@zerwiz/ymir 0.1.33 → 0.1.35

package/apps/sessrumnir/src/main/process-tree.test.ts

@@ -0,0 +1,94 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn, spawnSync } from 'child_process'
+import { PiRpcManager } from './pi-rpc-manager'
+
+/**
+ * OMP puts each subagent it spawns in a new process group, so the negative-PID
+ * signal the manager sends only reaches the agent itself. Observed live: the
+ * app exited, its own OMP died, and two `hub` subagents kept running against
+ * the API. Reaping needs the tree captured before the parent is signalled,
+ * because re-parenting to init erases the link the moment it dies.
+ */
+
+const IS_WINDOWS = process.platform === 'win32'
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function settle(ms: number): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/** Reach the private walker without widening the class's public surface. */
+function walk(manager: PiRpcManager, root: number): number[] {
+  return (manager as unknown as { descendantPids: (pid: number) => number[] }).descendantPids(root)
+}
+
+test('a grandchild in its own process group is still found', { skip: IS_WINDOWS }, async () => {
+  // Parent sleeps; child detaches into a NEW group, exactly like an OMP
+  // subagent. setsid is what makes the group signal miss it.
+  const parent = spawn('sh', ['-c', 'setsid sleep 30 & sleep 30'], { detached: true, stdio: 'ignore' })
+  try {
+    assert.ok(parent.pid, 'parent must have a pid')
+    await settle(400)
+
+    const found = walk(new PiRpcManager(), parent.pid!)
+    assert.ok(found.length > 0, 'the walk must see the descendants')
+
+    // A plain group kill leaves the detached grandchild behind. That is the bug.
+    const escaped = found.filter((pid) => {
+      const sid = spawnSync('ps', ['-o', 'sid=', '-p', String(pid)], { encoding: 'utf-8' })
+      return sid.status === 0 && sid.stdout.trim() !== '' && Number(sid.stdout.trim()) !== parent.pid
+    })
+    assert.ok(escaped.length > 0, 'at least one descendant must have escaped the parent group')
+  } finally {
+    try { process.kill(-parent.pid!, 'SIGKILL') } catch { /* gone */ }
+    for (const pid of walk(new PiRpcManager(), parent.pid ?? 0)) {
+      try { process.kill(pid, 'SIGKILL') } catch { /* gone */ }
+    }
+  }
+})
+
+test('an escaped descendant is signalled directly and dies', { skip: IS_WINDOWS }, async () => {
+  const parent = spawn('sh', ['-c', 'setsid sleep 30 & sleep 30'], { detached: true, stdio: 'ignore' })
+  assert.ok(parent.pid, 'parent must have a pid')
+  await settle(400)
+
+  const strays = walk(new PiRpcManager(), parent.pid!)
+  assert.ok(strays.length > 0)
+
+  try { process.kill(-parent.pid!, 'SIGTERM') } catch { /* gone */ }
+  for (const pid of strays) {
+    try { process.kill(pid, 'SIGTERM') } catch { /* gone */ }
+  }
+  await settle(600)
+
+  for (const pid of strays) {
+    assert.equal(alive(pid), false, `descendant ${pid} must not survive the kill`)
+  }
+  assert.equal(alive(parent.pid!), false, 'the agent itself must not survive either')
+})
+
+test('a childless process yields no descendants', { skip: IS_WINDOWS }, async () => {
+  // Not process.pid: the walker shells out to `ps`, so its own transient child
+  // shows up under the test runner. An agent pid never parents that call.
+  const lonely = spawn('sleep', ['30'], { detached: true, stdio: 'ignore' })
+  try {
+    assert.ok(lonely.pid)
+    await settle(300)
+    assert.deepEqual(walk(new PiRpcManager(), lonely.pid!), [])
+  } finally {
+    try { process.kill(-lonely.pid!, 'SIGKILL') } catch { /* gone */ }
+  }
+})
+
+test('the walk terminates on an unknown pid', { skip: IS_WINDOWS }, () => {
+  assert.deepEqual(walk(new PiRpcManager(), 999_999_999), [])
+})

