autodev-cli 1.4.32 → 1.4.34

package/out/webSocketPoller.js

@@ -44,6 +44,8 @@ const rdp_1 = require("./rdp");
 const messageBuilder_1 = require("./messageBuilder");
 const todo_1 = require("./todo");
 const todoWriteManager_1 = require("./todoWriteManager");
+const commands_1 = require("./core/commands");
+const pathSafe_1 = require("./core/pathSafe");
 const gitService = __importStar(require("./git/gitService"));
 // ---------------------------------------------------------------------------
 // WebSocketPoller — persistent WS connection for ws:// / wss:// endpoints
@@ -439,293 +441,331 @@ class WebSocketPoller {
             return;
         }
         const msgType = msg['type'];
-        // ── VNC frames from pixel-office ─────────────────────────────────────────
-        // ── MCP update from pixel-office ─────────────────────────────────────────
-        if (msgType === 'mcp_update') {
-            const entries = msg['mcpServers'];
-            if (entries && typeof entries === 'object') {
-                this._onMcpUpdate?.(entries);
-            }
-            return;
-        }
-        // ── Export / restore requests from pixel-office ───────────────────────────
-        if (msgType === 'export_request') {
-            const agentId = msg['agentId'];
-            if (agentId) {
-                this._onExportRequest?.(agentId);
-            }
+        // Server app-level heartbeat: reply with a JSON pong so the server's
+        // liveness sweep counts this (primary, task-carrying) connection as alive,
+        // mirroring OfficeSocket. Without this the workhorse connection can be swept
+        // as stale even while the WS-protocol ping/pong keeps flowing.
+        if (msgType === 'ping') {
+            this._sendTextFrame(JSON.stringify({ type: 'pong' }));
+            this._lastPongAt = Date.now();
             return;
         }
-        if (msgType === 'restore_request') {
-            const agentId = msg['agentId'];
-            const downloadUrl = msg['downloadUrl'];
-            if (agentId && downloadUrl) {
-                this._onRestoreRequest?.(agentId, downloadUrl);
+        // Isolate all downstream frame dispatch: a single throwing frame (malformed
+        // payload, ENOSPC/EACCES while saving an attachment, a containment-guard
+        // throw) must never propagate out of the socket 'data' handler and crash the
+        // whole agent process. Log and drop the frame instead of going offline.
+        try {
+            // ── VNC frames from pixel-office ─────────────────────────────────────────
+            // ── MCP update from pixel-office ─────────────────────────────────────────
+            if (msgType === 'mcp_update') {
+                const entries = msg['mcpServers'];
+                if (entries && typeof entries === 'object') {
+                    this._onMcpUpdate?.(entries);
+                }
+                return;
             }
-            return;
-        }
-        if (msgType === 'export_config') {
-            const exportEnabled = !!msg['exportEnabled'];
-            const exportDailyBackup = !!msg['exportDailyBackup'];
-            const agentId = msg['agentId'] ?? '';
-            this._onExportConfig?.(exportEnabled, exportDailyBackup, agentId);
-            return;
-        }
-        // ── File browser requests from server ─────────────────────────────────────
-        if (msgType === 'fb_request') {
-            const requestId = msg['requestId'];
-            const action = msg['action'];
-            const relPath = msg['path'] ?? '';
-            const content = msg['content'];
-            const newPath = msg['newPath'];
-            const query = msg['query'];
-            if (requestId && action) {
-                this._handleFbRequest(requestId, action, relPath, content, newPath, query);
+            // ── Export / restore requests from pixel-office ───────────────────────────
+            if (msgType === 'export_request') {
+                const agentId = msg['agentId'];
+                if (agentId) {
+                    this._onExportRequest?.(agentId);
+                }
+                return;
             }
-            return;
-        }
-        if (msgType === 'git_request') {
-            const requestId = msg['requestId'];
-            const action = msg['action'];
-            if (requestId && action) {
-                this._handleGitRequest(requestId, action, msg['path'], msg['staged'], msg['message'], msg['branch'], msg['hash']);
+            if (msgType === 'restore_request') {
+                const agentId = msg['agentId'];
+                const downloadUrl = msg['downloadUrl'];
+                if (agentId && downloadUrl) {
+                    this._onRestoreRequest?.(agentId, downloadUrl);
+                }
+                return;
             }
-            return;
-        }
-        if (msgType === 'vnc_session') {
-            if (!this._vncEnabled) {
-                this._log('vnc_session ignored — VNC not enabled');
