ompchamber 1.2.1 → 2.0.1

package/src/shared/lib/markdown/autolink.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * linkify-it autolinking that yields to code spans.
+ *
+ * linkify-it accepts a backtick as an email local-part character (RFC 5321's
+ * `!#$%&'*+/=?^_`{|}~-` set), so `` `NNN+login@users.noreply.github.com` ``
+ * matches as ONE autolink whose raw text spans both backticks. The extension
+ * runs before marked's own inline rules, so that match is consumed and the code
+ * span never forms: the backticks end up as link text and the href carries
+ * `%60` escapes (`mailto:%60NNN+…%60`) — a broken link AND a code span that
+ * shows its delimiters.
+ *
+ * A code span wins over an autolink in CommonMark, and the inline lexer reaches
+ * the OPENING backtick first — so refusing every match whose raw contains a
+ * backtick is enough to hand that position back to the `codespan` rule, which
+ * then swallows the whole span. Autolinks without a backtick in them are
+ * untouched, which is every ordinary URL and email.
+ */
+
+import type {
+  MarkedExtension,
+  RendererExtension,
+  Token,
+  TokenizerAndRendererExtension,
+  TokenizerThis,
+} from 'marked';
+import markedLinkifyIt from 'marked-linkify-it';
+
+/** Refuse an autolink whose raw text carries a backtick (see the file header). */
+function guardAutolink(
+  extension: TokenizerAndRendererExtension | RendererExtension,
+): TokenizerAndRendererExtension | RendererExtension {
+  if (!('tokenizer' in extension) || !extension.tokenizer) return extension;
+  const tokenize = extension.tokenizer;
+  return {
+    ...extension,
+    tokenizer(this: TokenizerThis, source: string, tokens: Token[]) {
+      const token = tokenize.call(this, source, tokens);
+      return token && !token.raw.includes('`') ? token : undefined;
+    },
+  };
+}
+
+export function codeSafeAutolink(): MarkedExtension {
+  return { extensions: (markedLinkifyIt().extensions ?? []).map(guardAutolink) };
+}

package/src/shared/lib/markdown/document-urls.test.ts

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { resolveDocumentReference, rewriteDocumentReferences } from '@/shared/lib/markdown/document-urls';
+
+const doc = (path: string, root?: string, repo?: string) => ({ path, root, repo });
+
+describe('resolveDocumentReference', () => {
+  test('resolves beside the document, not beside the app', () => {
+    expect(resolveDocumentReference('docs/hero.png', doc('README.md'))?.path).toBe('docs/hero.png');
+    expect(resolveDocumentReference('img/a.png', doc('docs/guide.md'))?.path).toBe('docs/img/a.png');
+  });
+
+  test('walks out of the document folder', () => {
+    expect(resolveDocumentReference('../README.md', doc('docs/guide.md'))?.path).toBe('README.md');
+    expect(resolveDocumentReference('./a.png', doc('docs/guide.md'))?.path).toBe('docs/a.png');
+  });
+
+  test('a leading slash is the scope root, not the document folder', () => {
+    expect(resolveDocumentReference('/docs/a.png', doc('manual/v2/guide.md'))?.path).toBe('docs/a.png');
+  });
+
+  test('cannot climb above the scope root', () => {
+    expect(resolveDocumentReference('../../../../etc/passwd', doc('README.md'))?.path).toBe('etc/passwd');
+  });
+
+  test('keeps the scope in the raw URL', () => {
+    const resolved = resolveDocumentReference('a.png', doc('docs/guide.md', '/ws', 'projects/x'));
+    expect(resolved?.url).toBe('/api/fs/raw?path=docs%2Fa.png&root=%2Fws&repo=projects%2Fx');
+    // `repo: '.'` means the root itself, so the param is omitted.
+    expect(resolveDocumentReference('a.png', doc('docs/guide.md', '/ws', '.'))?.url)
+      .toBe('/api/fs/raw?path=docs%2Fa.png&root=%2Fws');
+  });
+
+  test('a query or fragment belongs to the reference, not the path', () => {
+    expect(resolveDocumentReference('img/a.png?v=2#frag', doc('docs/guide.md'))?.path).toBe('docs/img/a.png');
+  });
+
+  test('decodes percent escapes', () => {
+    expect(resolveDocumentReference('my%20image.png', doc('README.md'))?.path).toBe('my image.png');
+  });
+
+  test('leaves anything that is not a relative file reference alone', () => {
+    for (const reference of ['https://x.test/a.png', 'mailto:a@b.c', 'data:image/png;base64,AA', '//cdn.test/a.png', '#section', '   ', '']) {
+      expect(resolveDocumentReference(reference, doc('README.md'))).toBeNull();
+    }
+  });
+});
+
+describe('rewriteDocumentReferences', () => {
+  test('points images at the raw route and links at the file they name', () => {
+    expect(rewriteDocumentReferences('<img src="docs/a.png"><a href="AGENTS.md">x</a>', doc('README.md')))
+      .toBe('<img src="/api/fs/raw?path=docs%2Fa.png"><a href="/api/fs/raw?path=AGENTS.md" data-file-path="AGENTS.md">x</a>');
+  });
+
+  test('escapes the query separator so the attribute survives HTML parsing', () => {
+    expect(rewriteDocumentReferences('<img src="a.png">', doc('docs/g.md', '/ws')))
+      .toBe('<img src="/api/fs/raw?path=docs%2Fa.png&amp;root=%2Fws">');
+  });
+
+  test('leaves external references and escaped code untouched', () => {
+    const html = '<a href="https://x.test">x</a><code class="language-html">&lt;img src=&quot;a.png&quot;&gt;</code>';
+    expect(rewriteDocumentReferences(html, doc('README.md'))).toBe(html);
+  });
+});