package/apps/sessrumnir/src/main/renderer-origin.test.ts

@@ -0,0 +1,33 @@
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { isTrustedRendererUrl } from './renderer-origin'
+
+const INDEX = '/opt/app/resources/renderer/index.html'
+
+test('dev: accepts the dev server origin (any path/hash)', () => {
+  const opts = { devServerUrl: 'http://localhost:5173', rendererIndexPath: INDEX }
+  assert.equal(isTrustedRendererUrl('http://localhost:5173/', opts), true)
+  assert.equal(isTrustedRendererUrl('http://localhost:5173/#/chat', opts), true)
+})
+
+test('dev: rejects a look-alike host that only shares a prefix', () => {
+  const opts = { devServerUrl: 'http://localhost:5173', rendererIndexPath: INDEX }
+  assert.equal(isTrustedRendererUrl('http://localhost:5173.evil.com/', opts), false)
+  assert.equal(isTrustedRendererUrl('http://evil.com/localhost:5173', opts), false)
+})
+
+test('prod: accepts the packaged index file, ignoring hash routing', () => {
+  const opts = { rendererIndexPath: INDEX }
+  assert.equal(isTrustedRendererUrl('file:///opt/app/resources/renderer/index.html', opts), true)
+  assert.equal(isTrustedRendererUrl('file:///opt/app/resources/renderer/index.html#/settings', opts), true)
+})
+
+test('prod: rejects any other local file', () => {
+  const opts = { rendererIndexPath: INDEX }
+  assert.equal(isTrustedRendererUrl('file:///opt/app/resources/renderer/evil.html', opts), false)
+  assert.equal(isTrustedRendererUrl('file:///etc/passwd', opts), false)
+})
+
+test('rejects unparseable input', () => {
+  assert.equal(isTrustedRendererUrl('not a url', { rendererIndexPath: INDEX }), false)
+})

package/apps/sessrumnir/src/main/renderer-origin.ts

@@ -0,0 +1,35 @@
+import { join } from 'path'
+import { pathToFileURL } from 'url'
+
+/**
+ * The only file the main window is allowed to load/navigate to in production,
+ * and the only frame URL that privileged IPC accepts as a sender. Its preload
+ * exposes terminal + full IPC, so this must stay pinned to the packaged renderer.
+ */
+export const RENDERER_INDEX_PATH = join(__dirname, '../renderer/index.html')
+
+/**
+ * True when `frameUrl` belongs to the app's own renderer: the dev server's exact
+ * origin in development, or the packaged index file (ignoring hash/query used by
+ * client-side routing) in production. Parses the URL so a look-alike host or a
+ * sibling local file cannot pass a naive string-prefix check.
+ */
+export function isTrustedRendererUrl(
+  frameUrl: string,
+  opts: { devServerUrl?: string; rendererIndexPath: string }
+): boolean {
+  let parsed: URL
+  try {
+    parsed = new URL(frameUrl)
+  } catch {
+    return false
+  }
+  if (opts.devServerUrl) {
+    try {
+      return parsed.origin === new URL(opts.devServerUrl).origin
+    } catch {
+      return false
+    }
+  }
+  return parsed.protocol === 'file:' && parsed.pathname === pathToFileURL(opts.rendererIndexPath).pathname
+}

