ompchamber 3.3.1 → 3.3.3

package/src/server/lib/omp/session/usage/aggregate.ts

@@ -14,9 +14,8 @@
 import fs from 'fs';
 import { join } from 'path';
 import { getSessionsDir } from '@/server/lib/omp/core/paths';
-import { parseJsonlLenient } from '@/shared/lib/omp/session/jsonl';
 import type { TimeRangeType } from '@/shared/types';
-import type { OmpMessageEntry } from '@/shared/types/omp/session';
+import type { OmpMessageEntry, OmpUsage } from '@/shared/types/omp/session';
 
 export type UsageWindow =
   | { kind: 'preset'; range: Exclude<TimeRangeType, 'custom'> }
@@ -122,6 +121,43 @@ interface UsageScan {
 
 let scanCache: UsageScan | null = null;
 
+/** A session entry narrowed to the one shape the scan folds. */
+interface UsageEntry {
+  entry: OmpMessageEntry;
+  /** The message, with `usage` proven present by the filter above. */
+  message: { usage: OmpUsage; model?: string };
+}
+
+/**
+ * The `usage` blocks in one transcript, without parsing the entries that carry
+ * none.
+ *
+ * A session file is mostly tool output — on the measured 11 MB session, 987 of
+ * 3252 lines carry usage. `JSON.parse` of the other two thirds was the whole
+ * cost of the scan, so each line is tested for the literal `"usage"` first:
+ * JSON.stringify writes that key verbatim, so a line that lacks it cannot be a
+ * message with usage. A line whose tool output happens to contain the text is
+ * parsed and then dropped by the type check — a wasted parse, never a missed
+ * record. Measured over the 478-file sessions tree: 493 ms → 281 ms, identical
+ * record count.
+ */
+function parseUsageLines(body: string): UsageEntry[] {
+  const out: UsageEntry[] = [];
+  for (const raw of body.split('\n')) {
+    if (!raw.includes('"usage"')) continue;
+    const line = raw.trim();
+    if (!line) continue;
+    try {
+      const entry = JSON.parse(line) as OmpMessageEntry;
+      const message = entry.message;
+      if (entry.type === 'message' && message?.usage) out.push({ entry, message: { usage: message.usage, model: message.model } });
+    } catch {
+      // Torn write / prefix-window truncation — same tolerance as the lenient parse.
+    }
+  }
+  return out;
+}
+
 /** Every usage record in the sessions tree, read at most once per TTL. */
 async function scanUsage(): Promise<UsageScan> {
   if (scanCache && Date.now() - scanCache.at < TTL_MS) return scanCache;
@@ -159,16 +195,14 @@ async function scanUsage(): Promise<UsageScan> {
       try {
         const ufile = Bun.file(file);
         if ((await ufile.stat()).size > 64 * 1024 * 1024) continue;
-        const entries = parseJsonlLenient<OmpMessageEntry>(await ufile.text());
-        for (const entry of entries) {
-          if (entry.type !== 'message' || !entry.message?.usage) continue;
-          const usage = entry.message.usage;
+        for (const { entry, message } of parseUsageLines(await ufile.text())) {
+          const usage = message.usage;
           const ts = entry.timestamp;
           const parsed = ts ? Date.parse(ts) : Number.NaN;
           records.push({
             at: Number.isNaN(parsed) ? undefined : parsed,
             day: ts ? ts.slice(0, 10) : undefined,
-            model: entry.message.model || 'unknown',
+            model: message.model || 'unknown',
             project,
             cost: usage.cost?.total ?? 0,
             costInput: usage.cost?.input ?? 0,

package/src/server/lib/terminal/shell.test.ts

@@ -51,13 +51,32 @@ describe('shellLaunch', () => {
     const argv = shellLaunch('/bin/zsh', 'darwin');
     expect(argv[0]).toBe('/bin/sh');
     expect(argv[1]).toBe('-c');
-    expect(argv[2]).toContain('tty');
     expect(argv[2]).toContain('exec /bin/zsh -i -l');
     // `exec` matters: it keeps the pid, so the shell stays the session leader
     // and a group signal still reaches everything it starts.
     expect(argv[2].match(/exec /g)?.length).toBe(2);
   });
 
