flowviant 0.77.5 → 0.78.1

package/bin/lib/fleet.mjs

@@ -38,7 +38,6 @@ import { handleVersionSignal } from './update.mjs';
 import {
   git,
   resetWorktree,
-  ensureWorktree,
   repoRootOrDie,
   detectBaseRef,
   originSlug,
@@ -46,7 +45,6 @@ import {
   isValidPrUrl,
   isValidBranch,
   isSafePathSegment,
-  worktreeDiffstat,
 } from './git.mjs';
 import { c, info, note, ok, warn, fail } from './ui.mjs';
 import { revertPatch, withPatchLock } from './patch.mjs';
@@ -85,7 +83,7 @@ import {
   RUNTIMES,
 } from './runtimes.mjs';
 import { createWorkManager } from './work.mjs';
-import { scanLocalSessions } from './localSessions.mjs';
+import { scanLocalSessions, ourConversationIds } from './localSessions.mjs';
 import { repoState } from './repoState.mjs';
 
 async function fetchRoster(
@@ -253,7 +251,7 @@ let localSessionsUnsupported = false; // the server 404'd — quiet until restar
 let localSessionsScanAt = 0;
 let localSessionsSent = null; // last payload the server ACCEPTED, stringified
 let localSessionsSentAt = 0;
-async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
+async function maybeReportLocalSessions({ repoRoot, excludeDirs, excludeIds }) {
   if (localSessionsUnsupported) return;
   if (Date.now() - localSessionsScanAt < LOCAL_SESSIONS_SCAN_MS) return;
   localSessionsScanAt = Date.now();
@@ -261,7 +259,9 @@ async function maybeReportLocalSessions({ repoRoot, excludeDirs }) {
   try {
     // scanLocalSessions orders deterministically, so this string only changes
     // when the facts on disk do — the dedup below compares whole payloads.
-    payload = JSON.stringify({ sessions: scanLocalSessions({ repoRoot, excludeDirs }) });
+    payload = JSON.stringify({
+      sessions: scanLocalSessions({ repoRoot, excludeDirs, excludeIds }),
+    });
   } catch {
     return; // presence must never throw into the poll loop
   }
@@ -319,7 +319,13 @@ async function maybeReportRepoState({ repoRoot, baseRef }) {
   repoStateScanAt = Date.now();
   let payload;
   try {
-    const state = repoState(repoRoot, getBaseRef());
+    // The PARAM, and nothing else: this function sits at MODULE scope, where
+    // runFleetDaemon's `getBaseRef` closure does not exist. An earlier version
+    // reached for it anyway, the ReferenceError landed in the catch below —
+    // written for an unreadable repo, silent by design — and this endpoint was
+    // never once posted to. The caller reads the loop's live `baseRef` at call
+    // time, so the value here is always current.
+    const state = repoState(repoRoot, baseRef);
     if (!state) return; // not readable — say nothing rather than say "none"
     payload = JSON.stringify(state);
   } catch {
@@ -771,33 +777,6 @@ export async function runFleetDaemon() {
     return run;
   };
 
-  /** A clean detached checkout at base — what "the real code" has to mean for a
-   *  question about the repo, rather than whatever half-finished state an agent
-   *  worktree happens to be in. Shared by the plan check and consults. */
-  const ensureWikiWorktree = () => {
-    if (!existsSync(wikiWt)) {
-      try {
-        git(['worktree', 'add', '--detach', wikiWt, baseRef], repoRoot);
-      } catch {
-        git(['worktree', 'prune'], repoRoot);
-        git(['worktree', 'add', '--detach', wikiWt, baseRef], repoRoot);
-      }
-      return;
-    }
-    // It already exists — which means it is pinned to whatever base pointed at
-    // when it was FIRST created, possibly weeks ago. "Reads the real code" has
-    // to mean the current base, so re-point it. Best-effort: a stale answer
-    // beats no answer, and the next turn tries again.
-    try {
-      git(['fetch', 'origin', '--quiet'], repoRoot);
-      git(['checkout', '--detach', baseRef], wikiWt);
-      git(['reset', '--hard', baseRef], wikiWt);
-      git(['clean', '-fd'], wikiWt);
-    } catch {
-      /* offline, or a turn left it dirty — read what we have */
-    }
-  };
-
   // Machine telemetry — what the box is doing with itself, for the admin view.
   const MACHINE_URL = FLEET_URL.replace(/\/agents\/?$/, '/machine');
 