package/apps/sessrumnir/src/main/session-lineage-reader.test.ts

@@ -0,0 +1,317 @@
+import assert from 'node:assert/strict'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { MAX_PREVIEW_SCAN_BYTES, clearSessionMetadataCache } from './session-metadata'
+import { readSessionLineage } from './session-lineage-reader'
+
+// ─── Fixture builders ────────────────────────────────────────────────────────
+
+const headerLine = (over: Record<string, unknown> = {}): string =>
+  JSON.stringify({
+    type: 'session',
+    version: 3,
+    id: '019f9166-642a-7905-ae5a-f4dbbc6baadb',
+    timestamp: '2026-07-23T23:53:54.474Z',
+    cwd: '/home/u/proj',
+    ...over,
+  })
+
+const userLine = (text: string): string =>
+  JSON.stringify({
+    type: 'message',
+    id: 'm1',
+    parentId: 'p0',
+    timestamp: '2026-07-23T23:54:00.000Z',
+    message: { role: 'user', content: [{ type: 'text', text }], timestamp: 1 },
+  })
+
+const assistantLine = (text: string): string =>
+  JSON.stringify({
+    type: 'message',
+    id: 'm2',
+    parentId: 'm1',
+    message: { role: 'assistant', content: [{ type: 'text', text }] },
+  })
+
+const sessionInfoLine = (name: string): string =>
+  JSON.stringify({ type: 'session_info', id: 'i1', parentId: 'm1', name })
+
+interface SessionSpec {
+  /** Path relative to the sessions root, e.g. `proj-a/2026-…_aaa.jsonl`. */
+  file: string
+  lines: string[]
+}
+
+async function withSessionStore<T>(
+  specs: SessionSpec[],
+  fn: (root: string) => Promise<T>,
+  extraDirs: string[] = []
+): Promise<T> {
+  const root = await mkdtemp(join(tmpdir(), 'pi-lineage-'))
+  try {
+    for (const dir of extraDirs) {
+      await mkdir(join(root, dir), { recursive: true })
+    }
+    for (const spec of specs) {
+      const full = join(root, spec.file)
+      await mkdir(join(full, '..'), { recursive: true })
+      await writeFile(full, `${spec.lines.join('\n')}\n`, 'utf-8')
+    }
+    clearSessionMetadataCache()
+    return await fn(root)
+  } finally {
+    clearSessionMetadataCache()
+    await rm(root, { recursive: true, force: true })
+  }
+}
+
+// ─── The issue #47 regressions ───────────────────────────────────────────────
+
+test('labels a session by its first user message, not its Windows cwd', async () => {
+  // Regression: the label was `header.cwd.split('/').pop()`. A win32 cwd has no
+  // forward slash, so split returns one element and the whole path was rendered.
+  const WIN_CWD = 'C:\\Users\\night\\Downloads\\pi'
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine({ cwd: WIN_CWD }), userLine('Refactor auth module login logic')],
+      },
+    ],
+    async (root) => {
+      const [record] = await readSessionLineage(root)
+      assert.equal(record.preview, 'Refactor auth module login logic')
+      assert.notEqual(record.name, WIN_CWD)
+      assert.notEqual(record.preview, WIN_CWD)
+    }
+  )
+})
+
+test('does not label POSIX sessions with the shared cwd basename', async () => {
+  // Every session in one project dir used to render the identical label.
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine({ cwd: '/home/u/pi-desktop-gui' }), userLine('First topic')],
+      },
+      {
+        file: join('proj-a', '2026-07-24T09-00-00-000Z_bbb.jsonl'),
+        lines: [headerLine({ cwd: '/home/u/pi-desktop-gui' }), userLine('Second topic')],
+      },
+    ],
+    async (root) => {
+      const records = await readSessionLineage(root)
+      const previews = records.map((r) => r.preview).sort()
+      assert.deepEqual(previews, ['First topic', 'Second topic'])
+      assert.ok(!records.some((r) => r.name === 'pi-desktop-gui'))
+    }
+  )
+})
+
+test('prefers an explicit session name over the message preview', async () => {
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('Refactor auth'), sessionInfoLine('debug token refresh')],
+      },
+    ],
+    async (root) => {
+      const [record] = await readSessionLineage(root)
+      assert.equal(record.name, 'debug token refresh')
+      assert.equal(record.preview, 'Refactor auth')
+    }
+  )
+})
+
+test('reports no name for an unnamed session', async () => {
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('Refactor auth')],
+      },
+    ],
+    async (root) => {
+      assert.equal((await readSessionLineage(root))[0].name, null)
+    }
+  )
+})
+
+// ─── Identity and linking ────────────────────────────────────────────────────
+
+test('identifies a session by its filename stem, not the header uuid', async () => {
+  // The renderer's title fallback formats the timestamp out of the stem; a bare
+  // header uuid would degrade to a 12-char slice instead.
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine({ id: 'deadbeef-0000' }), userLine('hi')],
+      },
+    ],
+    async (root) => {
+      assert.equal((await readSessionLineage(root))[0].sessionId, '2026-07-23T23-53-54-474Z_aaa')
+    }
+  )
+})
+
+test('links a child to its parent through an absolute parentSession path', async () => {
+  // Built without the helper: the child's parentSession must hold the parent's
+  // real absolute path, which is only known after the temp root exists.
