@youdie006/prodex 0.40.49 → 0.40.51

package/dist/http-mcp.js

@@ -6,11 +6,101 @@ import { createServer as createMcpServer } from "./mcp.js";
 import { normalizeLoopbackHttpHost } from "./config.js";
 const DEFAULT_REQUEST_BODY_LIMIT_BYTES = 1_048_576;
 const TRANSPORT_CLOSE_TIMEOUT_MS = 5_000;
+/**
+ * Every initialize used to keep its MCP server and transport until a DELETE
+ * that clients rarely send, about 170 KB each: measured 2026-11-09, RSS went
+ * from 92 MB to 1 GB over 5,000 initializes. The bridge tools answer in
+ * seconds, so a session with no request for half an hour and no stream open
+ * has been left behind; a client that does come back gets 404, which MCP
+ * clients answer by initializing again, at the cost of one round trip.
+ */
+const DEFAULT_SESSION_IDLE_TIMEOUT_MS = 30 * 60_000;
+/**
+ * A personal server sees a few clients at a time (a ChatGPT project, Codex, a
+ * Claude session), so 100 live sessions is far above real use while holding
+ * at most about 17 MB, also against a client that initializes in a loop.
+ */
+const DEFAULT_MAX_SESSIONS = 100;
+const SESSION_SWEEP_INTERVAL_MAX_MS = 60_000;
+/**
+ * The live MCP sessions, kept in least-recently-used order. A session is in
+ * use while a request of its own is open (a GET stream stays open for as long
+ * as the client listens), and idle from when its last request ended.
+ */
+class HttpMcpSessions {
+    limits;
+    entries = new Map();
+    constructor(limits) {
+        this.limits = limits;
+    }
+    /** The session's transport, counted as in use until res closes; undefined when unknown or closed. */
+    use(sessionId, res) {
+        const entry = this.entries.get(sessionId);
+        if (!entry)
+            return undefined;
+        this.entries.delete(sessionId);
+        this.entries.set(sessionId, entry);
+        entry.openRequests += 1;
+        entry.lastActiveMs = this.limits.now();
+        res.once("close", () => {
+            entry.openRequests -= 1;
+            entry.lastActiveMs = this.limits.now();
+        });
+        return entry.transport;
+    }
+    add(sessionId, transport) {
+        this.entries.set(sessionId, { transport, lastActiveMs: this.limits.now(), openRequests: 0 });
+        while (this.entries.size > this.limits.maxSessions) {
+            // The least recently used session without an open request, else the
+            // least recently used of all; never the one just added, which is last.
+            let victim;
+            for (const [id, entry] of this.entries) {
+                if (entry.openRequests === 0) {
+                    victim = id;
+                    break;
+                }
+            }
+            this.close(victim ?? this.entries.keys().next().value);
+        }
+    }
+    remove(sessionId, transport) {
+        if (this.entries.get(sessionId)?.transport === transport)
+            this.entries.delete(sessionId);
+    }
+    sweep() {
+        const now = this.limits.now();
+        for (const [id, entry] of this.entries) {
+            if (entry.openRequests === 0 && now - entry.lastActiveMs >= this.limits.idleTimeoutMs)
+                this.close(id);
+        }
+    }
+    async closeAll() {
+        const transports = Array.from(this.entries.values(), (entry) => entry.transport);
+        this.entries.clear();
+        await Promise.all(transports.map((transport) => closeTransport(transport)));
+    }
+    /** Forgotten at once, so the id answers 404 like any unknown session. */
+    close(sessionId) {
+        const entry = this.entries.get(sessionId);
+        if (!entry)
+            return;
+        this.entries.delete(sessionId);
+        void closeTransport(entry.transport);
+    }
+}
+function closeTransport(transport) {
+    return withTimeout(transport.close(), TRANSPORT_CLOSE_TIMEOUT_MS, "timed out closing HTTP MCP transport").catch(() => undefined);
+}
 export async function startHttpMcpServer(options) {
     const host = normalizeLoopbackHttpHost(options.host ?? "127.0.0.1");
     const token = options.token;
     const requestBodyLimitBytes = options.requestBodyLimitBytes ?? DEFAULT_REQUEST_BODY_LIMIT_BYTES;
-    const transports = new Map();
+    const sessionIdleTimeoutMs = Math.max(1, options.sessionIdleTimeoutMs ?? DEFAULT_SESSION_IDLE_TIMEOUT_MS);
+    const sessions = new HttpMcpSessions({
+        idleTimeoutMs: sessionIdleTimeoutMs,
+        maxSessions: Math.max(1, options.maxSessions ?? DEFAULT_MAX_SESSIONS),
+        now: options.now ?? Date.now
+    });
     const server = http.createServer(async (req, res) => {
         try {
             // Only the path and query are read, so the base is fixed: taking it from
@@ -41,11 +131,11 @@ export async function startHttpMcpServer(options) {
                 return;
             }
             if (req.method === "POST") {
-                await handlePost(req, res, transports, options.cwd, requestBodyLimitBytes, options.registerRoot);
+                await handlePost(req, res, sessions, options.cwd, requestBodyLimitBytes, options.registerRoot);
                 return;
             }
             if (req.method === "GET" || req.method === "DELETE") {
-                await handleSessionRequest(req, res, transports);
+                await handleSessionRequest(req, res, sessions);
                 return;
             }
             writeJson(res, 405, { error: "method_not_allowed" });
@@ -80,6 +170,9 @@ export async function startHttpMcpServer(options) {
             resolve();
         });
     });
+    // Unref'd: an idle sweep is no reason for the process to stay up.