+            if (msgType === 'export_config') {
+                const exportEnabled = !!msg['exportEnabled'];
+                const exportDailyBackup = !!msg['exportDailyBackup'];
+                const agentId = msg['agentId'] ?? '';
+                this._onExportConfig?.(exportEnabled, exportDailyBackup, agentId);
                 return;
             }
-            const action = msg['action'];
-            if (action === 'start') {
-                const sessionId = msg['sessionId'];
-                const port = Number(msg['port'] ?? 5900);
-                // Prefer password from server frame; fall back to locally-configured password
-                const password = msg['password'] || this._vncPassword;
-                this._log(`VNC session start: ${sessionId} → port ${port}`);
-                const session = new vnc_1.VncSession(sessionId, (frame) => this.sendFrame(frame));
-                this._vncSessions.set(sessionId, session);
-                session.start(port, password).catch((err) => {
-                    this._log(`VNC session ${sessionId} failed to start: ${err.message}`);
-                    this._vncSessions.delete(sessionId);
-                    this.sendFrame({ type: 'vnc_close', sessionId, reason: err.message });
-                });
+            // ── File browser requests from server ─────────────────────────────────────
+            if (msgType === 'fb_request') {
+                const requestId = msg['requestId'];
+                const action = msg['action'];
+                const relPath = msg['path'] ?? '';
+                const content = msg['content'];
+                const newPath = msg['newPath'];
+                const query = msg['query'];
+                if (requestId && action) {
+                    this._handleFbRequest(requestId, action, relPath, content, newPath, query);
+                }
+                return;
             }
-            return;
-        }
-        if (msgType === 'vnc_input') {
-            const sessionId = msg['sessionId'];
-            const event = msg['event'];
-            if (sessionId && event) {
-                this._vncSessions.get(sessionId)?.handleInput(event);
+            if (msgType === 'git_request') {
+                const requestId = msg['requestId'];
+                const action = msg['action'];
+                if (requestId && action) {
+                    this._handleGitRequest(requestId, action, msg['path'], msg['staged'], msg['message'], msg['branch'], msg['hash']);
+                }
+                return;
             }
-            return;
-        }
-        if (msgType === 'vnc_close') {
-            const sessionId = msg['sessionId'];
-            if (sessionId) {
-                this._log(`VNC session closed: ${sessionId}`);
-                this._vncSessions.get(sessionId)?.stop();
-                this._vncSessions.delete(sessionId);
+            if (msgType === 'vnc_session') {
+                if (!this._vncEnabled) {
+                    this._log('vnc_session ignored — VNC not enabled');
+                    return;
+                }
+                const action = msg['action'];
+                if (action === 'start') {
+                    const sessionId = msg['sessionId'];
+                    const port = Number(msg['port'] ?? 5900);
+                    // Prefer password from server frame; fall back to locally-configured password
+                    const password = msg['password'] || this._vncPassword;
+                    this._log(`VNC session start: ${sessionId} → port ${port}`);
+                    const session = new vnc_1.VncSession(sessionId, (frame) => this.sendFrame(frame));
+                    this._vncSessions.set(sessionId, session);
+                    session.start(port, password).catch((err) => {
+                        this._log(`VNC session ${sessionId} failed to start: ${err.message}`);
+                        this._vncSessions.delete(sessionId);
+                        this.sendFrame({ type: 'vnc_close', sessionId, reason: err.message });
+                    });
+                }
+                return;
             }
-            return;
-        }
-        // ── RDP frames from pixel-office ─────────────────────────────────────────
-        if (msgType === 'rdp_session') {
-            if (!this._rdpEnabled) {
-                this._log('rdp_session ignored — RDP not enabled');
+            if (msgType === 'vnc_input') {
+                const sessionId = msg['sessionId'];
+                const event = msg['event'];
+                if (sessionId && event) {
+                    this._vncSessions.get(sessionId)?.handleInput(event);
+                }
                 return;
             }
-            const action = msg['action'];
-            if (action === 'start') {
+            if (msgType === 'vnc_close') {
                 const sessionId = msg['sessionId'];
-                const opts = {
-                    // Host/port come ONLY from local settings — never from the WS frame.