package/src/shared/lib/markdown/document-urls.ts

@@ -0,0 +1,118 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Resolve the relative references of a markdown *document* (an opened file's
+ * preview) to the workspace files they actually name.
+ *
+ * A previewed file is not a chat message: `![](docs/hero.png)` means the image
+ * on disk beside the document, and `[Architecture](AGENTS.md)` means that file.
+ * Neither resolves on its own — the preview is an app route, so a relative URL
+ * is requested from the server's own origin (`/docs/hero.png` → 404, and a
+ * click would navigate the console away from itself). Each one is rewritten to
+ * the workspace file it points at: images through `/api/fs/raw` (real bytes,
+ * real content-type) and links through the same URL plus the resolved path in
+ * `data-file-path`, which the panel turns back into an editor tab.
+ *
+ * Only plain relative references are touched. Anything with a scheme
+ * (`https:`, `mailto:`, `data:`), a protocol-relative `//host`, or a bare
+ * `#anchor` is the document's own business and is left exactly as written.
+ */
+
+import { buildFsRawUrl } from '@/shared/lib/fs/paths';
+
+/**
+ * Where the document lives. `path` is relative to the picked scope exactly the
+ * way `/api/fs/raw` and the file panel read it: relative to `repo` when one is
+ * picked, otherwise to `root`.
+ */
+export interface DocumentScope {
+  path: string;
+  root?: string;
+  repo?: string;
+}
+
+export interface ResolvedDocumentReference {
+  /** Scope-relative path of the referenced file — what an editor tab opens. */
+  path: string;
+  /** Raw-bytes URL of the same file, for an `<img src>` or a middle-click. */
+  url: string;
+}
+
+/** A scheme (`https:`), protocol-relative host, fragment, or empty ref. */
+const ABSOLUTE_REFERENCE_RE = /^(?:[a-z][a-z0-9+.-]*:|\/\/|#|$)/i;
+
+/** Collapse `.`/`..` segments; ascending above the scope root is dropped. */
+function normalizeSegments(segments: string[]): string {
+  const out: string[] = [];
+  for (const segment of segments) {
+    if (!segment || segment === '.') continue;
+    if (segment === '..') {
+      out.pop();
+      continue;
+    }
+    out.push(segment);
+  }
+  return out.join('/');
+}
+
+/** `%20`-style escapes are how a markdown link writes a space. */
+function decodeReference(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+/**
+ * Resolve one reference written inside `scope`'s document, or null when it is
+ * not a relative file reference (leave those untouched).
+ */
+export function resolveDocumentReference(
+  reference: string,
+  scope: DocumentScope,
+): ResolvedDocumentReference | null {
+  const raw = reference.trim();
+  if (ABSOLUTE_REFERENCE_RE.test(raw)) return null;
+
+  // `?v=1` and `#section` address the preview, not the file on disk.
+  const withoutQuery = raw.split(/[?#]/)[0];
+  const decoded = decodeReference(withoutQuery);
+  if (!decoded) return null;
+
+  // A leading slash is root-relative (GitHub's repo-root rule), and the scope
+  // frame already IS that root, so it resolves without the document's folder.
+  const rootRelative = /^[/\\]/.test(decoded);
+  const documentDir = scope.path.replace(/\\/g, '/').split('/').slice(0, -1);
+  const segments = decoded.split(/[\\/]+/);
+  const path = normalizeSegments(rootRelative ? segments : [...documentDir, ...segments]);
+  if (!path) return null;
+
+  return { path, url: buildFsRawUrl({ path, root: scope.root, repo: scope.repo }) };
+}
+
+/** Attribute values are injected as HTML, so `&` and `"` must be entities. */
+function escapeAttribute(value: string): string {
+  return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;');
+}
+
+/**
+ * Rewrite the relative `src`/`href` attributes of rendered document HTML.
+ * Fenced code is already escaped by the renderer, so a literal `src="` inside
+ * a code block cannot be mistaken for an attribute.
+ */
+export function rewriteDocumentReferences(html: string, scope: DocumentScope): string {
+  return html.replace(/(\s(?:src|href))="([^"]*)"/g, (match, attribute: string, value: string) => {
+    const resolved = resolveDocumentReference(value, scope);
+    if (!resolved) return match;
+    const url = ` ${attribute.trim()}="${escapeAttribute(resolved.url)}"`;
+    // The resolved path rides along on links only: it is what a click opens as
+    // a tab, and a mid-click still has the raw URL to fall back to.
+    return attribute.trim() === 'href'
+      ? `${url} data-file-path="${escapeAttribute(resolved.path)}"`
+      : url;
+  });
+}

