ompchamber 1.2.1 → 2.0.1

package/src/server/lib/terminal/foreground.test.ts

@@ -0,0 +1,164 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * `detectBusyShells` decides the terminal cap's budget, so it has to be right
+ * about the two states that matter: a shell at its prompt (not counted) and a
+ * shell running a command (counted). Both are observed against a real PTY,
+ * because the whole question is what the *kernel* says the terminal's
+ * foreground group is — a mocked probe would only test the mock.
+ *
+ * The probe's answer is cross-checked against `ps -o tpgid=`, which is the
+ * definition of the field being read: an offset that drifted makes the probe
+ * return null (its own pid guard rejects a mismatched struct) and fail these
+ * assertions rather than silently report a garbage group.
+ *
+ * Waiting is driven by the PTY stream, not by sleeps: a shell's prompt (or the
+ * marker a command prints before it parks) is the real signal that the
+ * foreground group has moved, so the assertions never race a guessed delay.
+ */
+
+import { afterAll, describe, expect, test } from 'bun:test';
+
+import { processProbe } from '@/server/lib/lifecycle/proc';
+import { shellLaunch } from '@/server/lib/terminal/shell';
+import { detectBusyShells, type ShellProcess } from '@/server/lib/terminal/foreground';
+
+const describePosix = process.platform === 'win32' ? describe.skip : describe;
+
+/** The shell the test drives, and the prompt it announces itself with. */
+const SHELL = '/bin/sh';
+/**
+ * Spelled `CHAM''BER` on the command line below: the PTY echoes what is typed,
+ * so a literal needle would be satisfied by the echo before the shell ever
+ * parsed the line — the same trap the busy marker avoids.
+ */
+const PROMPT = 'CHAMBER> ';
+
+/** The value `ps` prints for the same field the probe reads. */
+async function psTpgid(pid: number): Promise<number> {
+  const proc = Bun.spawn(['ps', '-o', 'tpgid=', '-p', String(pid)], { stdout: 'pipe', stderr: 'ignore' });
+  const text = await new Response(proc.stdout).text();
+  await proc.exited;
+  return Number(text.trim());
+}
+
+interface PtyShell {
+  id: string;
+  pid: number;
+  term: Bun.Terminal;
+  proc: Bun.Subprocess;
+  /** Resolves the next time the PTY emits `needle`; output seen so far counts. */
+  until: (needle: string) => Promise<void>;
+}
+
+const spawned: PtyShell[] = [];
+
+async function spawnShell(id: string): Promise<PtyShell> {
+  let seen = '';
+  let pending: { needle: string; resolve: () => void } | null = null;
+  const term = new Bun.Terminal({
+    cols: 80,
+    rows: 24,
+    name: 'xterm-256color',
+    data(_term, bytes) {
+      seen += new TextDecoder().decode(bytes);
+      if (pending && seen.includes(pending.needle)) {
+        const { resolve } = pending;
+        pending = null;
+        resolve();
+      }
+    },
+  });
+  // The production launch argv, not a bare `/bin/sh`. The runtime must spawn
+  // `detached: true`, and `setsid()` drops the controlling terminal — a shell
+  // that never re-opens the PTY reports `tpgid` as -1 (verified on Linux), which
+  // reads as "a command owns the terminal" and is what made the prompt