-                    // A frame-supplied host/port would let a remote party open an outbound
-                    // RDP bridge to an arbitrary target (SSRF / internal-network pivot).
-                    // Default to loopback (xrdp runs on the same machine as the extension).
-                    host: this._rdpSettings.host || '127.0.0.1',
-                    port: this._rdpSettings.port ?? 3389,
-                    // credentials never sent from server — always use local settings
-                    username: this._rdpSettings.username || msg['username'],
-                    password: this._rdpSettings.password || msg['password'],
-                    domain: this._rdpSettings.domain || msg['domain'],
-                    width: msg['width'] ? Number(msg['width']) : undefined,
-                    height: msg['height'] ? Number(msg['height']) : undefined,
-                    colorDepth: msg['colorDepth'] ? Number(msg['colorDepth']) : undefined,
-                };
-                this._log(`RDP session start: ${sessionId} → ${opts.host}:${opts.port ?? 3389}`);
-                // Send Guacamole token to browser so it can connect via guacamole-lite
-                // (guacd + guacamole-lite must be running on the same host as xrdp, port 4567)
-                if (opts.username || opts.password) {
-                    const guacSettings = {
-                        hostname: opts.host,
-                        port: String(opts.port ?? 3389),
-                        'ignore-cert': true,
+                if (sessionId) {
+                    this._log(`VNC session closed: ${sessionId}`);
+                    this._vncSessions.get(sessionId)?.stop();
+                    this._vncSessions.delete(sessionId);
+                }
+                return;
+            }
+            // ── RDP frames from pixel-office ─────────────────────────────────────────
+            if (msgType === 'rdp_session') {
+                if (!this._rdpEnabled) {
+                    this._log('rdp_session ignored — RDP not enabled');
+                    return;
+                }
+                const action = msg['action'];
+                if (action === 'start') {
+                    const sessionId = msg['sessionId'];
+                    const opts = {
+                        // Host/port come ONLY from local settings — never from the WS frame.
+                        // A frame-supplied host/port would let a remote party open an outbound
+                        // RDP bridge to an arbitrary target (SSRF / internal-network pivot).
+                        // Default to loopback (xrdp runs on the same machine as the extension).
+                        host: this._rdpSettings.host || '127.0.0.1',
+                        port: this._rdpSettings.port ?? 3389,
+                        // credentials never sent from server — always use local settings
+                        username: this._rdpSettings.username || msg['username'],
+                        password: this._rdpSettings.password || msg['password'],
+                        domain: this._rdpSettings.domain || msg['domain'],
+                        width: msg['width'] ? Number(msg['width']) : undefined,
+                        height: msg['height'] ? Number(msg['height']) : undefined,
+                        colorDepth: msg['colorDepth'] ? Number(msg['colorDepth']) : undefined,
                     };
-                    if (opts.username) {
-                        guacSettings['username'] = opts.username;
-                    }
-                    if (opts.password) {
-                        guacSettings['password'] = opts.password;
-                    }
-                    if (opts.domain) {
-                        guacSettings['domain'] = opts.domain;
-                    }
-                    if (opts.width) {
-                        guacSettings['width'] = opts.width;
-                    }
-                    if (opts.height) {
-                        guacSettings['height'] = opts.height;
+                    this._log(`RDP session start: ${sessionId} → ${opts.host}:${opts.port ?? 3389}`);
+                    // Send Guacamole token to browser so it can connect via guacamole-lite
+                    // (guacd + guacamole-lite must be running on the same host as xrdp, port 4567)
+                    if (opts.username || opts.password) {
+                        const guacSettings = {
+                            hostname: opts.host,
+                            port: String(opts.port ?? 3389),
+                            'ignore-cert': true,
+                        };
+                        if (opts.username) {
+                            guacSettings['username'] = opts.username;
+                        }
+                        if (opts.password) {
+                            guacSettings['password'] = opts.password;
+                        }
+                        if (opts.domain) {
+                            guacSettings['domain'] = opts.domain;
+                        }