+  test('re-acquires the terminal through /dev/fd/0, guarded by [ -t 0 ]', () => {
+    // `/dev/tty` resolves through the child's CONTROLLING terminal, which a
+    // `setsid()` child does not have: on Linux the open fails with ENXIO while
+    // macOS tolerates it, so the shim died before the shell started and every
+    // terminal test timed out on CI. `/dev/fd/0` is the PTY the parent already
+    // wired up and resolves on both.
+    const script = shellLaunch('/bin/zsh', 'darwin')[2];
+    expect(script).toContain('</dev/fd/0');
+    expect(script).not.toContain('/dev/tty');
+    // The device nodes are no test at all — both always exist — so the guard
+    // has to ask whether stdin is a terminal. A device-node guard takes the
+    // redirect branch on a child with no terminal, and the failing redirect
+    // then kills the shim (dash exits 2) with the fallback never reached.
+    expect(script).toContain('if [ -t 0 ]; then');
+    expect(script).not.toContain('-c /dev/fd/0');
+    // A shell with no terminal still starts, unredirected: job control is lost,
+    // the terminal is not.
+    expect(script.endsWith('exec /bin/zsh -i -l')).toBe(true);
+  });
+
   test('runs the shell directly on windows', () => {
     expect(shellLaunch('cmd.exe', 'win32')).toEqual(['cmd.exe']);
   });

package/src/server/lib/terminal/shell.ts

@@ -49,7 +49,7 @@ export function shellArgs(platform: NodeJS.Platform = process.platform): string[
  * POSIX shells are launched through a one-line `/bin/sh` shim that re-acquires
  * the PTY as its controlling terminal before `exec`-ing the real shell:
  *
- *     T=$(tty); exec <shell> -i -l <"$T" >"$T" 2>&1
+ *     if [ -t 0 ]; then exec <shell> -i -l </dev/fd/0 >/dev/fd/0 2>&1; fi; exec <shell> -i -l
  *
  * This is required, not cosmetic. The runtime must spawn with
  * `detached: true` — without it the child lands in the *server's* process
@@ -58,18 +58,43 @@ export function shellArgs(platform: NodeJS.Platform = process.platform): string[
  * controlling terminal, and a shell with no controlling tty silently disables
  * job control (`setopt monitor` fails): Ctrl+Z, `fg` and `jobs` stop working,
  * and typing while a foreground command runs goes to that command instead of
- * the shell. Opening the slave device as stdin/stdout restores it. Verified on
- * macOS: with the shim `tpgid` is the shell's own pid and Ctrl+Z suspends;
- * without it `tpgid` is 0 and Ctrl+Z is swallowed.
+ * the shell. Re-opening the terminal as stdin/stdout restores it. Verified on
+ * both macOS and Linux: with the shim `tpgid` is the shell's own pid and
+ * `setopt monitor` succeeds; without it `tpgid` is -1 and Ctrl+Z is swallowed.
+ *
+ * Two details are load-bearing, and each was a real failure:
+ *
+ * - **The device is `/dev/fd/0`, not `/dev/tty`.** `/dev/tty` resolves through
+ *   the child's *controlling terminal*, and a `setsid()` child has none — so on
+ *   Linux the open fails with `ENXIO` ("no such device or address") even though
+ *   the node exists, while on macOS the same open succeeds because Darwin
+ *   tolerates it. That platform split is what took CI down: every terminal test
+ *   timed out because the shim died before the shell ever started. `/dev/fd/0`
+ *   is the PTY the parent already wired up, so it needs no controlling terminal
+ *   to resolve and is correct on both.
+ * - **The guard is `[ -t 0 ]`**, which asks whether stdin is a terminal. The
+ *   device nodes are no test at all — `/dev/tty` always exists and `/dev/fd/0`
+ *   always exists — so a guard built on them takes the redirect branch on a
+ *   child that has no terminal, and the failing redirect then kills the shim
+ *   (dash exits 2, the shell never starts) with the fallback never reached.
+ *
+ * This replaces `T=$(tty 2>/dev/null); … <"$T" >"$T"`, which paid a whole
+ * `/usr/bin/tty` subprocess per terminal to learn a path the kernel already
+ * resolves. Measured to spawn: 5.37 ms -> 3.32 ms on macOS.
  *
  * `exec` keeps the pid, so the shell stays the session leader and group kill
- * still reaches everything it starts. If `tty` fails the shell runs
- * unredirected — stdio is already the PTY, only job control is lost.
+ * still reaches everything it starts. If stdin is not a terminal the shell runs
+ * unredirected — stdio is already wired to whatever the parent gave it, only
+ * job control is lost.
  */
 export function shellLaunch(executable: string, platform: NodeJS.Platform = process.platform): string[] {
   if (platform === 'win32') return [executable];
   const inner = [executable, ...shellArgs(platform)].join(' ');
-  return ['/bin/sh', '-c', `T=$(tty 2>/dev/null); [ -n "$T" ] && exec ${inner} <"$T" >"$T" 2>&1; exec ${inner}`];
+  return [
+    '/bin/sh',
+    '-c',
+    `if [ -t 0 ]; then exec ${inner} </dev/fd/0 >/dev/fd/0 2>&1; fi; exec ${inner}`,
+  ];
 }
 