+  // assertion below fail there. `shellLaunch` is the shim that re-acquires it,
+  // so this is the shell shape the probe is actually asked about.
+  const proc = Bun.spawn(shellLaunch(SHELL), { terminal: term, detached: true, cwd: '/tmp' });
+  const shell: PtyShell = {
+    id,
+    pid: proc.pid,
+    term,
+    proc,
+    until(needle) {
+      if (seen.includes(needle)) return Promise.resolve();
+      return new Promise<void>((resolve) => {
+        pending = { needle, resolve };
+      });
+    },
+  };
+  spawned.push(shell);
+  return shell;
+}
+
+afterAll(async () => {
+  for (const shell of spawned) {
+    try {
+      shell.term.write('\u0003exit\n');
+    } catch {
+      // Already closed.
+    }
+  }
+  await Promise.all(spawned.map((shell) => shell.proc.exited.catch(() => undefined)));
+});
+
+describePosix('processProbe.foregroundGroup', () => {
+  test('reports the same group ps does for a live pid', async () => {
+    const fromProbe = processProbe.foregroundGroup(process.pid);
+    expect(fromProbe).not.toBeNull();
+    expect(fromProbe).toBe(await psTpgid(process.pid));
+  });
+
+  test('returns null for a pid that no longer exists', async () => {
+    const corpse = Bun.spawn(['/bin/sh', '-c', 'exit 0']);
+    const deadPid = corpse.pid;
+    await corpse.exited;
+    expect(processProbe.foregroundGroup(deadPid)).toBeNull();
+  });
+});
+
+describePosix('detectBusyShells', () => {
+  test('a shell at its prompt is not busy, and one running a command is', async () => {
+    const shell = await spawnShell('probe');
+    const shells: ShellProcess[] = [{ id: shell.id, pid: shell.pid }];
+
+    // The prompt is the shell printing from its own foreground group. It is
+    // named by us rather than assumed: the default is `$ ` for a user and `# `
+    // for root, and the assertion is about the foreground group, not the glyph.
+    shell.term.write("PS1='CHAM''BER> '\n");
+    await shell.until(PROMPT);
+    expect((await detectBusyShells(shells)).has(shell.id)).toBe(false);
+
+    // The marker is printed by a child that already owns the terminal, and the
+    // typed text spells it `REA''DY` — a literal needle would be matched by the
+    // PTY's own echo of the input, before the shell had even parsed the line.
+    shell.term.write("sh -c 'echo REA''DY; sleep 30'\n");
+    await shell.until('READY\r\n');
+    expect((await detectBusyShells(shells)).has(shell.id)).toBe(true);
+  });
+
+  test('falls back to ps when one pid cannot be probed, and still answers', async () => {
+    const shell = await spawnShell('fallback');
+    const corpse = Bun.spawn(['/bin/sh', '-c', 'exit 0']);
+    const ghostPid = corpse.pid;
+    await corpse.exited;
+
+    shell.term.write("sh -c 'echo REA''DY; sleep 30'\n");
+    await shell.until('READY\r\n');
+
+    // A dead pid is one the probe declines, which routes the whole set through
+    // `ps` — the path the BSDs take for every question.
+    const shells: ShellProcess[] = [
+      { id: shell.id, pid: shell.pid },
+      { id: 'ghost', pid: ghostPid },
+    ];
+    const busy = await detectBusyShells(shells);
+    expect(busy.has(shell.id)).toBe(true);
+    expect(busy.has('ghost')).toBe(false);
+    expect(busy.size).toBe(1);
+  });
+});

