deepdebug-local-agent 1.6.0 → 1.7.0

package/test/la-protocol-v2/content-alignment.test.js

@@ -210,6 +210,8 @@ function fakeTimers() {
     return { pending, setTimeout: (fn, ms) => { const t = { fn, ms, off: false }; pending.push(t); return t; }, clearTimeout: (t) => { if (t) t.off = true; },
         async fire() { const due = pending.splice(0).filter((t) => !t.off); for (const t of due) await t.fn(); } };
 }
+/** flush() would send a batch that is waiting for its backoff (it is the "drain now" of tests/shutdown); after a timer fires we only let the microtasks settle. */
+const settle = () => new Promise((res) => setImmediate(res));
 function indexerRig({ maxIds = 2048, ttl = 900_000 } = {}) {
     const session = fakeSession();
     const timers = fakeTimers();
@@ -234,11 +236,11 @@ test("indexer: rate_limited -> nothing stored, the ids come back after 30 s, the
     assert.deepEqual(r.session.sent.map((s) => s.code), ["rate_limited"]);
     assert.equal(r.indexer.announcedCount, 0);
     assert.equal(r.timers.pending.at(-1).ms, 30_000);
-    await r.timers.fire();                       // announce() -> schedules the batch (0 ms)
-    await r.timers.fire();                       // the batch: rejected again
-    await r.indexer.flush();
+    r.advance(30_000);
+    await r.timers.fire(); await settle();   // F3-07c: the retry sends the failed batch itself (it never left the queue): rejected again
     assert.equal(r.timers.pending.at(-1).ms, 60_000);
-    await r.timers.fire(); await r.timers.fire(); await r.indexer.flush();
+    r.advance(60_000);
+    await r.timers.fire(); await settle();
     assert.equal(r.session.sent.at(-1).code, null, "accepted at last");
     assert.deepEqual(r.session.sent.at(-1).payload.entries.map((e) => e.ref), [id]);
     assert.equal(r.indexer.announcedCount, 1);
@@ -246,19 +248,41 @@ test("indexer: rate_limited -> nothing stored, the ids come back after 30 s, the
     r.indexer.close();
 });
 
+test("indexer: after rate_limited, ids minted inside the window do NOT restart the send; they go out together when the window ends", async () => {
+    const r = indexerRig();
+    r.session.script = ["rate_limited"];
+    const a = r.mint("a.txt");
+    await r.indexer.flush();
+    assert.equal(r.session.sent.length, 1, "the rate-limited send");
+    // a listing mints many ids right now: the batch timer fires, but the window (30 s) has not ended
+    const more = [r.mint("b.txt"), r.mint("c.txt")];
+    r.advance(5_000);
+    await r.timers.fire(); await settle();
+    await r.timers.fire(); await settle();
+    assert.equal(r.session.sent.length, 1, "nothing was sent inside the backoff window");
+    assert.ok(r.timers.pending.some((t) => !t.off), "a timer is armed for the end of the window");
+    r.advance(30_000);
+    await r.timers.fire(); await settle();
+    const last = r.session.sent.at(-1);
+    assert.equal(last.code, null, "accepted after the window");
+    assert.deepEqual(last.payload.entries.map((e) => e.ref).sort(), [a, ...more].sort());
+    r.indexer.close();
+});
+
 test("indexer: protocol_unsupported stops for the connection (no timers, adds are dropped); the next non-resumed ready starts again", async () => {
     const r = indexerRig();
     r.session.script = ["protocol_unsupported"];
     r.mint();
     await r.indexer.flush();
     assert.equal(r.timers.pending.filter((t) => !t.off).length, 0, "no retry timer");
+    assert.equal(r.indexer.pending, 0, "F3-07c: a gateway that keeps no index: the queue is dropped, not kept for nothing");
     const before = r.session.sent.length;
     r.mint("g.txt");
     await r.indexer.flush();
     assert.equal(r.session.sent.length, before);
     assert.equal(r.indexer.stats.dropped >= 1, true);
     r.session.emit("ready", { resumed: false });
-    await r.indexer.flush(); await r.timers.fire(); await r.indexer.flush();
+    await r.indexer.flush(); await r.timers.fire(); await settle();
     assert.equal(r.session.sent.at(-1).code, null);
     assert.equal(r.session.sent.at(-1).payload.entries.length, 2, "both live ids come back: the one that was refused and the one dropped while stopped (it is in the registry)");
     r.indexer.close();
@@ -270,14 +294,51 @@ test("indexer: internal and timeout are retried after 5 s; other failures wait f
     r.mint();
     await r.indexer.flush();
     assert.equal(r.timers.pending.at(-1).ms, 5_000);
