defaultAgent ? { defaultAgent } : {}),
         ...(defaultModel && defaultModel.includes('/') ? { defaultModel } : {}),
         // A variant is meaningless without the model it belongs to.
         ...(defaultModel && defaultModel.includes('/') && defaultVariant ? { defaultVariant } : {}),

package/server/lib/opencode/settings-normalization-runtime.test.js

@@ -122,6 +122,19 @@ describe('settings normalization runtime - symlink resolution', () => {
       expect(result[1].defaultVariant).toBe(undefined);
     });
 
+    it('keeps a project default agent', () => {
+      const runtime = createTestRuntime({
+        realpathSync: (p) => p,
+        path: { resolve: (p) => p, sep: '/', dirname: (p) => p.split('/').slice(0, -1).join('/') || '/' },
+      });
+
+      const result = runtime.sanitizeProjects([
+        { id: 'proj1', path: '/a', defaultAgent: 'plan' },
+      ]);
+
+      expect(result[0].defaultAgent).toBe('plan');
+    });
+
     it('deduplicates projects that resolve to the same realpath', () => {
       const runtime = createTestRuntime({
         realpathSync: (p) => p.startsWith('/symlink') ? '/real/project' : p,

package/server/lib/opencode/settings-registry.json

@@ -127,6 +127,10 @@
       "scope": "instance",
       "computed": true
     },
+    "routingFeatureAvailable": {
+      "scope": "instance",
+      "computed": true
+    },
     "openCodeUpdateToastDismissedVersion": {
       "scope": "instance"
     },
@@ -217,6 +221,9 @@
     "sidebarShowRecentSection": {
       "scope": "profile"
     },
+    "workStatusSectionOrder": {
+      "scope": "profile"
+    },
     "workStatusPanelEnabled": {
       "scope": "profile"
     },
@@ -605,6 +612,10 @@
       "scope": "device",
       "local": true
     },
+    "contextEditorVisible": {
+      "scope": "device",
+      "local": true
+    },
     "contextEditorTreeWidth": {
       "scope": "device",
       "local": true
@@ -617,6 +628,10 @@
       "scope": "device",
       "local": true
     },
+    "messageQueueExpanded": {
+      "scope": "device",
+      "local": true
+    },
     "workStatusScrollTop": {
       "scope": "device",
       "local": true

package/server/lib/opencode/shutdown-runtime.js

@@ -108,6 +108,9 @@ export const createGracefulShutdownRuntime = (dependencies) => {
               console.log('HTTP server closed');
               resolve();
             });
+            // The backend has stopped. Active SSE/HTTP clients must not keep
+            // Desktop waiting for the outer shutdown deadline.
+            server.closeAllConnections?.();
           }),
           new Promise((resolve) => {
             closeTimeout = setTimeout(() => {

package/server/lib/opencode/shutdown-runtime.test.js

@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
+import http from 'node:http';
 
 import { createGracefulShutdownRuntime } from './shutdown-runtime.js';
 
@@ -55,4 +56,27 @@ describe('graceful shutdown runtime', () => {
     expect(warnSpy).not.toHaveBeenCalledWith('Server close timeout reached, forcing shutdown');
     expect(vi.getTimerCount()).toBe(0);
   });
+
+  it('closes an active HTTP stream instead of waiting for the shutdown deadline', async () => {
+    const server = http.createServer((_request, response) => {
+      response.writeHead(200, { 'content-type': 'text/event-stream' });
+      response.write('data: fixture\n\n');
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const request = http.get(`http://127.0.0.1:${server.address().port}`);
+    request.on('error', () => {});
+    const response = await new Promise((resolve) => request.once('response', resolve));
+    response.resume();
+    const closed = new Promise((resolve) => response.once('close', resolve));
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await createRuntime(server).gracefulShutdown({ exitProcess: false });
+      expect(warning).not.toHaveBeenCalledWith('Server close timeout reached, forcing shutdown');
+      await closed;
+    } finally {
+      request.destroy();
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    }
+  });
 });