package/src/shared/lib/markdown/marked.ts

@@ -8,17 +8,19 @@
  *
  * Stack (run in order, all server/client safe — parsed synchronously):
  *   1. remend  — heal incomplete markdown while streaming (before parse)
- *   2. marked  — GFM true, breaks true, autolink via marked-linkify-it (CJK
- *      punctuation is not swallowed into URLs), plus a KaTeX extension for
- *      \(...\) inline, \[...\] block, and $$...$$ display math
+ *   2. marked  — GFM true, breaks true, autolink via linkify-it (CJK
+ *      punctuation is not swallowed into URLs, and a match carrying a backtick
+ *      is left to the code-span rule — see autolink.ts), plus a KaTeX
+ *      extension for \(...\) inline, \[...\] block, and $$...$$ display math
  *
  * The resulting HTML is NOT sanitized here — run the output through
- * DOMPurify (see sanitize.ts) before injecting, so raw HTML from the
- * assistant is escaped rather than executed.
+ * DOMPurify (see sanitize.ts) before injecting. What the source's own HTML
+ * means is the caller's call: `renderMarkdown` escapes it (assistant output,
+ * where markup is data) unless `allowHtml` says the source is a document.
  */
 
 import { Marked } from 'marked';
-import markedLinkifyIt from 'marked-linkify-it';
+import { codeSafeAutolink } from '@/shared/lib/markdown/autolink';
 import remend from 'remend';
 import { highlightCode } from '@/shared/lib/code/syntax-highlight';
 import { MATH_PENDING_CLASS } from '@/shared/lib/markdown/katex';
@@ -64,7 +66,7 @@ const marked = new Marked({
   breaks: true,
 });
 
-marked.use(markedLinkifyIt());
+marked.use(codeSafeAutolink());
 
 interface CodeToken {
   type: string;
@@ -217,19 +219,29 @@ function escapeHtmlOutsideCode(source: string): string {
  * parsing so the placeholder URL never leaks into the DOM as an href. */
 const INCOMPLETE_LINK_RE = /\[([^\]]*)\]\(streamdown:incomplete-link\)/g;
 