-    await r.timers.fire(); await r.timers.fire(); await r.indexer.flush();
+    await r.timers.fire(); await settle();
     assert.equal(r.timers.pending.at(-1).ms, 5_000);
-    await r.timers.fire(); await r.timers.fire(); await r.indexer.flush();
+    console.log("DBG", JSON.stringify(r.session.sent.map((x)=>x.code)), r.timers.pending.map((t)=>[t.ms,t.off]));
+    await r.timers.fire(); await settle();
     assert.equal(r.session.sent.at(-1).code, "agent_offline");
     assert.equal(r.timers.pending.filter((t) => !t.off).length, 0, "agent_offline: no timer, the next ready announces again");
     r.session.emit("ready", { resumed: false });
-    await r.indexer.flush(); await r.timers.fire(); await r.indexer.flush();
+    await r.indexer.flush(); await r.timers.fire(); await settle();
+    assert.equal(r.session.sent.at(-1).code, null);
+    r.indexer.close();
+});
+
+test("indexer (F3-07c): a failed frame puts back ONLY its own batch: other workspaces' batches survive, nothing is duplicated, order is kept", async () => {
+    const r = indexerRig();
+    r.session.script = ["rate_limited"];
+    const a = r.mint("a.txt", "ws-1"); const b = r.mint("b.txt", "ws-2"); const c = r.mint("c.txt", "ws-3");
+    await r.indexer.flush();
+    assert.deepEqual(r.session.sent.map((x) => [x.workspaceId, x.code]), [["ws-1", "rate_limited"]]);
+    assert.equal(r.indexer.pending, 3, "the failed batch and the two batches of the other workspaces are all still queued (it used to be 0)");
+    assert.equal(r.indexer.announce(), 0, "announce() does not queue what is already waiting");
+    assert.equal(r.indexer.pending, 3);
+    r.advance(30_000);                       // the backoff window of the rate_limited answer ends before the retry timer fires
+    await r.timers.fire(); await settle();
+    assert.deepEqual(r.session.sent.slice(1).map((x) => [x.workspaceId, x.code, x.payload.entries.map((e) => e.ref)]), [["ws-1", null, [a]], ["ws-2", null, [b]], ["ws-3", null, [c]]]);
+    assert.equal(r.indexer.announcedCount, 3);
+    assert.equal(r.indexer.pending, 0);
+    assert.ok(r.logs.every((l) => ![a, b, c].some((id) => l.includes(id))), "no id in a log line");
+    r.indexer.close();
+});
+
+test("indexer (F3-07c): ids added while a frame is in flight are not lost when it fails; a batch that keeps failing is dropped after 5 tries and the next ones still go", async () => {
+    const r = indexerRig();
+    r.session.script = ["internal", "internal", "internal", "internal", "internal"];
+    const a = r.mint("a.txt", "ws-1");
+    await r.indexer.flush();                      // 1st try fails
+    const b = r.mint("b.txt", "ws-1");            // queued behind the failed one, same workspace
+    for (let i = 0; i < 4; i++) { await r.timers.fire(); await settle(); }
+    assert.equal(r.session.sent.filter((x) => x.code === "internal").length, 5);
+    assert.equal(r.indexer.stats.dropped >= 1, true, "5th failure: the batch is given up and counted");
+    assert.equal(r.indexer.pending, 0);
+    assert.ok(a && b);
+    const c = r.mint("c.txt", "ws-1");
+    await r.indexer.flush();
     assert.equal(r.session.sent.at(-1).code, null);
+    assert.deepEqual(r.session.sent.at(-1).payload.entries.map((e) => e.ref), [c], "a later id is announced normally");
     r.indexer.close();
 });
 
@@ -285,13 +346,13 @@ test("indexer: not ready -> nothing is sent; ready -> every live id goes out; ex
     const r = indexerRig({ ttl: 60_000 });
     r.session.state = "await_ready";
     const a = r.mint("a.txt"); const b = r.mint("b.txt");
-    await r.timers.fire(); await r.indexer.flush();
+    await r.timers.fire(); await settle();
     assert.equal(r.session.sent.length, 0);
     r.advance(61_000);
     const c = r.mint("c.txt");                   // a and b expired in the meantime
     r.session.state = "ready";
     r.session.emit("ready", { resumed: false });
-    await r.indexer.flush(); await r.timers.fire(); await r.indexer.flush();
+    await r.indexer.flush(); await r.timers.fire(); await settle();
     const refs = r.session.sent.flatMap((s) => s.payload.entries.map((e) => e.ref));
     assert.deepEqual(refs, [c]);
     assert.equal(refs.includes(a) || refs.includes(b), false);

package/test/la-protocol-v2/content-deny-list.test.js

@@ -0,0 +1,138 @@
+// F3-07c: the narrowed deny list (Edu, 2026-11-03): block the files that ARE credentials, serve the code that merely talks about them.