package/server/lib/opencode/theme-archive.js

@@ -0,0 +1,53 @@
+import { inflateRaw } from 'node:zlib';
+import { promisify } from 'node:util';
+
+const inflate = promisify(inflateRaw);
+const MAX_FILE_BYTES = 512 * 1024;
+
+// Read only selected JSON entries in memory. Nothing from a VSIX is executed or
+// extracted onto the host filesystem.
+export function openThemeArchive(bytes) {
+  let end = bytes.length - 22;
+  const lower = Math.max(0, end - 65535);
+  while (end >= lower && (bytes.readUInt32LE(end) !== 0x06054b50 || end + 22 + bytes.readUInt16LE(end + 20) !== bytes.length)) end--;
+  if (end < lower) throw new Error('Invalid VSIX directory');
+  const count = bytes.readUInt16LE(end + 10);
+  const directorySize = bytes.readUInt32LE(end + 12);
+  let cursor = bytes.readUInt32LE(end + 16);
+  if (count > 5000 || bytes.readUInt16LE(end + 4) || bytes.readUInt16LE(end + 6)
+    || bytes.readUInt16LE(end + 8) !== count || cursor + directorySize !== end) throw new Error('Unsupported VSIX directory');
+  const entries = new Map();
+  let totalSize = 0;
+  for (let index = 0; index < count; index++) {
+    if (cursor + 46 > end || bytes.readUInt32LE(cursor) !== 0x02014b50) throw new Error('Invalid VSIX entry');
+    const flags = bytes.readUInt16LE(cursor + 8);
+    const method = bytes.readUInt16LE(cursor + 10);
+    const compressed = bytes.readUInt32LE(cursor + 20);
+    const size = bytes.readUInt32LE(cursor + 24);
+    const nameLength = bytes.readUInt16LE(cursor + 28);
+    const next = cursor + 46 + nameLength + bytes.readUInt16LE(cursor + 30) + bytes.readUInt16LE(cursor + 32);
+    const offset = bytes.readUInt32LE(cursor + 42);
+    if (next > end || nameLength > 1024 || flags & 1 || ![0, 8].includes(method)) throw new Error('Unsupported VSIX entry');
+    const name = bytes.toString('utf8', cursor + 46, cursor + 46 + nameLength);
+    const parts = name.replace(/\/$/, '').split('/');
+    if (parts.some((part) => !part || part === '.' || part === '..') || /[\\\0:]/.test(name) || entries.has(name)) throw new Error('Unsafe VSIX path');
+    totalSize += size;
+    if (totalSize > 100 * 1024 * 1024) throw new Error('VSIX contents too large');
+    entries.set(name, { offset, compressed, size, method });
+    cursor = next;
+  }
+  if (cursor !== end) throw new Error('Invalid VSIX directory size');
+  return async (name) => {
+    const entry = entries.get(name);
+    if (!entry || entry.size > MAX_FILE_BYTES) throw new Error('Theme file missing or too large');
+    const { offset, compressed, size, method } = entry;
+    if (offset + 30 > bytes.length || bytes.readUInt32LE(offset) !== 0x04034b50 || bytes.readUInt16LE(offset + 8) !== method) throw new Error('Invalid VSIX file');
+    const nameLength = bytes.readUInt16LE(offset + 26);
+    const start = offset + 30 + nameLength + bytes.readUInt16LE(offset + 28);
+    if (start + compressed > bytes.length || bytes.toString('utf8', offset + 30, offset + 30 + nameLength) !== name) throw new Error('Invalid VSIX file bounds');
+    const data = bytes.subarray(start, start + compressed);
+    const result = method === 0 ? data : await inflate(data, { maxOutputLength: MAX_FILE_BYTES });
+    if (result.length !== size) throw new Error('Invalid VSIX file size');
+    return result.toString('utf8');
+  };
+}