+                        if (opts.width) {
+                            guacSettings['width'] = opts.width;
+                        }
+                        if (opts.height) {
+                            guacSettings['height'] = opts.height;
+                        }
+                        guacSettings['color-depth'] = opts.colorDepth ?? 24;
+                        const tokenPayload = JSON.stringify({ connection: { type: 'rdp', settings: guacSettings } });
+                        const token = Buffer.from(tokenPayload).toString('base64');
+                        // Use configured WSS URL (for HTTPS frontends), else fall back to plain WS on port 4567
+                        const guacWsUrl = this._rdpSettings.guacWsUrl || `ws://${opts.host}:4567`;
+                        this.sendFrame({
+                            type: 'rdp_guac_token',
+                            sessionId,
+                            wsUrl: guacWsUrl,
+                            token,
+                            width: opts.width ?? 1280,
+                            height: opts.height ?? 800,
+                        });
+                        this._log(`RDP guac token sent for session ${sessionId} → ${guacWsUrl}`);
                     }
-                    guacSettings['color-depth'] = opts.colorDepth ?? 24;
-                    const tokenPayload = JSON.stringify({ connection: { type: 'rdp', settings: guacSettings } });
-                    const token = Buffer.from(tokenPayload).toString('base64');
-                    // Use configured WSS URL (for HTTPS frontends), else fall back to plain WS on port 4567
-                    const guacWsUrl = this._rdpSettings.guacWsUrl || `ws://${opts.host}:4567`;
-                    this.sendFrame({
-                        type: 'rdp_guac_token',
-                        sessionId,
-                        wsUrl: guacWsUrl,
-                        token,
-                        width: opts.width ?? 1280,
-                        height: opts.height ?? 800,
+                    const session = new rdp_1.RdpSession(sessionId, (frame) => this.sendFrame(frame), (msg) => this._log(msg));
+                    this._rdpSessions.set(sessionId, session);
+                    session.start(opts).catch((err) => {
+                        this._log(`RDP session ${sessionId} failed to start: ${err.message}`);
+                        this._rdpSessions.delete(sessionId);
+                        this.sendFrame({ type: 'rdp_close', sessionId, reason: err.message });
                     });
-                    this._log(`RDP guac token sent for session ${sessionId} → ${guacWsUrl}`);
                 }
-                const session = new rdp_1.RdpSession(sessionId, (frame) => this.sendFrame(frame), (msg) => this._log(msg));
-                this._rdpSessions.set(sessionId, session);
-                session.start(opts).catch((err) => {
-                    this._log(`RDP session ${sessionId} failed to start: ${err.message}`);
-                    this._rdpSessions.delete(sessionId);
-                    this.sendFrame({ type: 'rdp_close', sessionId, reason: err.message });
-                });
-            }
-            return;
-        }
-        if (msgType === 'rdp_input') {
-            const sessionId = msg['sessionId'];
-            const event = msg['event'];
-            if (sessionId && event) {
-                this._rdpSessions.get(sessionId)?.handleInput(event);
+                return;
             }
-            return;
-        }
-        if (msgType === 'rdp_close') {
-            const sessionId = msg['sessionId'];
-            if (sessionId) {
-                this._log(`RDP session closed: ${sessionId}`);
-                this._rdpSessions.get(sessionId)?.stop();
-                this._rdpSessions.delete(sessionId);
+            if (msgType === 'rdp_input') {
+                const sessionId = msg['sessionId'];
+                const event = msg['event'];
+                if (sessionId && event) {
+                    this._rdpSessions.get(sessionId)?.handleInput(event);
+                }
+                return;
             }
-            return;
-        }
-        // ── A2A task frame ────────────────────────────────────────────────────────
-        // A2A task frame: { task: { id, contextId, status: { state }, metadata: { event, task, parts } } }
-        if (msg['task']) {
-            const t = msg['task'];
-            const state = t['status']?.['state'];
-            if (state !== 'TASK_STATE_SUBMITTED') {
+            if (msgType === 'rdp_close') {
+                const sessionId = msg['sessionId'];
+                if (sessionId) {
+                    this._log(`RDP session closed: ${sessionId}`);
+                    this._rdpSessions.get(sessionId)?.stop();
+                    this._rdpSessions.delete(sessionId);
+                }
                 return;
             }
-            // Deduplicate by task ID so the same delivery isn't re-processed on reconnect,
-            // but a new task with identical text is still accepted.