+    const sweepTimer = setInterval(() => sessions.sweep(), Math.min(SESSION_SWEEP_INTERVAL_MAX_MS, sessionIdleTimeoutMs));
+    sweepTimer.unref();
     const address = server.address();
     const port = typeof address === "object" && address ? address.port : options.port ?? 8787;
     const url = `http://${host}:${port}`;
@@ -89,8 +182,8 @@ export async function startHttpMcpServer(options) {
         url,
         mcp_url: token ? `${url}/mcp?prodex_token=${encodeURIComponent(token)}` : `${url}/mcp`,
         close: async (closeOptions = {}) => {
-            await Promise.all(Array.from(transports.values()).map((entry) => withTimeout(entry.transport.close(), TRANSPORT_CLOSE_TIMEOUT_MS, "timed out closing HTTP MCP transport").catch(() => undefined)));
-            transports.clear();
+            clearInterval(sweepTimer);
+            await sessions.closeAll();
             await closeHttpServer(server, closeOptions);
         }
     };
@@ -140,16 +233,16 @@ async function withTimeout(promise, timeoutMs, message) {
             clearTimeout(timeout);
     }
 }
-async function handlePost(req, res, transports, cwd, requestBodyLimitBytes, registerRoot) {
+async function handlePost(req, res, sessions, cwd, requestBodyLimitBytes, registerRoot) {
     const body = await readJsonBody(req, requestBodyLimitBytes);
     const sessionId = headerValue(req.headers["mcp-session-id"]);
     if (sessionId) {
-        const entry = transports.get(sessionId);
-        if (!entry) {
+        const transport = sessions.use(sessionId, res);
+        if (!transport) {
             writeJson(res, 404, { error: "session_not_found" });
             return;
         }
-        await entry.transport.handleRequest(req, res, body);
+        await transport.handleRequest(req, res, body);
         return;
     }
     if (!sessionId && isInitializeRequest(body)) {
@@ -159,13 +252,13 @@ async function handlePost(req, res, transports, cwd, requestBodyLimitBytes, regi
             enableJsonResponse: true,
             onsessioninitialized: (newSessionId) => {
                 initializedSessionId = newSessionId;
-                transports.set(newSessionId, { transport });
+                sessions.add(newSessionId, transport);
             }
         });
         transport.onclose = () => {
             const id = transport.sessionId || initializedSessionId;
             if (id)
-                transports.delete(id);
+                sessions.remove(id, transport);
         };
         const mcpServer = createMcpServer(cwd, {
             source: "chatgpt_project",
@@ -182,17 +275,18 @@ async function handlePost(req, res, transports, cwd, requestBodyLimitBytes, regi
         id: null
     });
 }
-async function handleSessionRequest(req, res, transports) {
+async function handleSessionRequest(req, res, sessions) {
     const sessionId = headerValue(req.headers["mcp-session-id"]);
     if (!sessionId) {
         writeJson(res, 400, { error: "invalid_or_missing_session" });
         return;
     }
-    if (!transports.has(sessionId)) {
+    const transport = sessions.use(sessionId, res);
+    if (!transport) {
         writeJson(res, 404, { error: "session_not_found" });
         return;
     }
-    await transports.get(sessionId).transport.handleRequest(req, res);
+    await transport.handleRequest(req, res);
 }
 async function readJsonBody(req, limitBytes) {
     const contentLength = parseContentLength(req.headers["content-length"]);

package/dist/mcp.js

@@ -15,7 +15,17 @@ const BridgeFileInputSchema = z.object({
     role: z.enum(["context", "artifact", "result"]).optional(),
     bytes: z.number().int().nonnegative().optional()
 });
-export const DEFAULT_STDIO_MESSAGE_LIMIT_BYTES = 1_048_576;
+/**
+ * Large enough for the largest call the tools accept. That is
+ * bridge_block_task with every list full: 100 commands and 100 warnings of
+ * 100,000 characters, 100 artifact paths of 10,000 and its text fields, about
+ * 21.2 million characters. JSON may write each one as a six-byte \uXXXX escape
+ * (a control character is one byte to the handlers' byte checks), so the frame
+ * can reach 127.3 MB. The old 1 MiB closed the session on a 1,000,000-character
+ * repo_write_file_dry_run that had only its newlines escaped. The limit still
+ * caps what a client that never sends a newline can make this process buffer.