package/server/lib/opencode/theme-catalog.js

@@ -0,0 +1,171 @@
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { parse } from 'jsonc-parser';
+import { z } from 'zod';
+import { openThemeArchive } from './theme-archive.js';
+
+const identifier = z.string().min(1).max(160).regex(/^[\w-]+$/);
+const version = z.string().min(1).max(80).regex(/^[\w.+-]+$/);
+const settings = z.object({ foreground: z.string().optional() });
+const tokenRules = z.array(z.object({ scope: z.union([z.string(), z.array(z.string())]).optional(), settings }));
+const sourceSchema = z.object({
+  name: z.string().optional(), type: z.string().optional(), include: z.string().optional(),
+  colors: z.record(z.string(), z.string().nullable()).default({}),
+  tokenColors: z.union([z.string(), tokenRules]).optional(),
+  semanticHighlighting: z.boolean().optional(),
+  semanticTokenColors: z.record(z.string(), z.union([z.string(), settings])).optional(),
+});
+const extensionSchema = z.object({
+  namespace: identifier, name: identifier, version,
+  displayName: z.string().optional(), files: z.object({ icon: z.string().optional() }),
+});
+const detailSchema = extensionSchema.extend({ files: z.object({ download: z.string(), sha256: z.string() }) });
+const manifestSchema = z.object({
+  publisher: identifier, name: identifier, version,
+  contributes: z.object({ themes: z.array(z.object({
+    label: z.string().min(1).max(160), path: z.string().min(1).max(1024),
+    uiTheme: z.enum(['vs', 'vs-dark', 'hc-black', 'hc-light']).optional(),
+  })).min(1).max(40) }),
+});
+const querySchema = z.object({ query: z.string().trim().min(1).max(160) });
+const packageSchema = z.object({ namespace: identifier, name: identifier, version });
+const hosts = new Set(['open-vsx.org', 'openvsx.eclipsecontent.org']);
+
+function trustedUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== 'https:' || !hosts.has(url.hostname) || url.port || url.username || url.password) throw new Error('Unexpected catalog host');
+  return url;
+}
+
+async function download(url, maxBytes, signal, fetchImpl) {
+  for (let redirects = 0; redirects < 4; redirects++) {
+    const response = await fetchImpl(trustedUrl(url), { signal, redirect: 'manual' });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      await response.body?.cancel();
+      url = new URL(response.headers.get('location') ?? '', url).href;
+      continue;
+    }
+    if (!response.ok || !response.body || Number(response.headers.get('content-length')) > maxBytes) {
+      await response.body?.cancel();
+      throw new Error('Catalog request failed');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        length += value.byteLength;
+        if (length > maxBytes) throw new Error('Catalog response too large');
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    return Buffer.concat(chunks, length);
+  }
+  throw new Error('Too many catalog redirects');
+}
+
+function parseJsonc(text, schema) {
+  const errors = [];
+  const value = parse(text, errors, { allowTrailingComma: true });
+  if (errors.length) throw new Error('Invalid theme JSON');
+  return schema.parse(value);
+}
+
+function themePath(from, reference) {
+  if (/[\\\0:]/.test(reference) || reference.startsWith('/')) throw new Error('Invalid theme reference');
+  const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(from), reference));
+  if (!resolved.startsWith('extension/')) throw new Error('Theme reference escapes package');
+  return resolved;
+}
+
+export function createThemeCatalog({ fetchImpl = fetch } = {}) {
+  const search = async (input, signal = AbortSignal.timeout(15000)) => {
+    const { query } = querySchema.parse(input);
+    const url = new URL('https://open-vsx.org/api/-/search');
+    url.search = new URLSearchParams({ query, category: 'Themes', size: '24', sortBy: 'relevance' }).toString();
+    const bytes = await download(url.href, 1024 * 1024, signal, fetchImpl);
+    const result = z.object({ extensions: z.array(extensionSchema).max(24) }).parse(JSON.parse(bytes.toString('utf8')));
+    return result.extensions.map((extension) => ({
+      namespace: extension.namespace, name: extension.name, version: extension.version,
