fix: address CodeRabbit review issues on PR #3312

- SetActiveTab: verify tab belongs to workspace before auto-pinning
- UpdateWorkspacePinnedTabIds: validate and deduplicate input against TabIds
- git subprocess commands: add 10s timeout via context.WithTimeout
- RPC response validation: check resp structure before accessing properties

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: shirayner

frontend/app/view/gitstatus/gitstatus.tsx

@@ -107,7 +107,11 @@ export class GitStatusViewModel implements ViewModel {
             );
             if (this.disposed || this.fetchEpoch !== epoch) return;
 
-            if (resp.error) {
+            if (resp == null || typeof resp !== "object") {
+                globalStore.set(this.errorAtom, "Invalid RPC response");
+                globalStore.set(this.filesAtom, []);
+                globalStore.set(this.branchAtom, "");
+            } else if (resp.error) {
                 globalStore.set(this.errorAtom, resp.error);
                 globalStore.set(this.filesAtom, []);
                 globalStore.set(this.branchAtom, "");

pkg/wcore/workspace.go

@@ -369,7 +369,7 @@ func SetActiveTab(ctx context.Context, workspaceId string, tabId string) error {
 			return fmt.Errorf("tab not found: %q", tabId)
 		}
 		workspace.ActiveTabId = tabId
-		if utilfn.FindStringInSlice(workspace.PinnedTabIds, tabId) == -1 {
+		if utilfn.FindStringInSlice(workspace.TabIds, tabId) != -1 && utilfn.FindStringInSlice(workspace.PinnedTabIds, tabId) == -1 {
 			workspace.PinnedTabIds = append(workspace.PinnedTabIds, tabId)
 		}
 		wstore.DBUpdate(ctx, workspace)
@@ -433,7 +433,19 @@ func UpdateWorkspacePinnedTabIds(ctx context.Context, workspaceId string, pinned
 	if ws == nil {
 		return fmt.Errorf("workspace not found: %q", workspaceId)
 	}
-	ws.PinnedTabIds = pinnedTabIds
+	tabSet := make(map[string]bool, len(ws.TabIds))
+	for _, id := range ws.TabIds {
+		tabSet[id] = true
+	}
+	seen := make(map[string]bool, len(pinnedTabIds))
+	var filtered []string
+	for _, id := range pinnedTabIds {
+		if tabSet[id] && !seen[id] {
+			seen[id] = true
+			filtered = append(filtered, id)
+		}
+	}
+	ws.PinnedTabIds = filtered
 	wstore.DBUpdate(ctx, ws)
 	return nil
 }

pkg/wshrpc/wshremote/gitstatus.go

@@ -12,10 +12,13 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/wavetermdev/waveterm/pkg/wshrpc"
 )
 
+const GitCommandTimeout = 10 * time.Second
+
 func (impl *ServerImpl) RemoteGitStatusCommand(ctx context.Context, data wshrpc.CommandRemoteGitStatusData) (*wshrpc.GitStatusResponse, error) {
 	cwd := data.Cwd
 	if cwd == "" {
@@ -39,6 +42,8 @@ func (impl *ServerImpl) RemoteGitStatusCommand(ctx context.Context, data wshrpc.
 }
 
 func getGitBranch(ctx context.Context, cwd string) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, GitCommandTimeout)
+	defer cancel()
 	cmd := exec.CommandContext(ctx, "git", "branch", "--show-current")
 	cmd.Dir = cwd
 	out, err := cmd.Output()
@@ -49,6 +54,8 @@ func getGitBranch(ctx context.Context, cwd string) (string, error) {
 }
 
 func getGitStatusFiles(ctx context.Context, cwd string) ([]wshrpc.GitStatusFile, error) {
+	ctx, cancel := context.WithTimeout(ctx, GitCommandTimeout)
+	defer cancel()
 	cmd := exec.CommandContext(ctx, "git", "status", "--porcelain")
 	cmd.Dir = cwd
 	out, err := cmd.Output()
@@ -91,7 +98,9 @@ func (impl *ServerImpl) RemoteGitLineDiffCommand(ctx context.Context, data wshrp
 		}
 	}
 
-	cmd := exec.CommandContext(ctx, "git", "diff", "HEAD", "--unified=0", "--", relPath)
+	gitCtx, cancel := context.WithTimeout(ctx, GitCommandTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(gitCtx, "git", "diff", "HEAD", "--unified=0", "--", relPath)
 	cmd.Dir = data.Cwd
 	out, err := cmd.Output()
 	if err != nil {