package/src/server/lib/terminal/foreground.ts

@@ -19,11 +19,19 @@
  * switched a few times pins the budget with shells that are all idle at a
  * prompt, and the next attach is rejected with nothing actually running.
  *
- * Cost is one `ps` call for the whole registry, so this is safe to run on every
- * attach. It is advisory: any failure resolves to "not busy", because refusing
- * a shell to save a slot is worse than letting one extra through.
+ * The value comes from the platform's `ProcessProbe` — `libproc` on macOS,
+ * `/proc` on Linux — which is a synchronous read of a field the kernel already
+ * has, and one `ps` subprocess answered it before. Measured on 8 live shells:
+ * 30 ms for the spawn against 0.07 ms for the probe. `ps` stays as the fallback
+ * for the platforms with no probe (the BSDs) and for the case where a probe
+ * declines to answer, so the answer never depends on the fast path working.
+ *
+ * Advisory either way: any failure resolves to "not busy", because refusing a
+ * shell to save a slot is worse than letting one extra through.
  */
 
+import { processProbe } from '@/server/lib/lifecycle/proc';
+
 const PS_TIMEOUT_MS = 1500;
 
 /** `pid` is the shell's process (it is the PTY session leader, so pgid === pid). */
@@ -32,10 +40,15 @@ export interface ShellProcess {
   pid: number;
 }
 
-export async function detectBusyShells(shells: ShellProcess[]): Promise<Set<string>> {
+/**
+ * The same question through `ps`, for a platform whose probe declined.
+ *
+ * Kept whole rather than merged into the probe path: it is the only mechanism
+ * that works everywhere a `ps` is installed, and its subprocess machinery
+ * (timeout, kill, reaping) is what the probe exists to avoid paying for.
+ */
+async function busyShellsViaPs(shells: ShellProcess[]): Promise<Set<string>> {
   const busy = new Set<string>();
-  if (shells.length === 0 || process.platform === 'win32') return busy;
-
   const byPid = new Map<number, string>();
   for (const shell of shells) byPid.set(shell.pid, shell.id);
 
@@ -71,3 +84,18 @@ export async function detectBusyShells(shells: ShellProcess[]): Promise<Set<stri
   }
   return busy;
 }
+
+export async function detectBusyShells(shells: ShellProcess[]): Promise<Set<string>> {
+  const busy = new Set<string>();
+  if (shells.length === 0 || process.platform === 'win32') return busy;
+
+  // All-or-nothing: one shell the probe cannot answer for sends the whole set
+  // through `ps`, which keeps a single answer for a single question instead of
+  // mixing two sources whose failure modes differ.
+  for (const shell of shells) {
+    const tpgid = processProbe.foregroundGroup(shell.pid);
+    if (tpgid === null) return busyShellsViaPs(shells);
+    if (tpgid !== shell.pid) busy.add(shell.id);
+  }
+  return busy;
+}

package/src/server/lib/terminal/history.ts

@@ -93,18 +93,19 @@ export function trimUtf8ToBytes(bytes: Uint8Array, maxBytes: number): Uint8Array
 /**
  * Split `input` into the bytes that may be replayed and the trailing fragment
  * of an unfinished control sequence. Dropped sequences are queries only.
+ *
+ * The scan for the next ESC is `indexOf`, not a byte-at-a-time loop: this runs
+ * over the whole replay buffer, and a JS loop spends its time on the bytes
+ * between sequences rather than on the sequences themselves. Measured on
+ * 512 KiB: 0.2 ms scanning byte-by-byte against 0.0085 ms with `indexOf`.
  */
 export function sanitizeReplayChunk(input: Uint8Array): { kept: Uint8Array; rest: Uint8Array } {
   const parts: Uint8Array[] = [];
   let from = 0;
-  let i = 0;
   let dropped = false;
 
-  while (i < input.length) {
-    if (input[i] !== ESC) {
-      i += 1;
-      continue;
-    }
+  let i = input.indexOf(ESC);
+  while (i !== -1) {
     const scan = scanEscape(input, i);
     if (scan === null) {
       if (i > from) parts.push(input.subarray(from, i));
@@ -122,7 +123,7 @@ export function sanitizeReplayChunk(input: Uint8Array): { kept: Uint8Array; rest
       from = scan.end;
       dropped = true;
     }
-    i = scan.end;
+    i = input.indexOf(ESC, scan.end);
   }
 
   if (!dropped) return { kept: input, rest: EMPTY };

package/src/server/plugins/compress.ts

@@ -11,15 +11,43 @@ import { brotliCompressSync, constants } from 'node:zlib';
  * The incoming body is buffered and a fresh `Response` is returned, because a
  * `Response` body can only be read once — reading it here would otherwise
  * leave Elysia nothing to send.
+ *
+ * Encodings are offered best-first: zstd, brotli, gzip. On a 905 KiB JSON body
+ * the three measured 0.48 ms / 8 KiB, 1.05 ms / 7 KiB and 2.22 ms / 19 KiB —
+ * zstd is both the fastest and, within 14% of brotli's ratio, effectively as
+ * small, and it stays ahead at every payload size measured (0.004 ms against
+ * 0.007 ms for gzip at 2 KiB). Brotli remains for a client that accepts `br`
+ * but not `zstd`, and gzip is the floor every client has.
  */
 const MIN_BYTES = 1024;
 
 const COMPRESSIBLE = /^(text\/|application\/(json|javascript|xml|wasm|svg))/;
 