+      label: extension.displayName || extension.name,
+      icon: extension.files.icon && URL.canParse(extension.files.icon) && hosts.has(new URL(extension.files.icon).hostname)
+        ? trustedUrl(extension.files.icon).href : null,
+    }));
+  };
+
+  const readPackage = async (input, signal = AbortSignal.timeout(45000)) => {
+    const requested = packageSchema.parse(input);
+    const url = `https://open-vsx.org/api/${requested.namespace}/${requested.name}/${requested.version}`;
+    const detail = detailSchema.parse(JSON.parse((await download(url, 512 * 1024, signal, fetchImpl)).toString('utf8')));
+    const bytes = await download(detail.files.download, 20 * 1024 * 1024, signal, fetchImpl);
+    const checksum = (await download(detail.files.sha256, 256, signal, fetchImpl)).toString('utf8').trim().split(/\s+/)[0];
+    if (createHash('sha256').update(bytes).digest('hex') !== checksum?.toLowerCase()) throw new Error('VSIX checksum mismatch');
+    const read = openThemeArchive(bytes);
+    const manifest = parseJsonc(await read('extension/package.json'), manifestSchema);
+    if (manifest.publisher.toLowerCase() !== requested.namespace.toLowerCase() || manifest.name !== requested.name || manifest.version !== requested.version) throw new Error('VSIX identity mismatch');
+    let reads = 0;
+    const load = async (file, ancestors = []) => {
+      signal.throwIfAborted();
+      if (ancestors.includes(file) || ancestors.length >= 8 || ++reads > 320) throw new Error('Too many theme references');
+      const source = parseJsonc(await read(file), sourceSchema);
+      const parent = source.include ? await load(themePath(file, source.include), [...ancestors, file]) : null;
+      const reference = z.string().safeParse(source.tokenColors);
+      const rules = reference.success
+        ? parseJsonc(await read(themePath(file, reference.data)), tokenRules) : tokenRules.parse(source.tokenColors ?? []);
+      const { include: _include, ...own } = source;
+      return {
+        ...parent, ...own,
+        colors: { ...parent?.colors, ...source.colors },
+        tokenColors: [...(parent?.tokenColors ?? []), ...(rules ?? [])],
+        semanticTokenColors: { ...parent?.semanticTokenColors, ...source.semanticTokenColors },
+      };
+    };
+    const themes = [];
+    let totalBytes = 0;
+    for (const contribution of manifest.contributes.themes) {
+      try {
+        const file = themePath('extension/package.json', contribution.path);
+        const source = await load(file);
+        source.name = contribution.label;
+        if (contribution.uiTheme) source.type = contribution.uiTheme === 'vs' ? 'light' : contribution.uiTheme === 'vs-dark' ? 'dark' : contribution.uiTheme;
+        const text = JSON.stringify(source);
+        totalBytes += Buffer.byteLength(text);
+        if (Buffer.byteLength(text) > 512 * 1024 || totalBytes > 10 * 1024 * 1024) throw new Error('Resolved themes too large');
+        themes.push({ path: contribution.path, name: contribution.label, text, error: false });
+      } catch {
+        signal.throwIfAborted();
+        themes.push({ path: contribution.path, name: contribution.label, text: '', error: true });
+      }
+    }
+    return themes;
+  };
+  return { search, readPackage };
+}
+
+export function registerThemeCatalogRoutes(app, catalog = createThemeCatalog()) {
+  for (const [route, operation, schema] of [
+    ['/api/config/themes/catalog/search', catalog.search, querySchema],
+    ['/api/config/themes/catalog/package', catalog.readPackage, packageSchema],
+  ]) {
+    app.post(route, async (req, res) => {
+      const input = schema.safeParse(req.body);
+      if (!input.success) return res.status(400).json({ error: 'invalid' });
+      const controller = new AbortController();
+      const cancel = () => controller.abort();
+      res.on('close', cancel);
+      try {
+        const items = await operation(input.data, AbortSignal.any([controller.signal, AbortSignal.timeout(45000)]));
+        res.json({ items });
+      } catch {
+        if (!res.destroyed) res.status(502).json({ error: 'catalog' });
+      } finally {
+        res.off('close', cancel);
+      }
+    });
+  }
+}