@@ -892,6 +871,7 @@ export async function runFleetDaemon() {
               execFileSync('gh', ['pr', 'edit', job.prUrl, '--base', baseBranchName(baseRef)], {
                 cwd: repoRoot,
                 stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: 30_000,
               });
             } catch (e) {
               // Already targeting base is the common no-op; anything else is
@@ -912,6 +892,7 @@ export async function runFleetDaemon() {
             execFileSync('gh', ['pr', 'merge', job.prUrl, '--squash', '--delete-branch'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
+              timeout: 120_000,
             });
             merged = true;
           } catch (e) {
@@ -989,7 +970,7 @@ export async function runFleetDaemon() {
                   'Task restarted in Flowviant — this attempt was discarded.',
                   '--delete-branch',
                 ],
-                { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'] }
+                { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
               );
             } catch (e) {
               // Already closed/merged/missing = fine; anything else we still
@@ -1031,10 +1012,22 @@ export async function runFleetDaemon() {
   const REGROUND_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/reground-done');
   const WIKI_VAULT_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-vault');
   const WIKI_PROGRESS_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-progress');
+  const WIKI_ABANDONED_URL = FLEET_URL.replace(/\/agents\/?$/, '/wiki-abandoned');
   const wikiQueue = [];
   let wikiBusy = false;
   let wikiChild = null; // the wiki turn's Claude process — tracked so teardown can kill it
   let lastSweepAt = null; // dedup: run each Regenerate request once
+  // …UNLESS IT FAILED. A sweep that ends without WIKI_DONE never finalizes, so
+  // the server's `regen_requested_at` stays set and the roster keeps offering
+  // the same `requestedAt` — which this dedup then swallowed forever. The
+  // console said "retry from the app", to a console nobody reads. Bounded the
+  // same way the re-ground path is: a full sweep is an expensive model turn, so
+  // a repo that fails one every time must not be able to loop-burn quota.
+  let sweepAttempts = 0;
+  // Which request the counter belongs to, so a NEW Regenerate click starts with
+  // a full budget rather than inheriting an exhausted one.
+  let sweepAttemptsFor = null;
+  const MAX_SWEEP_ATTEMPTS = 3;
   const groundedIntents = new Set(); // dedup: re-ground each delivery once
   // The vault is keyed by the server project this fleet credential serves
   // (learned from the roster); until the first poll names it, fall back to a
@@ -1077,8 +1070,38 @@ export async function runFleetDaemon() {
     }
   };
 