+export interface RenderMarkdownOptions {
+  /**
+   * Leave the source's own HTML markup intact so marked parses it as markup.
+   *
+   * OFF (default) is the agent-output contract: assistant HTML is data, never
+   * markup, so `<div align="center">` and `<br>` arrive as visible text and
+   * DOMPurify is only the second line of defence. ON is the file-preview
+   * contract, where the source IS the document — a README's `<p align="center">`
+   * block, badge `<img>` and inline `<br>` are the layout its author wrote, and
+   * escaping them shows the tags instead of the page. DOMPurify still sanitizes
+   * the result, so scripts and event handlers never survive either way.
+   */
+  allowHtml?: boolean;
+}
+
 /**
  * Heal streaming markdown (remend) then parse to HTML via marked.
  * Synchronous and side-effect free — safe in both server loaders and the
  * browser. The output must be sanitized with DOMPurify before injection.
- *
- * Raw HTML in the source is escaped (instruksi: assistant HTML is escaped,
- * never rendered) — `<script>`/`<img onerror>` come through as literal text
- * while backtick code is preserved. DOMPurify remains the second line of
- * defence.
  */
-export function renderMarkdown(markdown: string): string {
-  const escaped = escapeHtmlOutsideCode(markdown);
-  const healed = remend(escaped, { katex: true, inlineKatex: true })
+export function renderMarkdown(markdown: string, options: RenderMarkdownOptions = {}): string {
+  const source = options.allowHtml ? markdown : escapeHtmlOutsideCode(markdown);
+  const healed = remend(source, { katex: true, inlineKatex: true })
     .replace(INCOMPLETE_LINK_RE, (_, text: string) => `<span class="md-incomplete-link">${text}</span>`);
   return (marked.parse(healed) as string).trim();
 }

package/src/shared/lib/markdown/mermaid.ts

@@ -18,6 +18,7 @@
  */
 
 import { sanitizeMermaidSvg } from '@/shared/lib/markdown/sanitize';
+import { isDarkTheme } from '@/shared/lib/theme/catalog';
 
 export interface MermaidRenderResult {
   rendered: number;
@@ -34,8 +35,7 @@ let mermaidPromise: Promise<MermaidModule['default']> | null = null;
 let lastThemeKey: ThemeKey | null = null;
 
 function resolveThemeKey(): ThemeKey {
-  const theme = document.documentElement.dataset.theme || document.documentElement.getAttribute('data-theme');
-  return theme === 'one-dark-pro-soft' || theme === 'noir' || theme === 'dark' ? 'dark' : 'default';
+  return isDarkTheme(document.documentElement.dataset.theme || document.documentElement.getAttribute('data-theme')) ? 'dark' : 'default';
 }
 
 function cacheKey(themeKey: ThemeKey, source: string): string {

package/src/shared/lib/models/catalog.ts

@@ -17,7 +17,7 @@ export interface CatalogModelInfo {
   reasoning?: boolean;
   tool_call?: boolean;
   limit?: { context?: number; output?: number };
-  cost?: { input?: number; output?: number; cache_read?: number };
+  cost?: { input?: number; output?: number; cache_read?: number; cache_write?: number };
 }
 
 type ModelsDevCatalog = Record<string, { models?: Record<string, CatalogModelInfo> }>;

package/src/shared/lib/omp/session/schema-migrations.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Additive migrations for `session_stream_state`. `CREATE TABLE IF NOT EXISTS`
+ * leaves an existing table alone, so a database created before `owner_pid`
+ * existed would miss the column and every status read would fail on it.
+ *
+ * Split out of `@/server/lib/db/schema` for the same reason
+ * `@/shared/lib/workspace/schema-migrations` is: the DDL block there owns table
+ * creation, and each later column arrives in the module that explains it.
+ */
+
+import type { DbClient } from '@/server/lib/db/client';
+
+async function addColumn(db: DbClient, statement: string): Promise<void> {
+  try {
+    await db.exec(statement);
+  } catch {
+    // Already present — a fresh install gets the column from the DDL.
+  }
+}
+
+export async function migrateSessionStreamStateColumns(db: DbClient): Promise<void> {
+  // Which chamber process is running the session, so any instance reading this
+  // table can judge a `stream` row it does not own (see stream-state.server.ts).
+  await addColumn(db, 'ALTER TABLE session_stream_state ADD COLUMN owner_pid INTEGER;');
+}