+// `credentials*` used to block credentials.service.ts; now a name that mentions credential/kubeconfig is served only when its last
+// extension is source code. The DLP (enforce, mandatory) stays the second layer for whatever is served.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { isSensitivePath, resolveInside, CODE_EXTENSIONS } from "../../src/la-protocol-v2/content-handlers/path-guard.js";
+import { ContentRefRegistry } from "../../src/la-protocol-v2/content-handlers/ref-registry.js";
+import { setup, write, tmpDir } from "./helpers/content-rig.js";
+
+// [path, sensitive?]  Every row is one name the guard must classify; "dir" rows are listing entries that are folders.
+const FILES = [
+    // ---- served: code and docs whose NAME mentions a credential (the reason for the change)
+    ["credentials.service.ts", false], ["src/auth/credentials.service.ts", false], ["CredentialsController.java", false],
+    ["src/main/java/io/x/CredentialsController.java", false], ["credentials_test.py", false], ["tests/test_credentials.py", false],
+    ["credentials.js", false], ["credentials.mjs", false], ["credentials.tsx", false], ["credentialsHelper.go", false],
+    ["credentials_store.rs", false], ["CredentialProvider.kt", false], ["credentials.rb", false], ["Credentials.cs", false],
+    ["credentials.php", false], ["credentials.vue", false], ["credentials.sql", false], ["credentials.md", false],
+    ["docs/credentials.md", false], ["credentials.spec.ts", false], ["credentials.d.ts", false], ["aws-credentials-loader.ts", false],
+    ["credential-store.js", false], ["CREDENTIALS.SERVICE.TS", false], ["credentials.service.ts.", false], ["credentials.html", false],
+    // ---- served: look-alikes that are not about secrets at all
+    ["env.ts", false], ["env.d.ts", false], ["env.mjs", false], ["env.config.js", false], ["src/env/index.js", false], ["environment.ts", false],
+    ["src/environment.js", false], ["kubeconfig.go", false], ["KubeconfigLoader.java", false], ["kubeconfig_loader.py", false],
+    ["secrets.service.ts", false], ["SecretsManager.java", false], ["README.md", false], ["package.json", false], ["src/keyboard.js", false],
+    ["docs/pem-format.md", false], ["tsconfig.json", false], ["src/secretary.js", false], [".gitignore", false], [".github/workflows/ci.yml", false],
+    ["src/credentials/index.ts", false], ["src/credentials/CredentialsService.java", false], ["env.ts.snap.ts", false], [".environment.ts", false],
+    // ---- blocked: files that ARE credentials (Edu's list)
+    ["credentials", true], [".credentials", true], ["credentials.json", true], ["credentials.yml", true], ["credentials.yaml", true],
+    ["credentials.xml", true], ["credentials.toml", true], ["credentials.ini", true], ["credentials.cfg", true], ["credentials.conf", true],
+    ["credentials.csv", true], ["credentials.txt", true], ["credentials.properties", true], ["credentials.db", true], ["credentials.sqlite", true],
+    ["credentials.enc", true], ["credentials.pem", true], ["credentials.p12", true], ["credentials.pfx", true], ["credentials.kdbx", true],
+    ["credentials.tfvars", true], ["credentials.env", true], ["application_default_credentials.json", true], ["x.credentials", true],
+    ["aws/credentials", true], [".aws/credentials", true], ["gcloud/credentials.db", true], [".config/gcloud/credentials.db", true],
+    ["CREDENTIALS.JSON", true], ["Credentials.Yml", true], ["deep/er/credentials.json", true], ["gcp-credentials.json", true],