+  /**
+   * Tell the server this daemon has stopped retrying the pending sweep.
+   *
+   * The retry budget is a `let` in this process; `regen_requested_at` is a
+   * durable column with a 24-hour TTL. Without this the two disagreed — the
+   * daemon had permanently given up while every surface went on calling the
+   * sweep queued, for the rest of the day. Best-effort: an older server 404s
+   * once and the TTL is still the backstop it always was.
+   */
+  const postWikiAbandoned = async () => {
+    try {
+      await fetch(WIKI_ABANDONED_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(15_000),
+        body: '{}',
+      });
+    } catch {
+      /* best-effort — the request's own TTL still expires it */
+    }
+  };
+
   const enqueueSweep = (job) => {
     if (!job || job.requestedAt === lastSweepAt) return;
+    if (job.requestedAt !== sweepAttemptsFor) {
+      sweepAttemptsFor = job.requestedAt;
+      sweepAttempts = 0;
+    }
     lastSweepAt = job.requestedAt;
     // A full sweep is expensive — never stack two. One queued sweep already
     // covers any newer Regenerate click (it reads the repo fresh when it runs).
@@ -1100,7 +1123,24 @@ export async function runFleetDaemon() {
       // the turn still reads the real changed files; this catches pages whose
       // frontmatter file list has drifted, or that document a concept rather
       // than a directory.
-      dirtiesPages: Array.isArray(dirtiesPages) ? dirtiesPages : [],
+      //
+      // SANITIZED AT THE INTAKE, because every entry is server-supplied text
+      // that ends up interpolated into a prompt and printed by the drain's
+      // narration: a control byte can repaint the console it lands on, a
+      // newline can break out of the prompt's own list framing, and an
+      // unbounded array of unbounded strings is an unbounded prompt. This is
+      // the belt at the intake; the prompt keeps its own fence at the
+      // interpolation.
+      dirtiesPages: (Array.isArray(dirtiesPages) ? dirtiesPages : [])
+        .filter((p) => typeof p === 'string')
+        .slice(0, 40)
+        .map((p) =>
+          p
+            .replace(/[\u0000-\u001f\u007f]/g, ' ')
+            .trim()
+            .slice(0, 300)
+        )
+        .filter(Boolean),
       // THE COMMITS THAT SHIPPED — what changedFilesForShas resolves against.
       // Dropping this here was the whole 0.54.0/0.54.1 defect: the server sent
       // shas on every reground job, this function never stored them, and the
@@ -1224,6 +1264,18 @@ export async function runFleetDaemon() {
         // thinking block or slow tool (which emit nothing until they finish) —
         // otherwise the cover would flap back to the empty state mid-sweep.
         let heartbeat = null;
+        /**
+         * Did THIS sweep finish? Read by the `finally` below, which owns the
+         * retry decision for every way out of this block.
+         *
+         * It used to be decided inline on the one branch where the turn
+         * returned without its sentinel — so the two OTHER ways a sweep fails,
+         * `pickRuntimeFor` finding no CLI and the catch around the whole turn,
+         * left the request pinned and never retried at all. Those are the
+         * failures most worth retrying: a missing runtime is fixed by
+         * installing one, and a thrown turn is exactly the transient case.
+         */
+        let sweepCompleted = false;
         try {
           // Immediate frame so the cover shows the daemon feed right away (the
           // "reading your code" phase), not a static message, while Claude warms up.
@@ -1283,6 +1335,7 @@ export async function runFleetDaemon() {
           }
           const wikiLabel = RUNTIMES[wikiRt].label;
           if (task.type === 'sweep') {
+            sweepAttempts++;
             note(`${c.cyan('wiki')} ${c.dim(`— regenerating: your ${wikiLabel} is reading the repo…`)}`);
             const out = await runTurn({
               prompt: WIKI_KICKOFF(sha, vaultDir),
@@ -1307,9 +1360,12 @@ export async function runFleetDaemon() {
               },
             });
             const complete = sawSentinel(out, 'WIKI_DONE');
-            if (complete) ok(`${c.cyan('wiki')} ${c.dim('— vault regenerated from your code.')}`);
-            else
-              warn('wiki sweep ended without WIKI_DONE — partial pages synced; retry from the app.');
+            if (complete) {
+              sweepCompleted = true;
+              ok(`${c.cyan('wiki')} ${c.dim('— vault regenerated from your code.')}`);