-function compress(body: Uint8Array<ArrayBuffer>, encoding: 'br' | 'gzip'): Uint8Array {
-  return encoding === 'br'
-    ? brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } })
-    : Bun.gzipSync(body, { level: 6 });
+/** Compression encodings this server can produce, best first. */
+const ENCODINGS = ['zstd', 'br', 'gzip'] as const;
+
+type Encoding = (typeof ENCODINGS)[number];
+
+/**
+ * The best encoding the client accepts, or null.
+ *
+ * Plain substring matching, matching the previous `includes('br')` behavior: a
+ * browser's `Accept-Encoding` is an explicit set of alternatives, not a
+ * preference ordering this server has to weigh.
+ */
+function negotiateEncoding(acceptEncoding: string): Encoding | null {
+  for (const encoding of ENCODINGS) {
+    if (acceptEncoding.includes(encoding)) return encoding;
+  }
+  return null;
+}
+
+function compress(body: Uint8Array<ArrayBuffer>, encoding: Encoding): Uint8Array {
+  if (encoding === 'zstd') return Bun.zstdCompressSync(body, { level: 3 });
+  if (encoding === 'br') {
+    return brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } });
+  }
+  return Bun.gzipSync(body, { level: 6 });
 }
 
 export async function maybeCompress(response: Response, acceptEncoding: string | null): Promise<Response> {
@@ -29,7 +57,7 @@ export async function maybeCompress(response: Response, acceptEncoding: string |
   if (!COMPRESSIBLE.test(contentType)) return response;
   if (response.status === 204 || response.status === 304) return response;
 
-  const encoding = acceptEncoding.includes('br') ? 'br' : acceptEncoding.includes('gzip') ? 'gzip' : null;
+  const encoding = negotiateEncoding(acceptEncoding);
   if (!encoding) return response;
 
   const buffer = new Uint8Array(await response.arrayBuffer()) as Uint8Array<ArrayBuffer>;

package/src/server/plugins/ssr.ts

@@ -3,6 +3,8 @@ import { join } from 'path';
 import { getDb } from '@/server/db.server';
 import { tryServeStatic } from '@/server/plugins/static';
 import { tryProxyDevAsset } from '@/server/plugins/dev-assets';
+import { resolveTheme } from '@/shared/lib/theme/catalog';
+import { THEME_STYLE_ELEMENT_ID, themeStyleSheet } from '@/shared/lib/theme/css';
 
 const CLIENT_INDEX = join(process.cwd(), 'dist/client/index.html');
 
@@ -58,10 +60,6 @@ async function readSettings(): Promise<Record<string, unknown>> {
   }
 }
 
-function themeColor(theme: string): string {
-  return theme === 'one-dark-pro-soft' ? '#282c34' : '#faf8f3';
-}
-
 const MOBILE_UA = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini|Mobile|mobile|CriOS/i;
 
 /**
@@ -111,16 +109,25 @@ export const ssrRoutes = new Elysia({ name: 'ssr' }).get('*', async ({ request }
 
   const settings = await readSettings();
   const chamberSettings = (settings.omp_chamber_settings ?? {}) as { theme?: string };
-  const theme = chamberSettings.theme ?? 'paper';
+  // Resolved through the catalog: an id this build no longer ships (a
+  // downgrade, the retired `noir` alias) renders the default palette instead of
+  // an unstyled page.
+  const theme = resolveTheme(chamberSettings.theme);
   const initialIsMobile = MOBILE_UA.test(request.headers.get('user-agent') ?? '');
 