+ */
+export const DEFAULT_STDIO_MESSAGE_LIMIT_BYTES = 128 * 1024 * 1024;
 function asText(value) {
     return {
         content: [
@@ -144,7 +154,7 @@ export function createServer(cwd = process.cwd(), options = {}) {
         inputSchema: { query: McpBridgeTextSchema.min(1), glob: McpShortTextSchema.optional() }
     }, async (input) => asText(await handlers.repo_search(input)));
     server.registerTool("repo_write_file_dry_run", {
-        description: "Create a receipt-gated write preview for an existing repo-relative text file. Does not modify files. The file keeps its CRLF line endings and UTF-8 BOM when the new content leaves them out.",
+        description: "Create a receipt-gated write preview for an existing repo-relative text file. Does not modify files. The file keeps its CRLF line endings, UTF-8 BOM and final newline when the new content leaves them out, and keeps its file mode. A file that is not UTF-8 text is refused.",
         inputSchema: {
             path: McpShortTextSchema,
             content: z.string().max(1_000_000),
@@ -234,7 +244,9 @@ export function createServer(cwd = process.cwd(), options = {}) {
                         // Progress delivery must never break the consult.
                     });
                 };
-            return asText(withServerVersionNotice(await browserConsult({ ...input, session_key: input.session_key ?? mcpSessionKey }, onProgress), serverVersionNotice()));
+            // A client that cancels (Esc, its own timeout) aborts extra.signal.
+            // The consult stops on it until the prompt is submitted.
+            return asText(withServerVersionNotice(await browserConsult({ ...input, session_key: input.session_key ?? mcpSessionKey }, onProgress, extra.signal), serverVersionNotice()));
         });
     }
     const browserRecover = options.browserRecover;
@@ -250,9 +262,23 @@ export function createServer(cwd = process.cwd(), options = {}) {
     }
     return server;
 }
-export async function runMcpServer(cwd = process.cwd(), options = {}) {
+export async function runMcpServer(cwd = process.cwd(), options = {}, stdio = {}) {
     const server = createServer(cwd, options);
-    const transport = new LimitedStdioServerTransport();
+    const transport = new LimitedStdioServerTransport(process.stdin, process.stdout, stdio);
+    // Set before connect, which chains its own close handler after this one.
+    transport.onclose = () => {
+        const reason = transport.fatalInputError;
+        if (!reason)
+            return;
+        // The client is still waiting on its requests, and a closed transport
+        // answers none of them. Only the process exiting tells it the server is
+        // gone; without this it waited out its tool timeout (about 28 hours in
+        // Claude Code), or saw a clean exit 0, with nothing said either way.
+        process.exitCode = 1;
+        const exit = () => process.exit(1);
+        setTimeout(exit, 2_000);
+        process.stderr.write(`prodex mcp: ${reason.message}; closing the stdio session.\n`, exit);
+    };
     await server.connect(transport);
 }
 export class LimitedStdioServerTransport {
@@ -263,7 +289,13 @@ export class LimitedStdioServerTransport {
     onmessage;
     sessionId;
     setProtocolVersion;
-    buffer = Buffer.alloc(0);
+    /** Set when unreadable input closed the transport (an oversize message, a stdin error). */
+    fatalInputError;
+    // The unfinished message, as the chunks it arrived in. Joining each chunk
+    // onto one buffer and rescanning it for a newline made a large message cost
+    // time quadratic in its size.