+            } else {
+              warn('wiki sweep ended without WIKI_DONE — partial pages synced');
+            }
             await runSync(complete);
           } else {
             const files = changedFilesForShas(task.shas);
@@ -1376,6 +1432,34 @@ export async function runFleetDaemon() {
         } finally {
           wikiChild = null;
           if (heartbeat) clearInterval(heartbeat);
+          /**
+           * THE RETRY DECISION, IN ONE PLACE, FOR EVERY WAY OUT OF THIS BLOCK.
+           *
+           * Deciding it inline on the no-sentinel branch covered one of the
+           * three ways a sweep fails and silently declined the other two. Here
+           * it covers the thrown turn and the no-runtime return as well, which
+           * are the two most worth retrying.
+           *
+           * A successful sweep resets the budget. A failed one with budget left
+           * clears `lastSweepAt` so the roster's next offer of the SAME request
+           * is accepted — partial pages are synced without pruning either way,
+           * so a retry resumes rather than starting over. A failed one with the
+           * budget spent tells the SERVER, because the counter is process-local
+           * and the request it bounds is durable for 24 hours.
+           */
+          if (task.type === 'sweep') {
+            if (sweepCompleted) {
+              sweepAttempts = 0;
+            } else if (sweepAttempts < MAX_SWEEP_ATTEMPTS) {
+              lastSweepAt = null;
+              warn(`wiki sweep failed — retrying (${sweepAttempts}/${MAX_SWEEP_ATTEMPTS})`);
+            } else {
+              warn(
+                `wiki sweep failed ${sweepAttempts} times — giving up on this request; press Regenerate to try again.`
+              );
+              await postWikiAbandoned();
+            }
+          }
           // Terminal frame so the app cover clears promptly (don't wait for the
           // freshness window to lapse). force-sent past the throttle.
           await postWikiProgress(frame({ done: true }), true);
@@ -1596,12 +1680,7 @@ export async function runFleetDaemon() {
     // tab. Without this the daemon that lost the lease removes the worktree the
     // winner is working in — absence would mean "somebody else won" instead of
     // "the tab closed".
-    retireWorkSessions(
-      Array.isArray(roster.activeWorkSessions)
-        ? roster.activeWorkSessions
-        : roster.activeWorkSessions,
-      roster.sessionsHeldElsewhere
-    );
+    retireWorkSessions(roster.activeWorkSessions, roster.sessionsHeldElsewhere);
     // Diffs somebody has open and is waiting on. Project-scoped rather than
     // per-session: `git show` runs from the repo ROOT, which can see a closed
     // tab's branch and a shipped commit on main alike.
@@ -1643,7 +1722,15 @@ export async function runFleetDaemon() {
     // Terminal-session presence, throttled + dedup'd inside; never awaited —
     // the daemon's own worktrees are carved out (a session the daemon spawned
     // is already a tab, not something to offer adopting).
-    void maybeReportLocalSessions({ repoRoot, excludeDirs: [baseDir] });
+    void maybeReportLocalSessions({
+      repoRoot,
+      excludeDirs: [baseDir],
+      // …and our OWN tabs' conversations. Only the CHECKOUT needs this: every
+      // other place is under `baseDir` and already fenced by directory, while
+      // the operator's tabs share the checkout with real terminal sessions and
+      // cannot be. See `ourConversationIds`.
+      excludeIds: ourConversationIds(repoRoot),
+    });
     // …and the repo itself: every worktree and every branch, ours and not.
     // Never awaited, throttled inside, and silent on an older server.
     void maybeReportRepoState({ repoRoot, baseRef });
@@ -1736,7 +1823,10 @@ export async function runFleetDaemon() {
     // runs queued deploy jobs (the server only sends deployJobs to authorized
     // machines). Config report is cheap + dedup'd; jobs are single-flight.
     if (roster.env?.deployAuthorized) {
-      void reportDeployConfig(repoRoot);
+      // The BASE branch's copy, not the working tree's — see readDeployConfig.
+      // Reporting the working tree would advertise targets the runner will not
+      // find, which is the same lie in the other direction.
+      void reportDeployConfig(repoRoot, getBaseRef());
       processDeployJobs(roster.deployJobs, { repoRoot, baseRef: getBaseRef(), myPubB64 });
     }
 