package/src/shared/lib/omp/session/stream-state.server.test.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The staleness rule behind the sidebar's self-heal. Getting it wrong is
+ * user-visible in both directions: too eager clears the spinner of a run that
+ * is still working, too lazy leaves a spinner turning forever for a run whose
+ * process is gone.
+ *
+ * The rule is deliberately a pure function of the ROW plus OS liveness, with no
+ * caller context. That is what makes several chamber instances agree: they all
+ * read the same row and ask the same question about the same pid.
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { isStaleStreamRow } from '@/shared/lib/omp/session/stream-state.server';
+
+const OWNER = 4242;
+const otherInstance = 9999;
+/** OWNER and the other instance are alive; anything else, including 999999, is not. */
+const alive = (pid: number) => pid === OWNER || pid === otherInstance;
+
+describe('isStaleStreamRow', () => {
+  test('a row whose owner is alive is live, whoever is asking', () => {
+    expect(isStaleStreamRow({ session_id: 's1', owner_pid: OWNER }, alive)).toBe(false);
+  });
+
+  test('a row whose owner is gone is stale', () => {
+    expect(isStaleStreamRow({ session_id: 's1', owner_pid: 999999 }, alive)).toBe(true);
+  });
+
+  test('the verdict does not depend on which instance is asking', () => {
+    // The regression this shape exists for: several instances read ONE row and
+    // must report the same status. Judging by the reader's own runtime registry
+    // made a second instance call another instance's live run stale — the row
+    // is live here, and every asker must say so.
+    const row = { session_id: 's1', owner_pid: otherInstance };
+    const verdicts = [otherInstance, OWNER, 12345].map(() => isStaleStreamRow(row, alive));
+    expect(verdicts).toEqual([false, false, false]);
+  });
+
+  test('an ownerless row is stale, because nothing can vouch for its run', () => {
+    expect(isStaleStreamRow({ session_id: 's1', owner_pid: null }, alive)).toBe(true);
+  });
+
+  test('a row owned by the reader is judged by liveness like any other', () => {
+    // Self-ownership is not special-cased: the reader's own pid is alive while
+    // it runs, so its live rows survive.
+    expect(isStaleStreamRow({ session_id: 's1', owner_pid: OWNER }, (pid) => pid === OWNER)).toBe(false);
+  });
+});

package/src/shared/lib/omp/session/stream-state.server.ts

@@ -5,35 +5,49 @@
 
 /**
  * Server-authoritative per-session stream status, persisted in SQLite so the
- * sidebar can render spinner/check from the SAME loader that already refresh
+ * sidebar can render spinner/check from the SAME loader that already refreshes
  * on stream events (`omp:session-updated` → revalidator). Statuses:
  *
- *   stream  — a run is in flight (prompt dispatch → agent_start)
+ *   stream  — a run is in flight (prompt dispatch → agent_end)
  *   finish  — the run ended normally (agent_end), not yet seen
  *   abort   — the user stopped it, not yet seen
  *
  * A terminal status is a one-shot badge: opening the session acknowledges it
  * (`markStreamSeen` deletes the row), which is exactly the "check appears
- * once, disappears when the session is opened" contract. Rows marked
- * `stream` whose session is no longer running when the sidebar loads are
- * stale (chamber restart mid-run) and self-heal to `finish`.
+ * once, disappears when the session is opened" contract.
+ *
+ * `stream` rows record the pid of the chamber process running that session, so
+ * a `stream` row whose owner is gone self-heals to `finish` — see
+ * `healStaleStreamStatuses`. Ownership travels in the row because the database
+ * is SHARED by every chamber instance on the machine (~/.ompchamber/db.sqlite)
+ * while the runtime session registry is per process: without the column, a
+ * second instance opening its sidebar judged the first instance's live run by
+ * its own empty registry and cleared a spinner that was still working.
  *
  * All writes are fire-and-forget: a status write must never fail a prompt,
  * and the sidebar re-reads on the next revalidate anyway.
  */
 
 import { getDb } from '@/server/db.server';
+import { isProcessAlive } from '@/server/lib/lifecycle/identity';
 
 export type SessionStreamStatus = 'stream' | 'finish' | 'abort';
 