+    pending = [];
+    pendingBytes = 0;
     started = false;
     closed = false;
     maxMessageBytes;
@@ -290,7 +322,8 @@ export class LimitedStdioServerTransport {
         if (this.stdin.listenerCount("data") === 0) {
             this.stdin.pause();
         }
-        this.buffer = Buffer.alloc(0);
+        this.pending = [];
+        this.pendingBytes = 0;
         this.onclose?.();
     }
     async send(message) {
@@ -328,50 +361,64 @@ export class LimitedStdioServerTransport {
     }
     onData = (chunk) => {
         try {
-            const buffer = Buffer.from(chunk);
-            this.buffer = this.buffer.length === 0 ? buffer : Buffer.concat([this.buffer, buffer]);
-            this.processBuffer();
+            this.processChunk(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
         }
         catch (error) {
-            this.buffer = Buffer.alloc(0);
-            this.onerror?.(error instanceof Error ? error : new Error(String(error)));
-            void this.close();
+            this.failInput(error instanceof Error ? error : new Error(String(error)));
         }
     };
     onInputError = (error) => {
+        this.failInput(error);
+    };
+    failInput(error) {
+        if (this.closed)
+            return;
+        this.fatalInputError = error;
         this.onerror?.(error);
         void this.close();
-    };
-    processBuffer() {
-        while (true) {
-            const newlineIndex = this.buffer.indexOf("\n");
+    }
+    processChunk(chunk) {
+        let start = 0;
+        while (!this.closed) {
+            const newlineIndex = chunk.indexOf(0x0a, start);
             if (newlineIndex === -1) {
-                if (this.buffer.length > this.maxMessageBytes) {
-                    throw new Error(`MCP stdio message is too large (${this.buffer.length} bytes > ${this.maxMessageBytes} bytes)`);
+                if (start < chunk.length) {
+                    this.pending.push(chunk.subarray(start));
+                    this.pendingBytes += chunk.length - start;
+                }
+                if (this.pendingBytes > this.maxMessageBytes) {
+                    throw new Error(`MCP stdio message is too large (at least ${this.pendingBytes} bytes, limit ${this.maxMessageBytes} bytes)`);
                 }
                 return;
             }
-            if (newlineIndex > this.maxMessageBytes) {
-                throw new Error(`MCP stdio message is too large (${newlineIndex} bytes > ${this.maxMessageBytes} bytes)`);
+            const lineBytes = this.pendingBytes + newlineIndex - start;
+            if (lineBytes > this.maxMessageBytes) {
+                throw new Error(`MCP stdio message is too large (${lineBytes} bytes, limit ${this.maxMessageBytes} bytes)`);
             }
-            const line = this.buffer.toString("utf8", 0, newlineIndex).replace(/\r$/, "");
-            this.buffer = this.buffer.subarray(newlineIndex + 1);
-            if (line.trim().length === 0)
-                continue;
-            let message;
-            try {
-                message = JSONRPCMessageSchema.parse(JSON.parse(line));
-            }
-            catch (error) {
-                // A single malformed frame is recoverable: report it and keep
-                // processing the rest of the buffer instead of tearing down the whole
-                // session (which would also drop any valid pipelined messages after
-                // it). This matches the SDK's StdioServerTransport. Only the oversize
-                // guards above stay fatal.
-                this.onerror?.(error instanceof Error ? error : new Error(String(error)));
-                continue;
-            }
-            this.onmessage?.(message);
+            const tail = chunk.subarray(start, newlineIndex);
+            const lineBuffer = this.pending.length === 0 ? tail : Buffer.concat([...this.pending, tail], lineBytes);
+            this.pending = [];
+            this.pendingBytes = 0;
+            start = newlineIndex + 1;
+            this.processLine(lineBuffer.toString("utf8").replace(/\r$/, ""));
+        }
+    }
+    processLine(line) {
+        if (line.trim().length === 0)
+            return;
+        let message;
+        try {
+            message = JSONRPCMessageSchema.parse(JSON.parse(line));
+        }
+        catch (error) {
+            // A single malformed frame is recoverable: report it and keep
+            // processing the rest of the buffer instead of tearing down the whole
+            // session (which would also drop any valid pipelined messages after
+            // it). This matches the SDK's StdioServerTransport. Only the oversize
+            // guards above stay fatal.