-            const taskId = t['id'];
-            if (taskId) {
-                if (this._seenTaskIds.has(taskId)) {
+            // ── A2A task frame ────────────────────────────────────────────────────────
+            // A2A task frame: { task: { id, contextId, status: { state }, metadata: { event, task, parts } } }
+            if (msg['task']) {
+                const t = msg['task'];
+                const state = t['status']?.['state'];
+                if (state !== 'TASK_STATE_SUBMITTED') {
+                    return;
+                }
+                // Deduplicate by task ID so the same delivery isn't re-processed on reconnect,
+                // but a new task with identical text is still accepted.
+                const taskId = t['id'];
+                if (taskId && this._seenTaskIds.has(taskId)) {
                     this._log(`WS task already processed (id=${taskId}), skipping`);
                     return;
                 }
-                // Persisted + bounded so a restart/@latest respawn doesn't re-ingest
-                // deliveries the server replays on resubscribe.
-                this._markSeenDelivery(taskId);
-            }
-            const meta = t['metadata'] ?? {};
-            // ── Instant / steer message ────────────────────────────────────────────
-            // Delivered live to the running turn (mid-turn injection), NOT appended to
-            // TODO. Same A2A task-frame shape as a user_message but event='steer'.
-            if (meta['event'] === 'steer' || meta['event'] === 'instant') {
-                const steerObj = meta['task'];
-                let steerText = typeof steerObj?.['text'] === 'string' ? steerObj['text'] : '';
-                if (!steerText) {
-                    const parts = meta['parts'];
-                    if (parts) {
-                        const texts = parts
-                            .filter(p => p['kind'] === 'text' && typeof p['text'] === 'string')
-                            .map(p => p['text']);
-                        steerText = texts.join(' ');
+                // NOTE: the delivery is marked seen only AFTER it has been durably handled
+                // (TODO append resolved / steer or command dispatched) — see below. Marking
+                // it here at parse time meant a transient append failure permanently
+                // dropped the user's message because the server's reconnect replay was
+                // then skipped by the dedup check above.
+                const meta = t['metadata'] ?? {};
+                // ── Instant / steer message ────────────────────────────────────────────
+                // Delivered live to the running turn (mid-turn injection), NOT appended to
+                // TODO. Same A2A task-frame shape as a user_message but event='steer'.
+                if (meta['event'] === 'steer' || meta['event'] === 'instant') {
+                    const steerObj = meta['task'];
+                    let steerText = typeof steerObj?.['text'] === 'string' ? steerObj['text'] : '';
+                    if (!steerText) {
+                        const parts = meta['parts'];
+                        if (parts) {
+                            const texts = parts
+                                .filter(p => p['kind'] === 'text' && typeof p['text'] === 'string')
+                                .map(p => p['text']);
+                            steerText = texts.join(' ');
+                        }
                     }
+                    steerText = steerText.replace(/\r\n|\r|\n/g, ' ').trim();
+                    if (!steerText) {
+                        return;
+                    }
+                    this._log(`WS steer received: "${steerText}"`);
+                    // At-least-once (mirror the user_message path below): mark the delivery
+                    // seen only AFTER the steer is durably handled — mid-turn injection or a
+                    // successful TODO append. On failure we leave it unseen so the server's
+                    // reconnect replay re-delivers it instead of silently dropping it.