package/bin/lib/git.mjs

@@ -1,11 +1,6 @@
 /** Git worktree helpers (fleet & static-fleet modes). */
 
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { materializedFiles } from './env.mjs';
 
 export function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
@@ -144,161 +139,6 @@ export function baseBranchName(baseRef) {
   return String(baseRef || '').replace(/^origin\//, '') || 'main';
 }
 
-/**
- * Get a detached worktree at `wt`, creating it at `ref` if it isn't there.
- *
- * Returns `{ path, fresh }` — `fresh` is the whole point. A worktree that
- * ALREADY existed is one somebody was mid-way through, and the caller must not
- * reset it; a freshly created one is at base by construction and has nothing to
- * preserve. That single bit replaces the in-memory `resuming` flag and the
- * on-disk task marker for the common case, because once a worktree is named
- * after its task, "does this directory exist" IS "am I resuming".
- *
- * The prune-and-retry is not paranoia: `git worktree add` refuses a path that
- * is still REGISTERED even when the directory is gone (`flowviant clean` rm's
- * the dirs, `git worktree list` keeps the stale entries), and that failure is
- * permanent until pruned.
- */
-export function ensureWorktree(repoRoot, wt, ref) {
-  // Resolve first. `existsSync` answers relative to THIS process's cwd while
-  // `git worktree add` answers relative to repoRoot, so a relative path makes
-  // the two disagree: the check says "not there", the add says "already
-  // exists", and the prune-and-retry can't fix a path that was never the one
-  // we looked at. Callers pass absolute paths today; this makes that not matter.
-  wt = resolve(wt);
-  if (existsSync(wt)) return { path: wt, fresh: false };
-  try {
-    git(['worktree', 'add', '--detach', wt, ref], repoRoot);
-  } catch {
-    git(['worktree', 'prune'], repoRoot);
-    git(['worktree', 'add', '--detach', wt, ref], repoRoot);
-  }
-  return { path: wt, fresh: true };
-}
-
-// ── WIP checkpoints: the sandbox's state, on the remote ────────────────────
-//
-// A task's uncommitted work used to exist in exactly one place — a directory on
-// whichever machine claimed it. That made the checkout precious: losing the box
-// lost the work, so a task was pinned to a host, the host had to be named in the
-// UI, and a container could never be thrown away. Pushing the work somewhere
-// durable inverts all of that. The sandbox becomes a cache.
-//
-// These snapshots go to `refs/flowviant-wip/<intentId>`, NOT to a branch: they
-// are machine state, not history, and they must never appear in a PR, a branch
-// listing, or anyone's `git log`. Force-pushed, because only the latest matters.
-
-const wipRef = (intentId) => `refs/flowviant-wip/${intentId}`;
-
-/** git, with extra environment — for GIT_INDEX_FILE and a committer identity we
- *  can't assume the machine has configured. */
-function gitWithEnv(args, cwd, extraEnv) {
-  return execFileSync('git', args, {
-    cwd,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    env: { ...process.env, ...extraEnv },
-  }).trim();
-}
-
-/**
- * Snapshot everything in the worktree — staged, unstaged and untracked — and
- * push it, WITHOUT touching the agent's HEAD, index or files.
- *
- * That constraint is why this doesn't just commit. The agent is a live process
- * with its own git intentions; committing under it would rewrite state it is
- * mid-way through reasoning about, and `git stash` would rip the files out from
- * under an editor. Building the tree in a throwaway index leaves the agent's
- * world untouched — it cannot tell this happened.
- *
- * Returns the commit sha, or null if there was nothing dirty / no remote.
- *
- * This PUSHES, so what it stages is a security boundary, not a detail: the
- * daemon materializes plaintext env-vault secrets into this same worktree.
- * They are gitignored (materializeInto refuses to write them otherwise), and
- * `git add -A` honours .gitignore — but the whole point of the bug this guards
- * against was an exclusion mechanism that silently did nothing, so the paths
- * are ALSO subtracted by pathspec here. Two independent mechanisms, because one
- * of them failing quietly is exactly what put secrets on a remote branch.
- */
-export function checkpointWip(wt, intentId, baseRef) {
-  if (!isSafePathSegment(intentId)) return null;
-  const idx = join(tmpdir(), `flowviant-idx-${intentId}-${process.pid}`);
-  const env = {
-    GIT_INDEX_FILE: idx,
-    // A snapshot must never fail because the machine has no user.name — this is
-    // ours, not the user's, and it never lands in history anyone reads.
-    GIT_AUTHOR_NAME: 'Flowviant',
-    GIT_AUTHOR_EMAIL: 'daemon@flowviant.com',
-    GIT_COMMITTER_NAME: 'Flowviant',
-    GIT_COMMITTER_EMAIL: 'daemon@flowviant.com',
-  };
-  try {
-    const head = git(['rev-parse', 'HEAD'], wt);
-    gitWithEnv(['read-tree', head], wt, env);
-    gitWithEnv(
-      ['add', '-A', '--', '.', ...materializedFiles(wt).map((p) => `:(exclude)${p}`)],
-      wt,
-      env
-    );
-    const tree = gitWithEnv(['write-tree'], wt, env);
-    // Nothing changed since HEAD — no snapshot worth pushing.
-    if (tree === git(['rev-parse', `${head}^{tree}`], wt)) return null;
-    const commit = gitWithEnv(
-      ['commit-tree', tree, '-p', head, '-m', `flowviant wip ${intentId}`],
-      wt,
-      env
-    );
-    git(['push', '--force', 'origin', `${commit}:${wipRef(intentId)}`], wt);
-    return commit;
-  } catch {
-    // Offline, no push rights, a repo with no origin — a checkpoint is an
-    // optimisation, never a reason to fail a task.
-    return null;
-  } finally {
-    try {
-      rmSync(idx, { force: true });
-    } catch {
-      /* best-effort */
-    }
-    void baseRef;
-  }
-}
-
-/**
- * Rebuild a worktree from its last pushed checkpoint. Returns true if one was
- * found and applied.
- *
- * The reset is MIXED on purpose: it leaves the snapshot's content in the files
- * with HEAD back at the parent, which is what the agent had before — dirty
- * working tree, nothing staged it didn't stage itself. A soft reset would hand
- * it a fully-staged index it never created.
- */
-export function restoreWip(wt, intentId) {
-  if (!isSafePathSegment(intentId)) return false;
-  const ref = wipRef(intentId);
-  try {
-    git(['fetch', 'origin', `+${ref}:${ref}`], wt);
-    const commit = git(['rev-parse', ref], wt);
-    const parent = git(['rev-parse', `${commit}^`], wt);
-    git(['checkout', '--detach', commit], wt);
-    git(['reset', parent], wt);
-    return true;
-  } catch {
-    return false; // no checkpoint for this task, or it's unreachable
-  }
-}
-
-/** Drop a task's checkpoint once its work has landed somewhere real. */
-export function clearWip(wt, intentId) {
-  if (!isSafePathSegment(intentId)) return;
-  try {
-    git(['push', 'origin', '--delete', wipRef(intentId)], wt);
-  } catch {
-    /* already gone, or no remote */
-  }
-}
-
 export function resetWorktree(wt, baseRef) {
   try {
     git(['fetch', 'origin', '--quiet'], wt);
@@ -314,106 +154,3 @@ export function resetWorktree(wt, baseRef) {
   }
 }
 