   const template = await readTemplate();
   const bootstrap = JSON.stringify({ initialIsMobile, appSettings: settings }).replace(/</g, '\\u003c');
+  // The template's own `<meta name="theme-color">` is REWRITTEN, not joined by
+  // a second tag: with both present Chrome reads the first one, so an appended
+  // tag would leave a dark theme painting light browser chrome.
+  const themeStyle = `<style id="${THEME_STYLE_ELEMENT_ID}">${themeStyleSheet()}</style>`;
 
   return new Response(
     template
-      .replace('data-theme="paper"', `data-theme="${theme}"`)
-      .replace('<!--app-head-->', `<meta name="theme-color" content="${themeColor(theme)}">`)
+      .replace('data-theme="paper"', `data-theme="${theme.id}"`)
+      .replace('data-theme-variant="light"', `data-theme-variant="${theme.variant}"`)
+      .replace('<meta name="theme-color" content="#faf8f3" />', `<meta name="theme-color" content="${theme.canvas}" />`)
+      .replace('<!--app-head-->', themeStyle)
       .replace('<!--app-bootstrap-->', `<script>window.__OMP_BOOTSTRAP__=${bootstrap}</script>`),
     { headers: HTML_HEADERS },
   );

package/src/server/routes/btw/topics.ts

@@ -14,8 +14,20 @@
 
 import { json, type ActionFunctionArgs, type LoaderFunctionArgs } from '@/server/lib/remix-compat';
 import { toImageContents, validateAgentImages } from '@/server/lib/omp/rpc/constants';
+import { isApprovalMode } from '@/shared/lib/omp/config/access-mode';
+import type { AttachedTextFileData } from '@/shared/lib/chat/attachments';
 import { BtwError, type BtwImages } from '@/server/lib/btw/runtime.server';
-import { abortBtw, askBtw, getBtwState, promoteBtw, removeBtw } from '@/server/lib/btw/service.server';
+import {
+  abortBtw,
+  askBtw,
+  getBtwState,
+  promoteBtw,
+  removeBtw,
+  respondBtwDialog,
+  setBtwApprovalMode,
+  setBtwModel,
+  setBtwThinkingLevel,
+} from '@/server/lib/btw/service.server';
 
 /** Actions that can reject for a reason the client should show as-is. */
 const STATUS_BY_CODE: Record<string, number> = {
@@ -39,6 +51,40 @@ function readImages(raw: unknown): { images?: BtwImages } | { error: string } {
   return images ? { images } : {};
 }
 