+                    this._onSteer?.(steerText, () => { if (taskId) {
+                        this._markSeenDelivery(taskId);
+                    } });
+                    return;
                 }
-                steerText = steerText.replace(/\r\n|\r|\n/g, ' ').trim();
-                if (!steerText) {
+                if (meta['event'] !== 'user_message') {
                     return;
                 }
-                this._log(`WS steer received: "${steerText}"`);
-                this._onSteer?.(steerText);
-                return;
-            }
-            if (meta['event'] !== 'user_message') {
-                return;
-            }
-            const taskObj = meta['task'];
-            let taskText = typeof taskObj?.['text'] === 'string' ? taskObj['text'] : '';
-            // Handle A2A parts — extract text parts and save file parts as attachments
-            // Pre-generate task ID so all attachments share the same prefix
-            const wsTaskId = (0, todo_1.shortId)();
-            const rawParts = meta['parts'];
-            const textParts = [];
-            const attRefs = [];
-            if (rawParts) {
-                for (const part of rawParts) {
-                    if (part['kind'] === 'text') {
-                        const t = part['text'] ?? '';
-                        if (t) {
-                            textParts.push(t);
-                        }
-                    }
-                    else if (part['kind'] === 'file' && this._workspaceRoot) {
-                        const file = part['file'];
-                        if (file) {
-                            const name = file['name'] ?? 'attachment';
-                            const bytesB64 = file['bytes'];
-                            if (bytesB64) {
-                                const buf = Buffer.from(bytesB64, 'base64');
-                                const rel = (0, messageBuilder_1.saveAttachment)(this._workspaceRoot, name, buf, wsTaskId);
-                                attRefs.push(rel);
+                const taskObj = meta['task'];
+                let taskText = typeof taskObj?.['text'] === 'string' ? taskObj['text'] : '';
+                // Handle A2A parts — extract text parts and save file parts as attachments
+                // Pre-generate task ID so all attachments share the same prefix
+                const wsTaskId = (0, todo_1.shortId)();
+                const rawParts = meta['parts'];
+                const textParts = [];
+                const attRefs = [];
+                if (rawParts) {
+                    for (const part of rawParts) {
+                        if (part['kind'] === 'text') {
+                            const t = part['text'] ?? '';
+                            if (t) {
+                                textParts.push(t);
                             }
-                            else if (typeof file['uri'] === 'string') {
-                                attRefs.push(file['uri']);
+                        }
+                        else if (part['kind'] === 'file' && this._workspaceRoot) {
+                            const file = part['file'];
+                            if (file) {
+                                const name = file['name'] ?? 'attachment';
+                                const bytesB64 = file['bytes'];
+                                if (bytesB64) {
+                                    const buf = Buffer.from(bytesB64, 'base64');
+                                    const rel = (0, messageBuilder_1.saveAttachment)(this._workspaceRoot, name, buf, wsTaskId);
+                                    attRefs.push(rel);
+                                }
+                                else if (typeof file['uri'] === 'string') {
+                                    attRefs.push(file['uri']);
+                                }
                             }
                         }
                     }
                 }
+                // Use parts text only as fallback when task.text is absent
+                if (!taskText && textParts.length > 0) {
+                    taskText = textParts.join(' ');
+                }
+                if (!taskText) {
+                    return;
+                }
+                // Collapse newlines so the entire message becomes a single TODO.md line
+                taskText = taskText.replace(/\r\n|\r|\n/g, ' ').trim();
+                const fullText = attRefs.length > 0
+                    ? taskText + ' ' + attRefs.map(p => `[attachment: ${p}]`).join(' ')
+                    : taskText;
+                this._log(`WS task received: "${taskText}"${attRefs.length > 0 ? ` (+${attRefs.length} attachment(s))` : ''}`);
+                // Divert ONLY exact known control commands (/restart, /clear, /retry, …).
+                // Any other slash-prefixed text ("/login is broken", "/etc/nginx ...") is
+                // an ordinary task and must still be queued — never silently discarded.