+    ["credentials.prod.json", true], ["credentials.json.bak", true], ["credentials.bak", true], ["credentials~", true], ["credentials-prod", true],
+    ["credential.json", true], ["credentials.sh", true], ["credentials.service.json", true], ["credentials.json.", true],
+    ["credentials/prod.json", true], ["src/credentials/README", true], ["src/credentials/key.txt", true], [".credentials/token", true],
+    // ---- blocked: env files and their variants (the gaps the reviewer found)
+    [".env", true], [".env.local", true], [".env.production", true], [".env.production.local", true], [".envrc", true], [".envrc.local", true],
+    [".env_backup", true], [".env-prod", true], [".env.local~", true], [".env~", true], [".env#", true], ["env.production", true], ["env.local", true],
+    ["env_prod", true], ["env-staging", true], ["env", true], ["prod.env", true], ["app/.ENV", true], [".env2", true], [".envs/.production/.postgres", true],
+    // ---- blocked: kube, secrets, keys, npm/pip/net, docker, git, ssh
+    ["kubeconfig", true], ["kubeconfig-prod", true], ["kubeconfig_dev", true], ["kubeconfig.yaml", true], ["prod.kubeconfig", true], [".kube/config", true],
+    ["secrets/api.txt", true], ["config/secrets/prod.yml", true], ["secrets/manager.ts", true], [".secrets/x", true], ["secrets.json", true], ["secrets.yaml", true],
+    ["id_rsa", true], ["id_rsa.pub", true], ["id_rsa_github", true], ["id_ed25519", true], ["id_ed25519.pub", true], ["id_ed25519_work", true], ["id_ecdsa", true],
+    ["server.pem", true], ["private.key", true], ["release.keystore", true], ["debug.keystore", true], ["app.jks", true], ["cert.p12", true], ["vault.kdbx", true],
+    [".npmrc", true], ["pkg/.npmrc", true], [".pypirc", true], [".netrc", true], ["_netrc", true], [".pgpass", true], [".git-credentials", true],
+    [".docker/config.json", true], [".ssh/known_hosts", true], [".git/config", true], [".aws/config", true], [".gnupg/pubring.kbx", true],
+    ["terraform.tfstate", true], ["prod.tfvars", true], ["service-account-prod.json", true], [".htpasswd", true],
+    // ---- blocked: Windows aliases and streams of the above
+    ["CREDEN~1.JSO", true], ["CREDEN~1", true], ["ENV~1", true], ["KUBECO~1", true], [".env::$DATA", true], ["credentials.json:Zone.Identifier", true],
+    // ---- F3-07c review: credential files that no earlier rule named (blocked) and their look-alikes (served)
+    [".dockercfg", true], [".yarnrc", true], [".yarnrc.yml", true], [".pnpmrc", true], [".s3cfg", true], [".boto", true], [".terraformrc", true],
+    [".Renviron", true], ["auth.json", true], ["sub/auth.json", true], ["client_secret_123.json", true], ["firebase-adminsdk-abc.json", true],
+    ["gha-creds-1234.json", true], ["local.settings.json", true], ["wp-config.php", true], ["application-prod.properties", true],
+    ["application-prod.yml", true], ["application-prod.yaml", true], ["deploy_rsa", true], ["host_ed25519", true], ["ssh_host_rsa_key", true],
+    [".m2/settings.xml", true], [".m2/settings-security.xml", true], [".envrc/a.txt", true], [".env_backup/a.txt", true], [".env-prod/a.txt", true],
+    ["env.production/a.txt", true], ["kubeconfig-prod/a.txt", true], ["ENVRC~1", true], ["ENVS~1/x", true],
+    ["settings.xml", false], ["pom.xml", false], ["src/main/resources/application.yml", false], ["application-dev.yml", false],
+    ["application-test.properties", false], ["auth.ts", false], ["author.json", false], ["auth.service.ts", false], ["wp-config-sample.php", false],
+    ["rsa.ts", false], ["key_ed25519.ts", false], ["src/m2/settings.xml", false],
+];
+