+  const root = await mkdtemp(join(tmpdir(), 'pi-lineage-'))
+  try {
+    const dir = join(root, 'proj-a')
+    await mkdir(dir, { recursive: true })
+    const parentPath = join(dir, '2026-07-23T23-53-54-474Z_aaa.jsonl')
+    const childPath = join(dir, '2026-07-24T09-00-00-000Z_bbb.jsonl')
+    await writeFile(parentPath, `${headerLine()}\n${userLine('parent topic')}\n`, 'utf-8')
+    await writeFile(
+      childPath,
+      `${headerLine({ parentSession: parentPath })}\n${userLine('child topic')}\n`,
+      'utf-8'
+    )
+    clearSessionMetadataCache()
+
+    const records = await readSessionLineage(root)
+    const child = records.find((r) => r.preview === 'child topic')!
+    const parent = records.find((r) => r.preview === 'parent topic')!
+    assert.equal(child.parentPath, parentPath)
+    assert.equal(parent.parentPath, null)
+    assert.equal(child.path, childPath)
+  } finally {
+    clearSessionMetadataCache()
+    await rm(root, { recursive: true, force: true })
+  }
+})
+
+// ─── Walk shape ──────────────────────────────────────────────────────────────
+
+test('skips a file whose first line is not a session header', async () => {
+  await withSessionStore(
+    [
+      { file: join('proj-a', 'not-a-session.jsonl'), lines: [userLine('orphan')] },
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('real session')],
+      },
+    ],
+    async (root) => {
+      const records = await readSessionLineage(root)
+      assert.equal(records.length, 1)
+      assert.equal(records[0].preview, 'real session')
+    }
+  )
+})
+
+test('does not descend into nested subagent directories', async () => {
+  // Listing deliberately indexes parent sessions only; lineage must match, or a
+  // Timeline mount would flood with ephemeral subagent runs.
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('parent session')],
+      },
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa', 'subagent-run.jsonl'),
+        lines: [headerLine({ id: 'nested' }), userLine('subagent run')],
+      },
+    ],
+    async (root) => {
+      const records = await readSessionLineage(root)
+      assert.equal(records.length, 1)
+      assert.equal(records[0].preview, 'parent session')
+    }
+  )
+})
+
+// Contract test, not a guard test: dropping the `isFile()` check is absorbed by
+// the reader's error handling (opening a directory throws EISDIR and the record is
+// filtered), so this pins the observable behavior rather than the implementation.
+test('ignores a directory whose name ends in .jsonl', async () => {
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('real session')],
+      },
+    ],
+    async (root) => {
+      const records = await readSessionLineage(root)
+      assert.equal(records.length, 1)
+      assert.equal(records[0].preview, 'real session')
+    },
+    [join('proj-a', 'trap.jsonl')]
+  )
+})
+
+test('ignores loose files at the sessions root', async () => {
+  await withSessionStore(
+    [
+      { file: 'stray.jsonl', lines: [headerLine(), userLine('stray')] },
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('real session')],
+      },
+    ],
+    async (root) => {
+      const records = await readSessionLineage(root)
+      assert.equal(records.length, 1)
+      assert.equal(records[0].preview, 'real session')
+    }
+  )
+})
+
+test('returns no records when the sessions root does not exist', async () => {
+  assert.deepEqual(await readSessionLineage('/no/such/sessions/root'), [])
+})
+
+test('reads every project directory', async () => {
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), userLine('from a')],
+      },
+      {
+        file: join('proj-b', '2026-07-24T09-00-00-000Z_bbb.jsonl'),
+        lines: [headerLine(), userLine('from b')],
+      },
+      {
+        file: join('proj-c', '2026-07-25T09-00-00-000Z_ccc.jsonl'),
+        lines: [headerLine(), userLine('from c')],
+      },
+    ],
+    async (root) => {
+      const previews = (await readSessionLineage(root)).map((r) => r.preview).sort()
+      assert.deepEqual(previews, ['from a', 'from b', 'from c'])
+    }
+  )
+})
+
+// ─── Bounded I/O ─────────────────────────────────────────────────────────────
+
+test('stays within the scan budget on a session larger than the budget', async () => {
+  // The old reader called readFile on the whole file to consume one line. A
+  // bounded reader gives up on a message parked past the budget and still
+  // returns the header-derived record — an unbounded one would find the message.
+  const filler = assistantLine('x'.repeat(64 * 1024))
+  const fillerCount = Math.ceil(MAX_PREVIEW_SCAN_BYTES / filler.length) + 2
+  await withSessionStore(
+    [
+      {
+        file: join('proj-a', '2026-07-23T23-53-54-474Z_aaa.jsonl'),
+        lines: [headerLine(), ...Array.from({ length: fillerCount }, () => filler), userLine('far away')],
+      },
+    ],
+    async (root) => {
+      const [record] = await readSessionLineage(root)
+      assert.equal(record.sessionId, '2026-07-23T23-53-54-474Z_aaa')
+      assert.equal(record.preview, null)
+    }
+  )
+})