 export async function markStreamStatus(sessionId: string, status: SessionStreamStatus): Promise<void> {
   try {
     const db = await getDb();
+    // The owner describes the process running a live row; a terminal badge
+    // belongs to no process, and leaving a pid on it would invite a later read
+    // to judge the badge by the liveness of a process it never concerned.
+    const ownerPid = status === 'stream' ? process.pid : null;
     await db.run(
-      `INSERT INTO session_stream_state (session_id, status, updated_at)
-       VALUES (?, ?, CURRENT_TIMESTAMP)
-       ON CONFLICT(session_id) DO UPDATE SET status = excluded.status, updated_at = excluded.updated_at`,
-      [sessionId, status],
+      `INSERT INTO session_stream_state (session_id, status, owner_pid, updated_at)
+       VALUES (?, ?, ?, CURRENT_TIMESTAMP)
+       ON CONFLICT(session_id) DO UPDATE SET
+         status = excluded.status,
+         owner_pid = excluded.owner_pid,
+         updated_at = excluded.updated_at`,
+      [sessionId, status, ownerPid],
     );
   } catch {
     // Status tracking is best-effort by design.
@@ -97,23 +111,58 @@ export async function loadStreamStatuses(): Promise<Record<string, SessionStream
 }
 
 /**
- * Self-heal: `stream` rows belong to a live chamber process. After a restart
- * mid-run nothing will ever write the terminal status, so at read time a
- * `stream` row with no running session flips to `finish`.
+ * Whether a `stream` row has no live run behind it and must heal to `finish`.
+ *
+ * The owner pid is the only input: a row is live exactly while the process that
+ * wrote it is still running. EVERY chamber instance therefore reaches the same
+ * verdict from the same row — which is the point. Judging a row by the reader's
+ * own runtime registry instead made instances disagree about one run: a second
+ * instance opening its sidebar saw an empty registry, called the first
+ * instance's working run stale, and cleared a spinner that was still turning.
+ *
+ * A row with no owner predates the column and heals: new code always records a
+ * pid for `stream`, so an ownerless `stream` row can only come from an older
+ * process, whose run nothing can vouch for.
+ */
+export function isStaleStreamRow(
+  row: { session_id: string; owner_pid: number | null },
+  isOwnerAlive: (ownerPid: number) => boolean,
+): boolean {
+  if (row.owner_pid === null) return true;
+  return !isOwnerAlive(row.owner_pid);
+}
+
+/**
+ * Self-heal: a `stream` row outlives its owner when a chamber process exits
+ * mid-run (crash, restart, SIGKILL) — nothing will ever write the terminal
+ * status for it. At read time every such row flips to `finish`, which is the
+ * honest outcome: the run is not going to finish.
+ *
+ * Deliberately takes no caller context. Liveness is the same question for every
+ * instance, so it is answered once, here, from the OS — the database is shared
+ * by all of them and they must all read the same status out of it.
+ *
+ * Runs on the sidebar loader's path, so the authoritative status travels with
+ * the same fetch that refreshes the list.
  */
-export async function healStaleStreamStatuses(runningIds: Set<string>): Promise<void> {
+export async function healStaleStreamStatuses(): Promise<void> {
   try {
     const db = await getDb();
-    const rows = (await db.all("SELECT session_id FROM session_stream_state WHERE status = 'stream'")) as {
+    const rows = (await db.all("SELECT session_id, owner_pid FROM session_stream_state WHERE status = 'stream'")) as {
       session_id: string;
+      owner_pid: number | null;
     }[];
-    for (const row of rows) {
-      if (!runningIds.has(row.session_id)) {
-        await db.run("UPDATE session_stream_state SET status = 'finish', updated_at = CURRENT_TIMESTAMP WHERE session_id = ?", [
-          row.session_id,
-        ]);
-      }
-    }
+    const stale = rows.filter((row) => isStaleStreamRow(row, isProcessAlive)).map((row) => row.session_id);
+    if (stale.length === 0) return;
+    // `status = 'stream'` is re-checked in the WHERE clause: a run that started
+    // between the read above and this write owns its row now, and healing it
+    // would clear the spinner of a session that is demonstrably working.
+    const placeholders = stale.map(() => '?').join(', ');
+    await db.run(
+      `UPDATE session_stream_state SET status = 'finish', updated_at = CURRENT_TIMESTAMP
+       WHERE status = 'stream' AND session_id IN (${placeholders})`,
+      stale,
+    );
   } catch {
     // Best-effort.
   }

package/src/shared/lib/settings/client.ts

@@ -76,14 +76,20 @@ export function writeSetting(key: string, value: unknown): void {
 }
 