+test("deny list table (F3-07c): >= 80 names, served and blocked, each one on its own", () => {
+    assert.ok(FILES.length >= 80, `${FILES.length} rows`);
+    assert.ok(FILES.filter(([, s]) => !s).length >= 30 && FILES.filter(([, s]) => s).length >= 50, "both sides are well covered");
+    const wrong = FILES.filter(([p, s]) => isSensitivePath(p) !== s).map(([p, s]) => `${p} expected ${s ? "blocked" : "served"}`);
+    assert.deepEqual(wrong, []);
+});
+
+test("deny list: a folder entry (dir) is judged as a folder: src/credentials is a folder of code, .credentials and secrets are not", () => {
+    for (const [p, sens] of [["credentials", false], ["src/credentials", false], ["Credentials", false], ["credential", false], ["kubeconfig", false], ["env", false],
+        [".credentials", true], ["secrets", true], [".secrets", true], [".git", true], [".ssh", true], [".aws", true], [".envs", true], [".env", true], ["x/.env", true],
+        ["node_modules", false], ["src", false], ["docs", false], ["environment", false]]) {
+        assert.equal(isSensitivePath(p, [], { dir: true }), sens, `dir ${p}`);
+    }
+    // the same name as a FILE stays blocked: the guard never serves a file called `credentials`
+    assert.equal(isSensitivePath("src/credentials"), true);
+});
+
+test("deny list: code extensions are an allow list; data formats, scripts and backups never are", () => {
+    for (const e of ["ts", "java", "py", "go", "js", "md", "sql", "kt", "rb", "cs", "rs", "php", "vue", "svelte"]) assert.ok(CODE_EXTENSIONS.has(e), e);
+    for (const e of ["json", "yml", "yaml", "xml", "toml", "ini", "cfg", "conf", "csv", "txt", "properties", "db", "sqlite", "enc", "pem", "p12", "pfx", "kdbx", "tfvars", "env",
+        "sh", "bash", "ps1", "bat", "gradle", "bak", "old", "orig", "tmp", "swp", "map", "snap", "j2", "log", ""]) assert.equal(CODE_EXTENSIONS.has(e), false, e);
+    for (const e of ["json", "yml", "toml", "txt", "sh", "bak"]) assert.equal(isSensitivePath(`credentials.${e}`), true, e);
+    for (const e of ["ts", "java", "py", "go", "md"]) assert.equal(isSensitivePath(`credentials.${e}`), false, e);
+});
+
+test("deny list: LOCAL_AGENT_CONTENT_DENY_GLOBS still adds to it (credentials.service.ts can be put back by an operator)", () => {
+    assert.equal(isSensitivePath("credentials.service.ts", ["credentials*"]), true);
+    assert.equal(isSensitivePath("credentials.service.ts", []), false);
+    assert.equal(isSensitivePath("src/x.ts", ["src/"]), true);
+});
+
+test("deny list: the registry never mints an id for a blocked name, and mints for credentials.service.ts; a folder id for src/credentials", () => {
+    const reg = new ContentRefRegistry({ tenantId: "t1" });
+    const q = { workspaceId: "w", root: "/r" };
+    assert.ok(reg.mint({ ...q, kind: "file", rel: "src/credentials.service.ts" }));
+    for (const rel of ["credentials.json", ".envrc", "env.production", "secrets/x.ts", "credentials"]) assert.equal(reg.mint({ ...q, kind: "file", rel }), null, rel);
+    assert.ok(reg.mint({ ...q, kind: "file.list", rel: "src/credentials" }), "a folder named credentials may be listed");
+    assert.equal(reg.mint({ ...q, kind: "file.list", rel: "secrets" }), null);
+    assert.equal(reg.mint({ ...q, kind: "file.list", rel: ".credentials" }), null);
+    assert.ok(reg.mint({ ...q, kind: "file.list", rel: null }), "the root");
+});
+
+test("deny list at read time: credentials.service.ts is served (masked by the DLP), credentials.json and a link to it are not", async () => {
+    const rig = await setup({ dlp: "enforce" });