+            this.onerror?.(error instanceof Error ? error : new Error(String(error)));
+            return;
         }
+        this.onmessage?.(message);
     }
 }

package/dist/repo-write.js

@@ -4,7 +4,7 @@ import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { assertResolvedRepoPathAllowed, resolveRepoPath } from "./repo.js";
-import { readVerifiedUtf8File, replaceVerifiedUtf8File, withCrossProcessFileLock } from "./safe-file.js";
+import { NotUtf8Error, readVerifiedUtf8File, replaceVerifiedUtf8File, withCrossProcessFileLock } from "./safe-file.js";
 const execFileAsync = promisify(execFile);
 const MAX_WRITE_BYTES = 1_000_000;
 let testHooks = {};
@@ -17,12 +17,19 @@ export function setRepoWriteTestHooks(hooks) {
  * a UTF-8 BOM was dropped the same way. Keep what the file already uses, as an
  * editor does: CRLF only when the file uses it throughout and the new content
  * carries no CR of its own, and a BOM only when the new content has none.
+ *
+ * repo_read_file also returns its lines without a newline after the last one,
+ * so writing back what was read dropped the file's final newline (found
+ * 2026-11-09). A file that ends with one keeps it unless the new content is
+ * empty.
  */
 export function keepFileConventions(current, next) {
     let content = next;
     const crlf = current.includes("\r\n") && !/(^|[^\r])\n/.test(current);
     if (crlf && !content.includes("\r"))
         content = content.replace(/\n/g, "\r\n");
+    if (current.endsWith("\n") && content !== "" && !content.endsWith("\n"))
+        content += crlf ? "\r\n" : "\n";
     if (current.startsWith("\uFEFF") && !content.startsWith("\uFEFF"))
         content = `\uFEFF${content}`;
     return content;
@@ -34,6 +41,11 @@ export async function createRepoWriteDryRun(root, store, input) {
     }
     const current = await readWritableExistingFile(root, input.path);
     const content = keepFileConventions(current.content, input.content);
+    // Restoring CRLF and a BOM adds bytes, so the limit is checked again on what
+    // will be written: content that apply refuses used to pass the dry run.
+    if (Buffer.byteLength(content, "utf8") > MAX_WRITE_BYTES) {
+        throw new Error(`New content is too large to write through repo tools`);
+    }
     if (current.content === content) {
         throw new Error(`No changes for ${input.path}`);
     }
@@ -211,7 +223,10 @@ export async function stageReviewedPaths(root, store, input) {
     try {
         await testHooks.beforeGitAdd?.(stagedPaths);
         await assertGitHead(root, input.expected_head);
-        await execFileAsync("git", ["add", "--", ...stagedPaths], { cwd: root });
+        // Literal: read as pathspecs, a reviewed "pages/[id].tsx" also staged an
+        // unreviewed "pages/i.tsx" (found 2026-11-09). Every git call here that
+        // takes a reviewed path reads it literally.