-/**
- * What has changed in this worktree since `baseRef` — committed or not.
- *
- * The definition matters. `git diff --numstat <base>` (no `..HEAD`) compares the
- * base against the WORKING TREE, so it covers commits the agent has made, staged
- * work, and edits it has not committed yet. Anything narrower would go blank at
- * the exact moments you look: right after a commit, or before the first one.
- *
- * Untracked files are added separately — they are invisible to `git diff` and
- * are usually the most interesting thing an agent has done (a new module, a new
- * test). Their line counts are read here rather than inferred; a file too large
- * to be source is reported as a path with no counts instead of being read into
- * memory.
- *
- * PATHS AND COUNTS ONLY. Nothing in here returns file content.
- *
- * Both git calls are `-z`, for the reason gitRaw exists: git's line-based output
- * QUOTES any path that is not plain ASCII, so an accented filename arrives as
- * "n\303\251w.txt" — a string that is not the path, cannot be stat'd, and reads
- * as garbage in the tray. `-z` emits paths verbatim.
- */
-export function worktreeDiffstat(cwd, baseRef, { maxFiles = 200 } = {}) {
-  const files = [];
-  let additions = 0;
-  let deletions = 0;
-
-  const add = (path, added, removed) => {
-    additions += added;
-    deletions += removed;
-    files.push({ path, added, removed });
-  };
-
-  try {
-    // `--numstat -z` frames a normal change as one field, "added\tdeleted\tpath",
-    // but a RENAME as three: "added\tdeleted\t" (empty path), then the old path,
-    // then the new one. An empty path is therefore the rename marker, and the
-    // next two fields belong to it — read line-wise instead, a rename would
-    // report a file literally named "old => new".
-    const fields = splitNul(gitRaw(['diff', '--numstat', '-z', baseRef, '--'], cwd));
-    for (let i = 0; i < fields.length; i++) {
-      const [a, d, ...rest] = fields[i].split('\t');
-      let path = rest.join('\t');
-      if (!path) {
-        path = fields[i + 2] ?? fields[i + 1]; // the post-rename name is what exists now
-        i += 2;
-        if (!path) continue;
-      }
-      // Binary files report '-' for both counts; they changed, but not by lines.
-      add(path, a === '-' ? 0 : Number(a) || 0, d === '-' ? 0 : Number(d) || 0);
-    }
-  } catch {
-    // No base ref yet, or not a repo — nothing to report rather than a crash.
-    return null;
-  }
-
-  try {
-    const untracked = splitNul(
-      gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], cwd)
-    );
-    for (const path of untracked) {
-      let added = 0;
-      // Past the cap this path will not be shown, so do not pay to read it.
-      // This is the one place the totals can undercount, and reaching it takes
-      // an untracked tree bigger than the list itself — a generated directory
-      // .gitignore missed. Statting and reading all of it on a 20s interval
-      // would block the roster poll and every other lane on this daemon.
-      if (files.length < maxFiles) {
-        try {
-          const st = statSync(join(cwd, path));
-          // Regular files ONLY. `git ls-files --others` will happily name a
-          // symlink or a fifo, and readFileSync on a fifo or a character device
-          // BLOCKS — on a 20s interval, on the daemon's single thread, that is
-          // the whole process wedged waiting for a device that may never write.
-          // 2 MB: past that it is a build artifact or a binary, and reading it
-          // to count newlines would be the most expensive thing this daemon does.
-          if (st.isFile() && st.size <= 2_000_000) {
-            const text = readFileSync(join(cwd, path), 'utf8');
-            // A NUL byte means binary. Counting "lines" in a PNG produces a
-            // number that is not wrong so much as meaningless, and it was being
-            // summed into the total shown beside git's real counts.
-            if (text.includes('\0')) throw new Error('binary');
-            // Lines, not segments. A file ending in a newline — i.e. essentially
-            // every source file an agent writes — splits into one more piece
-            // than it has lines, and that +1 was landing in the totals shown
-            // beside git's own counts.
-            added = text ? text.split('\n').length - (text.endsWith('\n') ? 1 : 0) : 0;
-          }
-        } catch {
-          /* vanished between listing and reading — report the path, no counts */
-        }
-      }
-      add(path, added, 0);
-    }
-  } catch {
-    /* untracked listing failed — the tracked half still stands */
-  }
-
-  if (files.length === 0) return null;
-  // Totals stay whole while the LIST is capped: a truncated list must never
-  // quietly shrink the number printed beside it.
-  const truncated = Math.max(0, files.length - maxFiles);
-  return { files: files.slice(0, maxFiles), additions, deletions, truncated };
-}