+    try {
+        const secret = "ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
+        write(rig.root(), "src/credentials.service.ts", `export const token = "${secret}";\nexport const ok = 1;\n`);
+        write(rig.root(), "credentials.json", `{"token":"${secret}"}`);
+        const good = rig.mint("file", "src/credentials.service.ts");
+        assert.ok(good, "an id exists for the code file");
+        const r = await rig.request({ ref: good });
+        assert.equal(r.status, "ok");
+        assert.equal(r.text.includes(secret), false, "the DLP is still the second layer");
+        assert.match(r.text, /export const ok = 1/);
+        assert.equal(rig.mint("file", "credentials.json"), null);
+        // swapped in after the id was minted: a harmless name that now links to credentials.json
+        write(rig.root(), "later.ts", "x");
+        const id = rig.mint("file", "later.ts");
+        fs.rmSync(path.join(rig.root(), "later.ts"));
+        fs.symlinkSync(path.join(rig.root(), "credentials.json"), path.join(rig.root(), "later.ts"));
+        assert.equal((await rig.request({ ref: id })).status, "forbidden");
+        assert.deepEqual(await resolveInside(rig.root(), "credentials.json"), { ok: false, status: "forbidden" });
+        assert.equal((await resolveInside(rig.root(), "src/credentials.service.ts")).ok, true);
+    } finally { await rig.stop(); }
+});
+
+test("deny list: nothing about the new rules is a regex over the whole path (no catastrophic backtracking on a long name)", () => {
+    const long = "credentials".repeat(5000) + ".json";
+    const t = Date.now();
+    assert.equal(isSensitivePath(long.slice(0, 1000)), true);
+    assert.equal(isSensitivePath("a/".repeat(500) + "x.ts"), false);
+    assert.ok(Date.now() - t < 500);
+    void tmpDir;
+});

package/test/la-protocol-v2/content-diff-symlink.test.js

@@ -0,0 +1,83 @@
+// F3-07c: `git diff` of a tracked symlink prints the TARGET of the link ("new file mode 120000", "+/abs/path"): an absolute path of this
+// machine. Entries whose mode is 120000 on either side no longer reach the diff. Real repositories, real links.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { setup, write, git, initRepo, tmpDir } from "./helpers/content-rig.js";
+import { rawPaths, dropSymlinkBlocks, worktreeDiff } from "../../src/la-protocol-v2/content-handlers/git-diff.js";
+
+async function withRig(opts, body) {
+    const rig = await setup(opts);
+    try { await body(rig); } finally { await rig.stop(); }
+}
+
+const OUTSIDE = "/very/private/absolute/target/of-the-link";
+
+test("diff: a tracked symlink that is retargeted, deleted, replaced by a file or created by replacing a file never prints its target; regular files still diff", async () => {
+    await withRig({}, async (rig) => {
+        const root = rig.root();
+        write(root, "regular.txt", "one\n");
+        write(root, "was-file.txt", "content\n");
+        write(root, "was-link-target.txt", "t\n");
+        fs.symlinkSync("/old/absolute/target-a", path.join(root, "link-retarget"));
+        fs.symlinkSync("/old/absolute/target-b", path.join(root, "link-deleted"));
+        fs.symlinkSync("/old/absolute/target-c", path.join(root, "link-becomes-file"));
+        initRepo(root);
+        // work tree changes
+        write(root, "regular.txt", "two\n");
+        fs.rmSync(path.join(root, "link-retarget")); fs.symlinkSync(OUTSIDE, path.join(root, "link-retarget"));
+        fs.rmSync(path.join(root, "link-deleted"));