+/**
+ * Text files the client inlined for this question. Validated for shape only:
+ * the payload is a string the composer produced from bytes it already read, and
+ * the prompt builder escapes it into a fenced block.
+ */
+function readTextFiles(raw: unknown): AttachedTextFileData[] {
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((entry) => {
+    if (!entry || typeof entry !== 'object') return [];
+    const file = entry as Partial<AttachedTextFileData>;
+    if (typeof file.name !== 'string' || typeof file.content !== 'string') return [];
+    return [{
+      name: file.name,
+      content: file.content,
+      mimeType: typeof file.mimeType === 'string' ? file.mimeType : 'text/plain',
+      size: typeof file.size === 'number' ? file.size : file.content.length,
+    }];
+  });
+}
+
+/**
+ * The response body for one dialog, in the shape omp's RPC accepts: an answer
+ * value, a confirmation, or a cancellation. Anything else is refused rather
+ * than forwarded — a malformed response would leave the child blocked.
+ */
+function readDialogResponse(raw: unknown): Record<string, unknown> | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const response = raw as { value?: unknown; confirmed?: unknown; cancelled?: unknown };
+  if (response.cancelled === true) return { cancelled: true };
+  if (typeof response.confirmed === 'boolean') return { confirmed: response.confirmed };
+  if (typeof response.value === 'string') return { value: response.value };
+  return null;
+}
+
 export async function action({ params, request }: ActionFunctionArgs) {
   const { sessionId } = params;
   if (!sessionId) return json({ error: 'session id is required' }, { status: 400 });
@@ -54,12 +100,53 @@ export async function action({ params, request }: ActionFunctionArgs) {
         const question = typeof body?.question === 'string' ? body.question : '';
         const parsed = readImages(body?.images);
         if ('error' in parsed) return json({ error: parsed.error, code: 'invalid_images' }, { status: 400 });
-        return json({ success: true, data: await askBtw(sessionId, { topicId, question, images: parsed.images }) });
+        const provider = typeof body?.provider === 'string' ? body.provider : '';
+        const modelId = typeof body?.modelId === 'string' ? body.modelId : '';
+        return json({
+          success: true,
+          data: await askBtw(sessionId, {
+            topicId,
+            question,
+            images: parsed.images,
+            textFiles: readTextFiles(body?.textFiles),
+            ...(provider && modelId ? { model: { provider, id: modelId } } : {}),
+            ...(typeof body?.thinkingLevel === 'string' ? { thinkingLevel: body.thinkingLevel } : {}),
+            ...(isApprovalMode(body?.accessMode) ? { approvalMode: body.accessMode } : {}),
+          }),
+        });
       }
       case 'abort': {
         if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
         return json({ success: true, data: await abortBtw(sessionId, topicId) });
       }
+      case 'set_model': {
+        if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
+        const provider = typeof body?.provider === 'string' ? body.provider : '';
+        const modelId = typeof body?.modelId === 'string' ? body.modelId : '';
+        if (!provider || !modelId) return json({ error: 'provider and modelId are required', code: 'model_required' }, { status: 400 });
+        return json({ success: true, data: await setBtwModel(sessionId, topicId, provider, modelId) });
+      }
+      case 'set_thinking_level': {
+        if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
+        const level = typeof body?.level === 'string' ? body.level : '';
+        if (!level) return json({ error: 'level is required', code: 'level_required' }, { status: 400 });
+        return json({ success: true, data: await setBtwThinkingLevel(sessionId, topicId, level) });
+      }
+      case 'set_access_mode': {
+        if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
+        if (!isApprovalMode(body?.accessMode)) {
+          return json({ error: 'accessMode must be always-ask, write or yolo', code: 'invalid_access_mode' }, { status: 400 });
+        }
+        return json({ success: true, data: await setBtwApprovalMode(sessionId, topicId, body.accessMode) });
+      }
+      case 'dialog_response': {
+        if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
+        const id = typeof body?.id === 'string' ? body.id : '';
+        if (!id) return json({ error: 'id is required', code: 'dialog_required' }, { status: 400 });
+        const response = readDialogResponse(body?.response);
+        if (!response) return json({ error: 'a response value is required', code: 'dialog_required' }, { status: 400 });
+        return json({ success: true, data: await respondBtwDialog(sessionId, topicId, id, response) });
+      }
       case 'promote': {
         if (!topicId) return json({ error: 'topicId is required', code: 'topic_required' }, { status: 400 });
         return json({ success: true, data: await promoteBtw(sessionId, topicId) });

