feat(chat-runtime): tRPC router over commands + WebSocket sink adapter - #6192

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/wsSink/wsSink.ts, line 19:

<comment>The local `open` flag does not protect sends during the WebSocket ready-state race or bound a slow client's send queue. The adapter should apply an equivalent `readyState`/send-error check and slow-consumer limit before calling `socket.send`, otherwise a closed or stalled peer can throw into runtime publication or consume unbounded host memory.</comment>

<file context>
@@ -0,0 +1,27 @@
+	return {
+		send(envelope) {
+			if (!open) return;
+			socket.send(JSON.stringify(envelope));
+		},
+		close() {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/wsSink/wsSink.ts, line 12:

<comment>`createWsSink` permanently hijacks the single `socket.onclose` slot: it snapshots whatever handler is present at creation and overwrites it. Because the README plans for host-service to mount `createWsSink` per socket, the socket will already carry host-managed close handling, and if anything assigns `socket.onclose` after the sink is created (or the host needs to re-parent it later), the sink's `open = false` tracking is silently disabled — peer-close won't flip the flag, so `send()` keeps writing to a dead socket and the original handler is dropped. The design is only correct under the implicit contract that `onclose` is set before the sink is created. Consider chaining without taking ownership (invoke the current `socket.onclose` at close time, or return an object that lets the caller restore it), and guard `send` so a transport-level throw doesn't propagate into the subscription publish path.</comment>

<file context>
@@ -0,0 +1,27 @@
+export function createWsSink(socket: WsSinkSocket): Sink {
+	let open = true;
+	const previous = socket.onclose;
+	socket.onclose = () => {
+		open = false;
+		previous?.();
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/wsSink/wsSink.ts, line 26:

<comment>A failed socket shutdown is silently hidden: after `socket.close()` throws, this sink is permanently closed and callers receive no diagnostic even though the transport may still be open. Preserve best-effort shutdown if needed, but report the exception so leaked connections are diagnosable.</comment>

<file context>
@@ -3,25 +3,38 @@ import type { Sink } from "../../stream";
+		if (socket.onclose === handleClose) socket.onclose = previous;
+		try {
+			socket.close();
+		} catch {}
 	};
+
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/router/router.ts, line 23:

<comment>Valid session IDs containing a line break bypass the typed not-running mapping and surface as `INTERNAL_SERVER_ERROR`; use a multiline-safe capture (or structured command errors) so every protocol-valid ID receives the intended `NOT_FOUND`/`CONFLICT` code.</comment>

<file context>
@@ -1,41 +1,87 @@
+};
+
+const UNKNOWN_HARNESS = /^unknown harness /;
+const NOT_RUNNING = /^chat session (.+) is not running$/;
+
+function mapCommandError(runtime: ChatRuntime, error: unknown): unknown {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/router/router.ts, line 62:

<comment>The `createSession` procedure resolves the host-supplied cwd outside the `guarded` error-mapping wrapper, so a failure in `options.resolveCwd(workspaceId)` (for example, a closed or inaccessible workspace) bypasses `mapCommandError` and reaches tRPC as a raw error/generic internal error rather than a typed command error. Since this PR's goal is to surface typed command errors from every procedure, the cwd-resolution step should be covered by the same guard so the client receives a meaningful code instead of an opaque 500.</comment>

<file context>
@@ -1,41 +1,87 @@
-			.mutation(({ input }) => runtime.commands.createSession(input)),
+			.input(createSessionInputSchema)
+			.mutation(async ({ input }) => {
+				const cwd = await options.resolveCwd(input.workspaceId);
+				return guarded(() => runtime.commands.createSession({ ...input, cwd }));
+			}),
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/chat-runtime/src/router/router/router.test.ts, line 35:

<comment>Each newCaller() creates a temp working directory via mkdtempSync that is never cleaned up, so every test in this file leaks a directory on disk. Track the created cwd and remove it (e.g. rmSync(cwd, { recursive: true, force: true }) in a finally/afterEach) to keep test runs from accumulating temp state.</comment>

<file context>
@@ -29,16 +32,28 @@ const SCRIPT: FakeHarnessScript = {
 	const runtime = createTestRuntime({ harnesses });
-	const caller = createChatCallerFactory(createChatRouter(runtime))({});
-	return { runtime, caller, adapterCount: () => adapters.length };
+	const cwd = mkdtempSync(join(tmpdir(), "chat-router-cwd-"));
+	const resolvedWorkspaceIds: string[] = [];
+	const router = createChatRouter(runtime, {
</file context>