 /**
- * Write a patch of chamber-blob keys (`theme`, `streamTransport`, …). The blob
- * is kept whole so the durable copy stays one round-trippable object, while the
- * snapshot exposes its keys flat.
+ * Write a patch of chamber-blob keys (`theme`, `streamTransport`, …). The
+ * snapshot exposes the blob's keys flat, so an edit applies to the next read
+ * without a round-trip.
+ *
+ * Only the patch travels, and the server merges it into the stored blob. The
+ * whole local blob must not be republished: this page's copy was taken when it
+ * booted, so a tab left open across an external change (a second tab, a direct
+ * API call) would overwrite the newer keys with its own stale ones on the next
+ * unrelated write — which is exactly how a theme chosen elsewhere reverted.
  */
 export function writeChamberSettings(patch: Record<string, any>): void {
   chamberBlob = { ...chamberBlob, ...patch };
   snapshot = { ...current(), ...patch };
-  sendSettings({ [CHAMBER_SETTINGS_KEY]: chamberBlob });
+  sendSettings({ [CHAMBER_SETTINGS_KEY]: patch });
 }
 
 /** POST a settings patch to SQLite. Fire-and-forget; failures are non-fatal. */

package/src/shared/lib/settings/diff.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from 'bun:test';
+
+import { diffSettings } from '@/shared/lib/settings/diff';
+
+describe('diffSettings', () => {
+  test('an object patch persists only the keys it actually changed', () => {
+    const prev = { theme: 'paper', soundAlerts: true, binaryPath: '/bin/omp' };
+    const next = { ...prev, theme: 'nord-dark' };
+    expect(diffSettings(prev, next, { theme: 'nord-dark' })).toEqual({ theme: 'nord-dark' });
+  });
+
+  test('a no-op patch persists nothing', () => {
+    const prev = { theme: 'paper', soundAlerts: true };
+    expect(diffSettings(prev, { ...prev }, { theme: 'paper' })).toEqual({});
+  });
+
+  test('an updater function persists every key whose value it moved', () => {
+    const prev = { keybindingSend: 'Enter', keybindingNewLine: 'Shift + Enter' };
+    const next = { keybindingSend: 'Ctrl / Cmd + Enter', keybindingNewLine: 'Enter' };
+    expect(diffSettings(prev, next, (state) => ({ ...state, ...next }))).toEqual(next);
+  });
+
+  test('an unrelated update never republishes the theme it read', () => {
+    // The regression this exists for: a tab that booted on `paper` toggling an
+    // unrelated switch in a settings modal whose snapshot predates an external
+    // theme change must not write `theme` back.
+    const prev = { theme: 'paper', chatCompletionSound: true };
+    const patch = { chatCompletionSound: false };
+    expect(diffSettings(prev, { ...prev, ...patch }, patch)).toEqual({ chatCompletionSound: false });
+  });
+});

package/src/shared/lib/settings/diff.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The subset of a settings update that should be persisted.
+ *
+ * The settings modal keeps a full `SettingsState` snapshot from the moment it
+ * opened and hands every edit to one writer. Writing the whole object back
+ * republishes values the user never touched, from a snapshot that may be older
+ * than what another writer (a second tab, an API call) has since stored — the
+ * stale copy wins purely because it was written last.
+ *
+ * A key is persisted only when the update changed it:
+ *
+ * - **Object patch** — the keys it names, but only those whose value actually
+ *   differs, so a no-op re-render does not touch the row.
+ * - **Updater function** — every key whose value differs between `prev` and
+ *   `next`; the function's own intent is not inspectable, so the diff is.
+ *
+ * Values are compared by identity, which is what `SettingsState` holds: strings,
+ * numbers and booleans. A nested object would compare by reference and be
+ * reported as changed — acceptable here, and better than dropping a real edit.
+ */
+export function diffSettings<T extends Record<string, any>>(
+  prev: T,
+  next: T,
+  update: Partial<T> | ((prev: T) => T),
+): Partial<T> {
+  const patch: Partial<T> = {};
+  const keys = typeof update === 'function' ? (Object.keys(next) as (keyof T)[]) : (Object.keys(update) as (keyof T)[]);
+  for (const key of keys) {
+    if (next[key] !== prev[key]) patch[key] = next[key];
+  }
+  return patch;
+}