package/apps/sessrumnir/src/main/session-lineage-reader.ts

@@ -0,0 +1,111 @@
+import { readdir, stat } from 'fs/promises'
+import { basename, join } from 'path'
+import type { SessionLineageRecord } from '../shared/session-lineage'
+import { mapWithConcurrency } from './map-concurrent'
+import { getSessionsRoot } from './pi-paths'
+import { JSONL_EXTENSION } from './session-paths'
+import { readSessionMetadataCached } from './session-metadata'
+
+/**
+ * Reads every parent session's lineage link and label out of the Pi session store.
+ *
+ * The Timeline needs one record per session to resolve fork parents, so this walk
+ * touches the whole store. It previously `readFile`d each session in full to
+ * consume a single header line — on a real store that is ~9 MB of I/O to extract
+ * ~2 KB, serially, with no cache, on every Timeline mount. Now each file gets a
+ * bounded read, files are read concurrently, and results are mtime-cached.
+ */
+
+/** Session files read at once. Matches the session-list reader's pool. */
+const LINEAGE_READ_CONCURRENCY = 24
+/**
+ * Runaway guard. A store this large means the Timeline is unusable anyway, and an
+ * unbounded walk would pin main; capping cannot be done by recency because every
+ * header must be read to discover which sessions are parents. Truncating orphans
+ * any child whose parent was cut — it renders as a root — so the cap is logged
+ * rather than applied silently.
+ */
+const MAX_LINEAGE_SESSIONS = 2000
+
+/**
+ * Collect lineage records for parent sessions only.
+ *
+ * Layout under the Pi session store:
+ *   sessions/<sanitized-project>/<timestamp>_<id>.jsonl     ← parent (read these)
+ *   sessions/<sanitized-project>/<timestamp>_<id>/<child>…  ← subagent runs
+ *
+ * The depth-2 restriction is deliberate and matches the session list: extensions
+ * like pi-subagents nest ephemeral runs under the parent's folder, and surfacing
+ * them would flood the tree.
+ *
+ * `sessionsRoot` is injectable so the walk can be tested without the real store.
+ */
+export async function readSessionLineage(
+  sessionsRoot: string = getSessionsRoot()
+): Promise<SessionLineageRecord[]> {
+  const files = await collectSessionFilePaths(sessionsRoot)
+
+  const records = await mapWithConcurrency(files, LINEAGE_READ_CONCURRENCY, readRecord)
+  return records.filter((record): record is SessionLineageRecord => record !== null)
+}
+
+/** Absolute paths of every parent session file, capped. */
+async function collectSessionFilePaths(sessionsRoot: string): Promise<string[]> {
+  let projectDirs: string[]
+  try {
+    const entries = await readdir(sessionsRoot, { withFileTypes: true })
+    projectDirs = entries.filter((e) => e.isDirectory()).map((e) => e.name)
+  } catch {
+    // Store missing or unreadable — the Timeline renders empty.
+    return []
+  }
+
+  const files: string[] = []
+  for (const dirName of projectDirs) {
+    const projectDir = join(sessionsRoot, dirName)
+    let items
+    try {
+      items = await readdir(projectDir, { withFileTypes: true })
+    } catch {
+      continue
+    }
+    for (const item of items) {
+      // Parent sessions only: skip subagent nests, and skip a *directory* that
+      // happens to end in .jsonl (which would otherwise be read as a file).
+      if (!item.isFile() || !item.name.endsWith(JSONL_EXTENSION)) continue
+      files.push(join(projectDir, item.name))
+      if (files.length >= MAX_LINEAGE_SESSIONS) {
+        console.warn(
+          `[lineage] Session store exceeds ${MAX_LINEAGE_SESSIONS} sessions; ` +
+            'the timeline is truncated and some forks will render as roots.'
+        )
+        return files
+      }
+    }
+  }
+  return files
+}
+
+/** One lineage record, or null when the file is not a readable session. */
+async function readRecord(filePath: string): Promise<SessionLineageRecord | null> {
+  let mtimeMs: number
+  try {
+    mtimeMs = (await stat(filePath)).mtimeMs
+  } catch {
+    return null
+  }
+
+  const { header, name, preview } = await readSessionMetadataCached(filePath, mtimeMs)
+  // No session header means this is not a Pi session file.
+  if (!header) return null
+
+  return {
+    // The filename stem, not the header uuid: it carries the creation timestamp
+    // the renderer formats when a session has neither a name nor a preview.
+    sessionId: basename(filePath, JSONL_EXTENSION),
+    path: filePath,
+    name,
+    preview,
+    parentPath: header.parentSession,
+  }
+}