+        fs.rmSync(path.join(root, "link-becomes-file")); write(root, "link-becomes-file", "now a file\n");
+        fs.rmSync(path.join(root, "was-file.txt")); fs.symlinkSync(OUTSIDE + "-2", path.join(root, "was-file.txt"));
+        // sanity: plain git DOES print the targets (this is what the guard hides)
+        const raw = git(root, "diff", "HEAD");
+        assert.match(raw, /new file mode 120000|deleted file mode 120000|120000/);
+        assert.ok(raw.includes(OUTSIDE) || raw.includes("/old/absolute/target"), "plain git shows the target");
+        const d = await rig.request({ kind: "diff", ref: "worktree" });
+        assert.equal(d.status, "ok");
+        assert.match(d.text, /regular\.txt/);
+        assert.match(d.text, /\+two/);
+        for (const leak of ["120000", OUTSIDE, "/old/absolute", "link-retarget", "link-deleted", "link-becomes-file", "was-file.txt"]) assert.equal(d.text.includes(leak), false, `leaked ${leak}`);
+        // an id for one path that is a link: empty diff, not the target
+        const one = rig.mint("diff", "link-retarget");
+        const o = await rig.request({ kind: "diff", ref: one });
+        assert.deepEqual([o.status, o.text], ["ok", ""]);
+    });
+});
+
+test("diff: a file turned into a link AFTER the file list was taken is still not printed (lstat net); the text net removes any block with mode 120000", async () => {
+    const root = tmpDir();
+    write(root, "a.txt", "1\n"); write(root, "b.txt", "1\n");
+    initRepo(root);
+    write(root, "a.txt", "2\n"); write(root, "b.txt", "2\n");
+    fs.rmSync(path.join(root, "b.txt")); fs.symlinkSync(OUTSIDE, path.join(root, "b.txt"));
+    const r = await worktreeDiff({ root, maxBytes: 1 << 20, maxFiles: 100, timeoutMs: 8000 });
+    assert.equal(r.ok, true);
+    assert.match(r.text, /a\.txt/);
+    assert.equal(r.text.includes("b.txt"), false);
+    assert.equal(r.text.includes(OUTSIDE), false);
+    fs.rmSync(root, { recursive: true, force: true });
+
+    const fake = [
+        "diff --git a/l b/l\nnew file mode 120000\nindex 0000000..e69de29\n--- /dev/null\n+++ b/l\n@@ -0,0 +1 @@\n+/etc/hostname\n\\n",
+        "diff --git a/m b/m\ndeleted file mode 120000\nindex e69de29..0000000\n--- a/m\n+++ /dev/null\n@@ -1 +0,0 @@\n-/etc/hosts\n",
+        "diff --git a/n b/n\nold mode 100644\nnew mode 120000\n",
+        "diff --git a/o b/o\nindex 1111111..2222222 120000\n--- a/o\n+++ b/o\n@@ -1 +1 @@\n-/a\n+/b\n",
+        "diff --git a/ok b/ok\nindex 1111111..2222222 100644\n--- a/ok\n+++ b/ok\n@@ -1 +1 @@\n-mode 120000 is just text here\n+new file mode 120000 neither\n",
+    ];
+    const out = dropSymlinkBlocks(fake.join(""));
+    assert.equal(out, fake[4], "only the regular file's block survives, including a body that talks about 120000");
+    assert.equal(dropSymlinkBlocks(fake[4]), fake[4]);
+    assert.equal(dropSymlinkBlocks(""), "");
+});
+
+test("diff: git diff --raw -z parsing: modes on either side, paths with spaces/newlines/unicode, and no path is ever split", () => {
+    const out = ":100644 100644 aaa bbb M\0src/a b.txt\0:100644 120000 aaa 000 T\0link\0:120000 000000 aaa 000 D\0gone\0:000000 100644 000 bbb A\0não\nsplit.txt\0:100755 100755 aaa bbb M\0x\0";
+    assert.deepEqual(rawPaths(out), [
+        { path: "src/a b.txt", symlink: false }, { path: "link", symlink: true }, { path: "gone", symlink: true },
+        { path: "não\nsplit.txt", symlink: false }, { path: "x", symlink: false },
+    ]);
+    assert.deepEqual(rawPaths(""), []);
+    assert.deepEqual(rawPaths(":100644 100644 a b M"), [], "a truncated entry gives nothing");
+});