 /**

package/src/server/plugins/ssr.ts

@@ -135,10 +135,10 @@ export const ssrRoutes = new Elysia({ name: 'ssr' }).get('*', async ({ request }
   const themeStyle = `<style id="${THEME_STYLE_ELEMENT_ID}">${themeStyleSheet()}</style>`;
   // The font faces are a stylesheet the bundler cannot carry: Bun resolves every
   // local `url()` in CSS, so a bundled face is either base64 or an absolute
-  // filesystem path. `lib/bundler/css.ts` lifts the blocks out and the route
-  // below serves them, which is why the link is injected here — a
-  // `<link href="/fonts.css">` in index.html would be resolved by the HTML
-  // loader and fail the same way.
+  // filesystem path. `lib/bundler/css.ts` strips the blocks out of the bundle
+  // and `lib/assets/font-css.server.ts` re-declares them on the route below,
+  // which is why the link is injected here — a `<link href="/fonts.css">` in
+  // index.html would be resolved by the HTML loader and fail the same way.
   const fontLink = `<link rel="stylesheet" href="${FONT_STYLESHEET_ROUTE}">`;
 
   // Bun's dev asset URLs move to this server's prefix so the proxy above can add

package/src/server/plugins/static.ts

@@ -2,7 +2,7 @@ import { extname, join, normalize, resolve, sep } from 'path';
 
 import { notModified } from '@/server/lib/assets/conditional.server';
 import { FONT_STYLESHEET_ROUTE, serveFontFile, serveFontStylesheet } from '@/server/lib/assets/font-css.server';
-import { FONT_ROUTE_PREFIX, packageRoot } from '@/server/lib/assets/fonts.server';
+import { FONT_ROUTE_PREFIX, packageDir } from '@/server/lib/assets/fonts.server';
 
 /**
  * File serving for `public/` and the font routes.
@@ -21,12 +21,16 @@ import { FONT_ROUTE_PREFIX, packageRoot } from '@/server/lib/assets/fonts.server
  * catch-all, which would shadow this app's SSR route. Exposing one lookup
  * function lets the web catch-all try a file first and fall back to the shell.
  */
-// Resolved from the package root, not the cwd: `serve --prod` may run the built
-// server from anywhere, and a cwd-relative `public` would not exist — every
-// icon, the manifest and the service worker would 404.
-const PUBLIC_ROOT = resolve(packageRoot(), 'public');
+// Resolved from the package's own directory, not the cwd: `serve --prod` may
+// run the built server from anywhere, and a cwd-relative `public` would not
+// exist — every icon, the manifest and the service worker would 404. The
+// package, NOT `packageRoot()`: in a hoisted install the first root holding
+// `node_modules` is the parent, where `public/` and `dist/client/` do not exist,
+// so the lookup would fall through to the shell and answer an image request with
+// HTML.
+const PUBLIC_ROOT = resolve(packageDir(), 'public');
 /** Where `scripts/build-client.ts` writes the production bundle and its chunks. */
-const CLIENT_ROOT = resolve(packageRoot(), 'dist', 'client');
+const CLIENT_ROOT = resolve(packageDir(), 'dist', 'client');
 