+        await execFileAsync("git", ["--literal-pathspecs", "add", "--", ...stagedPaths], { cwd: root });
         staged = true;
         await verifyStagedContent(root, expectedObjectIdByPath);
         await testHooks.beforeStageReceipt?.(stagedPaths);
@@ -269,7 +284,7 @@ async function verifyStagedContent(root, expectedObjectIdByPath) {
     }
 }
 async function gitObjectIdForStagedPath(root, gitPath) {
-    const { stdout } = await execFileAsync("git", ["ls-files", "--stage", "-z", "--", gitPath], {
+    const { stdout } = await execFileAsync("git", ["--literal-pathspecs", "ls-files", "--stage", "-z", "--", gitPath], {
         cwd: root,
         maxBuffer: MAX_WRITE_BYTES + 1024
     });
@@ -283,7 +298,7 @@ async function gitObjectIdForStagedPath(root, gitPath) {
 async function readGitIndexEntries(root, paths) {
     const entries = new Map();
     for (const gitPath of paths) {
-        const { stdout } = await execFileAsync("git", ["ls-files", "--stage", "-z", "--", gitPath], {
+        const { stdout } = await execFileAsync("git", ["--literal-pathspecs", "ls-files", "--stage", "-z", "--", gitPath], {
             cwd: root,
             encoding: "buffer",
             maxBuffer: MAX_WRITE_BYTES + 1024
@@ -308,7 +323,7 @@ async function restoreGitIndexEntries(root, entries) {
             await execFileAsync("git", ["update-index", "--add", "--cacheinfo", entry.mode, entry.objectId, gitPath], { cwd: root });
         }
         else {
-            await execFileAsync("git", ["rm", "--cached", "--ignore-unmatch", "--", gitPath], { cwd: root });
+            await execFileAsync("git", ["--literal-pathspecs", "rm", "--cached", "--ignore-unmatch", "--", gitPath], { cwd: root });
         }
     }
 }
@@ -375,11 +390,15 @@ async function readWritableExistingFile(root, repoPath) {
     const resolved = resolveRepoPath(root, repoPath);
     await assertResolvedRepoPathAllowed(root, resolved, repoPath);
     const content = await readVerifiedUtf8File(resolved, () => assertResolvedRepoPathAllowed(root, resolved, repoPath), {
-        maxBytes: MAX_WRITE_BYTES
+        maxBytes: MAX_WRITE_BYTES,
+        requireUtf8: true
     }).catch((error) => {
         if (error instanceof Error && /too large/.test(error.message)) {
             throw new Error(`Path ${repoPath} is too large to write through repo tools`);
         }
+        if (error instanceof NotUtf8Error) {
+            throw new Error(`Path ${repoPath} is not UTF-8 text. Repo tools write UTF-8 only, so writing it would change its encoding; edit it with a tool that keeps its encoding.`);
+        }
         throw error;
     });
     return { resolved, content };

package/dist/repo.js

@@ -57,11 +57,16 @@ export function assertRepoRelativePath(repoPath) {
     }
     assertNotSensitiveRepoPath(normalized);
 }
+// "..notes.md" is a file in the root; only ".." itself or a path through it
+// leaves it.
+function escapesRoot(relative) {
+    return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
 export function resolveRepoPath(root, repoPath) {
     assertRepoRelativePath(repoPath);
     const resolved = path.resolve(root, repoPath);
     const relative = path.relative(root, resolved);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    if (escapesRoot(relative)) {
         throw new Error(`Path ${repoPath} escapes the repository root`);
     }
     return resolved;
@@ -103,6 +108,9 @@ export async function searchRepoWithMetadata(root, query, glob) {
     if (!query.trim()) {
         throw new Error("Search query must not be empty");
     }
+    if (/[\r\n]/.test(query)) {
+        throw new Error("repo_search matches one line at a time, so a query cannot contain a line break; search for one of its lines.");
+    }
     if (glob) {
         assertRepoRelativeGlob(glob);
     }
@@ -110,12 +118,20 @@ export async function searchRepoWithMetadata(root, query, glob) {
         "--no-config",
         "--no-follow",
         "--json",
+        // repo_read_file reads .github/, .eslintrc and the like, and without this
+        // ripgrep skipped every hidden file. Results still pass the same path
+        // policy as reads, and the globs below keep the sensitive ones unopened.
+        "--hidden",
         ...(glob ? ["--glob", glob] : []),
         "--glob",
         "!.bridge/**",
         "--glob",
         "!**/.bridge/**",
         "--glob",
+        "!.git",
+        "--glob",
+        "!**/.git",
+        "--glob",
         "!.git/**",
         "--glob",
         "!**/.git/**",
@@ -154,23 +170,7 @@ export async function searchRepoWithMetadata(root, query, glob) {
             timeout: 10_000,
             maxBuffer: 1024 * 1024
         });
-        const parsedMatches = stdout
-            .split("\n")
-            .filter(Boolean)
-            .map(parseRipgrepJsonMatch)
-            .filter((match) => match !== undefined);
-        const allowedMatches = [];
-        let truncated = false;
-        for (const match of parsedMatches) {
-            if (await isAllowedRepoSearchResult(root, match.path)) {
-                if (allowedMatches.length >= MAX_REPO_SEARCH_MATCHES) {
-                    truncated = true;
-                    break;
-                }
-                allowedMatches.push(match);
-            }
-        }
-        return { matches: allowedMatches, truncated, limit: MAX_REPO_SEARCH_MATCHES };
+        return await allowedSearchResult(root, stdout, false);
     }
     catch (error) {
         const maybe = error;
@@ -178,10 +178,23 @@ export async function searchRepoWithMetadata(root, query, glob) {
             throw new Error("ripgrep (rg) is required on PATH for repo_search");
         }
         if (isSearchOutputTooLarge(error)) {
+            // A broad query outgrew the buffer: return the matches read so far,
+            // marked truncated, rather than none.