package/bin/lib/grant.mjs

@@ -171,12 +171,33 @@ export function safePathname(url) {
  * `//evil.com` and `/\evil.com` are protocol-relative to a browser, so a naive
  * "starts with /" check turns the callback into an open redirect on the tunnel
  * origin. Anything that is not a single-slash relative path becomes '/'.
+ *
+ * STRUCTURAL, NOT LEXICAL, and that distinction is the whole fix. This used to
+ * be `/^\/(?![/\\])/` plus a CR/LF check — and an audit walked through it with
+ * a TAB: browsers STRIP tab, CR and LF out of a URL before parsing, so
+ * `"/\t/evil.com"` passed the guard, was written verbatim into Location by the
+ * callback, and navigated to `//evil.com`. Parsing against a dummy base and
+ * re-serialising reproduces exactly what the browser will do — there is no
+ * second implementation of URL parsing here to drift, and the value returned
+ * is the one the parser produced. The lexical checks stay in front of it as
+ * the cheap first line; the origin comparison is the guarantee. Ported from
+ * the server twins (previewAuthorize.routes.ts, preview-relay util.ts), which
+ * closed the same hole the same way.
  */
 export function safeRelative(raw) {
   if (!raw) return '/';
   const s = String(raw);
   if (s.length > 512) return '/';
-  if (/[\r\n]/.test(s)) return '/';
-  if (!/^\/(?![/\\])/.test(s)) return '/';
-  return s;
+  if (!s.startsWith('/')) return '/';
+  if (/^\/[/\\]/.test(s)) return '/';
+  // Every C0 control, space and DEL — not just CR/LF.
+  // eslint-disable-next-line no-control-regex
+  if (/[\x00-\x20\x7f]/.test(s)) return '/';
+  try {
+    const u = new URL(s, 'https://x.invalid');
+    if (u.origin !== 'https://x.invalid') return '/';
+    return u.pathname + u.search + u.hash;
+  } catch {
+    return '/';
+  }
 }