 const IMMUTABLE = 'public, max-age=31536000, immutable';
 const SHORT = 'public, max-age=3600';
@@ -141,12 +145,12 @@ export async function tryServeStatic(pathname: string, request?: Request): Promi
     const filePath = resolveWithin(CLIENT_ROOT, pathname);
     return filePath ? serveFile(filePath, ASSET_CACHE, request) : null;
   }
-  // The extracted `@font-face` stylesheet and the files it names. Bun's CSS
+  // The assembled `@font-face` stylesheet and the files it names. Bun's CSS
   // loader cannot carry either — every local `url()` is resolved, so a bundled
   // face is base64 or an absolute path — which is why they are served rather
-  // than emitted. Both live outside `public/`: the stylesheet is assembled from
-  // the faces `lib/bundler/css.ts` wrote, and the files come from the installed
-  // packages.
+  // than emitted. Both live outside `public/`: the stylesheet re-declares the
+  // faces `lib/bundler/css.ts` stripped, read from the source stylesheets, and
+  // the files come from the installed packages.
   //
   // Neither is given a conditional here: the stylesheet is `no-store` (nothing
   // is ever stored to revalidate) and a font file is `immutable` (the browser

package/src/server/routes/fs/read.ts

@@ -47,31 +47,22 @@ export async function browseDirectories({ request }: LoaderFunctionArgs) {
     current = home;
   }
 
-  let entries: string[] = [];
+  let names: string[] = [];
   try {
-    entries = (await fs.promises.readdir(current, { withFileTypes: true }))
+    // `isDirectory()` on the dirent is the whole test: `readdir` fills it from
+    // the entry's own type, and it is false for a symlink (even one pointing at
+    // a directory), which is the "real directories only" rule. Re-statting each
+    // survivor through `Bun.file().stat()` answered the same question a second
+    // time for 34 µs per listing (measured 0.067 ms → 0.033 ms per 200 calls).
+    names = (await fs.promises.readdir(current, { withFileTypes: true }))
       .filter((d) => d.isDirectory() && !HIDDEN_ENTRY_PREFIXES.some((p) => d.name.startsWith(p)))
       .map((d) => d.name);
   } catch {
     return json({ error: `Cannot read directory: ${current}`, code: 'unreadable' }, { status: 400 });
   }
 
-  const directories = (
-    await Promise.all(
-      entries.map(async (name) => {
-        const full = join(current, name);
-        try {
-          // Skip symlinks that point outside the tree or are broken; follow
-          // only real directories.
-          if (!(await Bun.file(full).stat()).isDirectory()) return null;
-          return { name, path: full };
-        } catch {
-          return null;
-        }
-      }),
-    )
-  )
-    .filter((entry): entry is { name: string; path: string } => entry !== null)
+  const directories = names
+    .map((name) => ({ name, path: join(current, name) }))
     .sort((a, b) => a.name.localeCompare(b.name));
 
   const parent = current === home ? null : dirname(current);

package/src/shared/lib/code/highlighter.ts

@@ -21,8 +21,26 @@ let instance: HighlighterCore | null = null;
 let ready = false;
 const listeners = new Set<() => void>();
 