+            const partial = await allowedSearchResult(root, maybe.stdout ?? "", true);
+            if (partial.matches.length > 0)
+                return partial;
             throw new Error("repo_search returned too many matches; narrow the query or glob and try again");
         }
         if (maybe.code === 1)
             return { matches: [], truncated: false, limit: MAX_REPO_SEARCH_MATCHES };
+        // ripgrep exits 2 when it could not read some path (a directory it may
+        // not enter, say) but still prints what it found elsewhere; that used to
+        // fail the whole search with the raw command line.
+        if (maybe.code === 2 && !ripgrepRegexError(error.stderr)) {
+            const partial = await allowedSearchResult(root, maybe.stdout ?? "", false);
+            if (partial.matches.length > 0)
+                return partial;
+        }
         // An invalid pattern used to surface as "Command failed: <rg path> ..."
         // with rg's parse error buried in it (measured 2026-10-21, query "(").
         const reason = ripgrepRegexError(error.stderr);
@@ -191,6 +204,24 @@ export async function searchRepoWithMetadata(root, query, glob) {
         throw error;
     }
 }
+async function allowedSearchResult(root, stdout, truncated) {
+    const parsedMatches = stdout
+        .split("\n")
+        .filter(Boolean)
+        .map(parseRipgrepJsonMatch)
+        .filter((match) => match !== undefined);
+    const allowedMatches = [];
+    for (const match of parsedMatches) {
+        if (await isAllowedRepoSearchResult(root, match.path)) {
+            if (allowedMatches.length >= MAX_REPO_SEARCH_MATCHES) {
+                truncated = true;
+                break;
+            }
+            allowedMatches.push(match);
+        }
+    }
+    return { matches: allowedMatches, truncated, limit: MAX_REPO_SEARCH_MATCHES };
+}
 function ripgrepRegexError(stderr) {
     if (!stderr || !/regex parse error/i.test(stderr))
         return undefined;
@@ -208,11 +239,17 @@ function parseRipgrepJsonMatch(line) {
     if (!isRipgrepJsonMatch(event))
         return undefined;
     return {
-        path: normalizeRipgrepMatchPath(event.data.path.text),
+        path: normalizeRipgrepMatchPath(ripgrepText(event.data.path)),
         line: event.data.line_number,
-        text: stripOneTrailingLineEnding(event.data.lines.text)
+        text: stripOneTrailingLineEnding(ripgrepText(event.data.lines))
     };
 }
+function ripgrepText(value) {
+    return "text" in value ? value.text : Buffer.from(value.bytes, "base64").toString("utf8");
+}
+function isRipgrepJsonText(value) {
+    return isRecord(value) && (typeof value.text === "string" || typeof value.bytes === "string");
+}
 function normalizeRipgrepMatchPath(matchPath) {
     return matchPath.split(path.sep).join("/").replace(/^\.\//, "");
 }
@@ -220,12 +257,7 @@ function isRipgrepJsonMatch(value) {
     if (!isRecord(value) || value.type !== "match" || !isRecord(value.data))
         return false;
     const { path: matchPath, line_number: lineNumber, lines } = value.data;
-    return (isRecord(matchPath) &&
-        typeof matchPath.text === "string" &&
-        typeof lineNumber === "number" &&
-        Number.isFinite(lineNumber) &&
-        isRecord(lines) &&
-        typeof lines.text === "string");
+    return isRipgrepJsonText(matchPath) && typeof lineNumber === "number" && Number.isFinite(lineNumber) && isRipgrepJsonText(lines);
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null;
@@ -494,7 +526,7 @@ export async function assertResolvedRepoPathAllowed(root, resolved, repoPath) {
         throw error;
     }
     const relative = path.relative(realRoot, realTarget);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    if (escapesRoot(relative)) {
         throw new Error(`Path ${repoPath} escapes the repository root after resolving symlinks`);
     }
     if (relative) {