+                if ((0, commands_1.isKnownSlashCommand)(fullText)) {
+                    if (taskId) {
+                        this._markSeenDelivery(taskId);
+                    }
+                    this._onCommand?.(fullText);
+                    return;
+                }
+                if (!this._todoPath) {
+                    this._log('WS failed to append task to TODO.md: todoPath is empty');
+                    return;
+                }
+                todoWriteManager_1.todoWriter.append(this._todoPath, fullText, wsTaskId)
+                    .then(() => {
+                    // At-least-once: only record the delivery as seen AFTER the durable
+                    // TODO append succeeds. On failure we leave it unseen so the server's
+                    // reconnect replay re-delivers it instead of dropping it.
+                    if (taskId) {
+                        this._markSeenDelivery(taskId);
+                    }
+                    this._onTaskAppend?.();
+                })
+                    .catch(err => { this._log(`WS failed to append task to TODO.md: ${err}`); });
             }
-            // Use parts text only as fallback when task.text is absent
-            if (!taskText && textParts.length > 0) {
-                taskText = textParts.join(' ');
-            }
-            if (!taskText) {
-                return;
-            }
-            // Collapse newlines so the entire message becomes a single TODO.md line
-            taskText = taskText.replace(/\r\n|\r|\n/g, ' ').trim();
-            const fullText = attRefs.length > 0
-                ? taskText + ' ' + attRefs.map(p => `[attachment: ${p}]`).join(' ')
-                : taskText;
-            this._log(`WS task received: "${taskText}"${attRefs.length > 0 ? ` (+${attRefs.length} attachment(s))` : ''}`);
-            // Handle slash commands — don't append as tasks
-            if (fullText.startsWith('/')) {
-                this._onCommand?.(fullText);
-                return;
-            }
-            if (!this._todoPath) {
-                this._log('WS failed to append task to TODO.md: todoPath is empty');
-                return;
-            }
-            todoWriteManager_1.todoWriter.append(this._todoPath, fullText, wsTaskId)
-                .then(() => { this._onTaskAppend?.(); })
-                .catch(err => { this._log(`WS failed to append task to TODO.md: ${err}`); });
+        }
+        catch (err) {
+            // A bad frame must never take down the socket/process — see the try above.
+            this._log(`WS frame dispatch failed (type=${msgType ?? 'unknown'}): ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
         }
     }
     /** Handle a file-browser request from the server (originated by the browser UI). */
@@ -744,13 +784,9 @@ class WebSocketPoller {
         }
         // Resolve and validate path is within workspace root. The root itself is
         // permitted for read-only actions (list/search) but never for mutations.
-        const resolveSafe = (rel, allowRoot) => {
-            const resolved = path.resolve(root, rel);
-            if (resolved === root) {
-                return allowRoot ? resolved : null;
-            }
-            return resolved.startsWith(root + path.sep) ? resolved : null;
-        };
+        // Containment is lexical AND canonical (realpath) — a workspace symlink
+        // pointing outside must not let a remote fb_request read/write host files.
+        const resolveSafe = (rel, allowRoot) => (0, pathSafe_1.resolveWithinRoot)(root, rel, allowRoot);
         const MUTATING = new Set(['write', 'delete', 'rename', 'mkdir']);
         const allowRoot = !MUTATING.has(action);
         const absPath = resolveSafe(relPath, allowRoot);
@@ -906,6 +942,18 @@ class WebSocketPoller {
             respond(false, undefined, 'Git not enabled');
             return;
         }
+        // Containment guard — mirror _handleFbRequest. Every path-bearing arg
+        // (filePath) must resolve inside the workspace root both lexically AND after
+        // resolving symlinks; otherwise a git_request could read arbitrary host
+        // files (e.g. path '../../.claude/.credentials.json' via the readFileSync
+        // fallback in getDiff, or leak them through `git diff -- <path>`). An empty
+        // filePath means "whole repo" and is permitted (allowRoot).
+        if (filePath !== undefined && filePath !== '') {
+            if ((0, pathSafe_1.resolveWithinRoot)(root, filePath, true) === null) {
+                respond(false, undefined, 'Path outside workspace');
+                return;
+            }
+        }
         (async () => {
             try {
                 switch (action) {