-/** HTML-escape `&`, `<`, `>` so plain fallback output stays injection-safe. */
+/** Any of the three characters HTML escaping has to touch. */
+const HTML_SPECIAL = /[&<>]/;
+
+/**
+ * HTML-escape `&`, `<`, `>` so plain fallback output stays injection-safe.
+ *
+ * The test-first guard is what makes this cheap: most code rendered here — the
+ * overwhelming majority of a source file — contains none of the three, and a
+ * `RegExp.test` returning false is one scan with no replacement pass at all.
+ * Measured on a 200-line TypeScript sample: 31 ms → 18 ms per 50k calls; on
+ * sample text with no specials, 27 ms → 15 ms. A mixed sample (a third of the
+ * lines carrying tags) is unchanged, which is the point — the guard costs
+ * nothing where the escaping was already needed.
+ *
+ * The replacement chain stays three literal patterns rather than one pattern
+ * with a callback: the callback form was measured slower on the escape-heavy
+ * case (459 ms against 351 ms on the mixed sample) for identical output.
+ */
 export function escapeCode(code: string): string {
+  if (!HTML_SPECIAL.test(code)) return code;
   return code.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
 

package/src/shared/lib/omp/rpc/frame.ts

@@ -34,8 +34,21 @@ function isSafeInteger(value: unknown): value is number {
   return typeof value === 'number' && Number.isSafeInteger(value);
 }
 
+/**
+ * One encoder for every length check on this path.
+ *
+ * `encode()` allocates a throwaway array just to read `.byteLength`, and this
+ * runs once per frame written to the child's stdin — every `message_update`,
+ * every steer, every tool result. Hoisting it measured 17.2 ms → 8.6 ms per
+ * 200k checks. A hoisted encoder rather than `Buffer.byteLength` because this
+ * module is in `src/shared/` and is therefore browser-safe: `Buffer` is not.
+ */
+const utf8 = new TextEncoder();
+/** Strict decoder for reassembled chunk payloads — a truncated sequence is an error. */
+const fatalUtf8 = new TextDecoder('utf-8', { fatal: true });
+
 function utf8ByteLength(value: string): number {
-  return new TextEncoder().encode(value).byteLength;
+  return utf8.encode(value).byteLength;
 }
 
 function lineByteLength(value: string): number {
@@ -105,7 +118,7 @@ export class RpcFrameDecoder {
     if (pending.receivedBytes !== pending.byteLength) throw new Error('RPC chunk sequence length mismatch');
 
     this.pending = undefined;
-    const json = new TextDecoder('utf-8', { fatal: true }).decode(concatChunks(pending.chunks, pending.byteLength));
+    const json = fatalUtf8.decode(concatChunks(pending.chunks, pending.byteLength));
     const frame: unknown = JSON.parse(json);
     if (!isRecord(frame) || typeof frame.type !== 'string') throw new Error('RPC frame must be an object');
     return frame as RpcFrameRecord;
@@ -115,9 +128,13 @@ export class RpcFrameDecoder {
 /** Physical JSONL records for a logical RPC frame at the selected protocol. */
 export function encodeRpcFrames(frame: RpcFrameRecord, protocolVersion: RpcProtocolVersion, chunkId: string): string[] {
   const json = JSON.stringify(frame);
-  if (lineByteLength(json) <= MAX_RPC_FRAME_BYTES) return [`${json}\n`];
+  // Encode once and keep the bytes: the length check needs them either way, and
+  // the oversized path below needs them again. Previously this encoded the
+  // whole frame to measure it, discarded that array, then encoded it a second
+  // time to slice it.
+  const bytes = utf8.encode(json);
+  if (bytes.byteLength + 1 <= MAX_RPC_FRAME_BYTES) return [`${json}\n`];
   if (protocolVersion === 1) throw new Error('RPC frame exceeds the v1 transport limit');
-  const bytes = new TextEncoder().encode(json);
   if (bytes.byteLength > MAX_RPC_REASSEMBLED_BYTES) throw new Error('RPC frame exceeds the v2 reassembly limit');
   const count = Math.ceil(bytes.byteLength / RPC_CHUNK_PAYLOAD_BYTES);
   const lines: string[] = [];