package/server/lib/opencode/theme-catalog.test.js

@@ -0,0 +1,125 @@
+import { describe, expect, test } from 'bun:test';
+import { createHash } from 'node:crypto';
+import { deflateRawSync } from 'node:zlib';
+import { createThemeCatalog, registerThemeCatalogRoutes } from './theme-catalog.js';
+import { registerCommonRequestMiddleware } from './core-routes.js';
+import express from 'express';
+import request from 'supertest';
+import { openThemeArchive } from './theme-archive.js';
+
+function archive(files) {
+  const locals = [];
+  const directory = [];
+  let offset = 0;
+  for (const [filename, content] of Object.entries(files)) {
+    const name = Buffer.from(filename);
+    const data = Buffer.from(content);
+    const compressed = deflateRawSync(data);
+    const header = Buffer.alloc(30);
+    header.writeUInt32LE(0x04034b50);
+    header.writeUInt16LE(8, 8);
+    header.writeUInt32LE(compressed.length, 18);
+    header.writeUInt32LE(data.length, 22);
+    header.writeUInt16LE(name.length, 26);
+    locals.push(header, name, compressed);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(offset, 42);
+    directory.push(central, name);
+    offset += header.length + name.length + compressed.length;
+  }
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50);
+  end.writeUInt16LE(directory.length / 2, 8);
+  end.writeUInt16LE(directory.length / 2, 10);
+  end.writeUInt32LE(Buffer.concat(directory).length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, ...directory, end]);
+}
+
+const identity = { namespace: 'Author', name: 'fixture', version: '1.0.0' };
+const manifest = { publisher: 'Author', name: 'fixture', version: '1.0.0', contributes: { themes: [
+  { label: 'Readable Night', path: './themes/night.json', uiTheme: 'vs-dark' },
+  { label: 'Broken sibling', path: '../../outside.json', uiTheme: 'vs' },
+] } };
+const packageFiles = {
+  'extension/package.json': JSON.stringify(manifest),
+  'extension/base.json': '{"colors":{"editor.background":"#111111","editor.foreground":"#eeeeee"},"tokenColors":[{"scope":"string","settings":{"foreground":"#aaaaaa"}}]}',
+  'extension/themes/night.json': '{ // JSONC\n"include":"../base.json", "colors":{"editor.foreground":"#ffffff"},"tokenColors":"./tokens.json",}',
+  'extension/themes/tokens.json': '[{"scope":"keyword","settings":{"foreground":"#aabbcc"}}]',
+};
+
+function transport(bytes, overrides = {}) {
+  const responses = new Map([
+    ['https://open-vsx.org/api/Author/fixture/1.0.0', JSON.stringify({ ...identity, files: { download: 'https://open-vsx.org/package.vsix', sha256: 'https://open-vsx.org/package.sha256' } })],
+    ['https://open-vsx.org/package.vsix', bytes],
+    ['https://open-vsx.org/package.sha256', createHash('sha256').update(bytes).digest('hex')],
+    ...Object.entries(overrides),
+  ]);
+  return async (url) => {
+    const body = responses.get(url.href);
+    if (body === undefined) throw new Error(`Unexpected request ${url}`);
+    return new Response(body);
+  };
+}
+
+describe('Open VSX theme catalog', () => {
+  test('catalog requests retain their bodies through the production middleware', async () => {
+    const app = express();
+    registerCommonRequestMiddleware(app, { express });
+    const catalog = createThemeCatalog({ fetchImpl: transport(archive(packageFiles)) });
+    registerThemeCatalogRoutes(app, {
+      search: async (input) => { expect(input).toEqual({ query: 'nord' }); return []; },
+      readPackage: catalog.readPackage,
+    });
+    await request(app).post('/api/config/themes/catalog/search').send({ query: 'nord' }).expect(200);
+    const response = await request(app).post('/api/config/themes/catalog/package').send(identity).expect(200);
+    expect(response.body.items[0].name).toBe('Readable Night');
+  });
+  test('resolves JSONC includes and external token files, preserving healthy siblings and manifest labels', async () => {
+    const catalog = createThemeCatalog({ fetchImpl: transport(archive(packageFiles)) });
+    const result = await catalog.readPackage(identity);
+    expect(result[0].error).toBe(false);
+    const source = JSON.parse(result[0].text);
+    expect(source.name).toBe('Readable Night');
+    expect(source.type).toBe('dark');
+    expect(source.colors).toEqual({ 'editor.background': '#111111', 'editor.foreground': '#ffffff' });
+    expect(source.tokenColors.map((rule) => rule.scope)).toEqual(['string', 'keyword']);
+    expect(source.include).toBeUndefined();
+    expect(result[1].error).toBe(true);
+  });
+
+  test('rejects checksum and package identity mismatches', async () => {
+    const bytes = archive(packageFiles);
+    await expect(createThemeCatalog({ fetchImpl: transport(bytes, { 'https://open-vsx.org/package.sha256': '0'.repeat(64) }) }).readPackage(identity)).rejects.toThrow('checksum');
+    const wrong = archive({ ...packageFiles, 'extension/package.json': JSON.stringify({ ...manifest, publisher: 'Impostor' }) });
+    await expect(createThemeCatalog({ fetchImpl: transport(wrong) }).readPackage(identity)).rejects.toThrow('identity');
+  });
+
+  test('limits decompression and rejects traversal and cyclic includes', async () => {
+    expect(() => openThemeArchive(archive({ '../outside.json': '{}' }))).toThrow('Unsafe');
+    const read = openThemeArchive(archive({ 'extension/huge.json': ' '.repeat(512 * 1024 + 1) }));
+    await expect(read('extension/huge.json')).rejects.toThrow('large');
+    const cyclic = archive({ ...packageFiles, 'extension/base.json': '{"include":"./themes/night.json"}' });
+    expect((await createThemeCatalog({ fetchImpl: transport(cyclic) }).readPackage(identity))[0].error).toBe(true);
+  });
+
+  test('searches only the theme category and rejects redirects outside the catalog', async () => {
+    const catalog = createThemeCatalog({ fetchImpl: async (url, options) => {
+      expect(url.searchParams.get('category')).toBe('Themes');
+      expect(url.searchParams.get('query')).toBe('Dune');
+      expect(options.redirect).toBe('manual');
+      return Response.json({ extensions: [{ ...identity, displayName: 'Dune', files: {} }] });
+    } });
+    expect((await catalog.search({ query: 'Dune' }))[0].label).toBe('Dune');
+    let calls = 0;
+    const hostile = createThemeCatalog({ fetchImpl: async () => { calls++; return new Response(null, { status: 302, headers: { location: 'http://127.0.0.1/private' } }); } });
+    await expect(hostile.search({ query: 'Dune' })).rejects.toThrow('host');
+    expect(calls).toBe(1);
+    await expect(catalog.readPackage({ ...identity, name: '../secret' })).rejects.toThrow();
+  });
+});