package/src/server/routes/fs/action.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The save branch's byte contract.
+ *
+ * `multipart/form-data` normalizes every bare LF in a field value to CRLF in
+ * transit — the HTML serializer does it on the way out and Bun's parser agrees
+ * on the way in — so `content` reaches this route CRLF-normalized no matter what
+ * the editor buffer held. The file's own ending therefore arrives as its own
+ * `eol` field, and the bytes written to disk are built from it. Without that
+ * step every save rewrote the whole file's line endings: an LF file came back
+ * CRLF, which `git diff` reports as every line changed.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { action } from '@/server/routes/fs/action';
+
+/** Probe files live in the repo root — the one directory the root allow-list always accepts. */
+const PROBE = path.join(process.cwd(), 'tmp-eol-probe.txt');
+
+afterEach(() => {
+  fs.rmSync(PROBE, { force: true });
+});
+
+async function save(content: string, eol?: string) {
+  const form = new FormData();
+  form.append('actionType', 'save');
+  form.append('root', process.cwd());
+  form.append('path', 'tmp-eol-probe.txt');
+  form.append('content', content);
+  if (eol) form.append('eol', eol);
+  const res = await action({ request: new Request('http://localhost/api/fs/action', { method: 'POST', body: form }) } as never);
+  expect(res.status).toBe(200);
+  return new Uint8Array(await Bun.file(PROBE).arrayBuffer());
+}
+
+describe('fs save line endings', () => {
+  test('an lf request writes lf, whatever multipart did in transit', async () => {
+    const bytes = await save('a\nb\n', 'lf');
+    expect([...bytes]).toEqual([0x61, 0x0a, 0x62, 0x0a]);
+  });
+
+  test('a crlf request writes crlf', async () => {
+    const bytes = await save('a\nb\n', 'crlf');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+
+  test('a payload that already carries crlf is not doubled', async () => {
+    const bytes = await save('a\r\nb\r\n', 'crlf');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+
+  // No `eol` means the route has no instruction, so the payload is written as
+  // multipart delivered it — which is CRLF, since the transport normalizes.
+  test('a payload without an eol field is written as delivered', async () => {
+    const bytes = await save('a\nb\n');
+    expect([...bytes]).toEqual([0x61, 0x0d, 0x0a, 0x62, 0x0d, 0x0a]);
+  });
+});

package/src/server/routes/fs/action.ts

@@ -5,6 +5,7 @@ import path from 'path';
 import { isMockMode } from '@/server/mock.server';
 import { getDefaultFsRoot, resolveRoot, resolveWithinRoot } from '@/server/lib/fs/root';
 import { runShell } from '@/server/lib/fs/shell';
+import { toDiskText } from '@/shared/lib/code/line-endings';
 export async function action({ request }: ActionFunctionArgs) {
   const formData = await request.formData();
   const actionType = formData.get('actionType') as string;
@@ -24,7 +25,15 @@ export async function action({ request }: ActionFunctionArgs) {
 
   try {
     if (actionType === 'save') {
-      const content = (formData.get('content') as string) ?? '';
+      const raw = (formData.get('content') as string) ?? '';
+      const eol = formData.get('eol');
+      // The bytes are built here rather than written verbatim: `multipart/
+      // form-data` normalizes every bare LF in a field value to CRLF in transit
+      // (the HTML serializer does it on the way out, Bun's parser agrees on the
+      // way in — same result either way), so an LF file would land on disk as
+      // CRLF and show up as a full-file diff. `eol` is the ending the client
+      // read the file with; without it the payload is written untouched.
+      const content = eol === 'crlf' || eol === 'lf' ? toDiskText(raw, eol) : raw;
       await fs.promises.mkdir(path.dirname(fullPath), { recursive: true });
       await Bun.write(fullPath, content);
       return json({ success: true });

package/src/server/routes/fs/git.ts

@@ -181,14 +181,16 @@ export async function loader({ request }: LoaderFunctionArgs) {
     await remoteRefresh;
     const syncCount = syncRequested ? await gitSyncCount(targetDir) : undefined;
 
+    // No `repos`/`reposPending`/`activeRepo` here: the repo list travels on the
+    // `?reposOnly=1` branch, keyed to the root it was discovered for. Echoing a
+    // repo back in a status response is what let a panel adopt a repo it had
+    // never chosen — and adopt it under whichever workspace was active when the
+    // echo arrived.
     return json({
       changes,
       branch: branch || 'main',
       branches: branches.length ? branches : ['main'],
       remoteBranches,
-      repos,
-      reposPending: pending,
-      activeRepo: repo,
       syncCount,
     });
   } catch (error: any) {
@@ -197,9 +199,6 @@ export async function loader({ request }: LoaderFunctionArgs) {
       branch: 'main',
       branches: ['main'],
       remoteBranches: [],
-      repos: repos.length ? repos : ['.'],
-      reposPending: pending,
-      activeRepo: repo,
       syncCount: { ahead: 0, behind: 0 },
       error: error?.message || 'Git error',
     }, { status: 200 });