From 425b293b2801a5520512a70bb01747bfb4d477e5 Mon Sep 17 00:00:00 2001
From: lete114 <me@imlete.cn>
Date: Mon, 25 May 2026 21:31:24 +0800
Subject: [PATCH] fix: prevent send() loopback via sentIds tracking

---
 src/ipc.ts       |  1 +
 test/ipc.test.ts | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/src/ipc.ts b/src/ipc.ts
index 366bb40..1061aa9 100644
--- a/src/ipc.ts
+++ b/src/ipc.ts
@@ -119,6 +119,7 @@ export class IPC {
   send<T>(channel: string, data: T, options: SendOptions<T>): void
   send<T = never>(channel: string, data?: T, options?: SendOptions<T>): void {
     const id = generateId()
+    this.#sentIds.add(id)
     const serialized = options?.serializer && data !== undefined
       ? options.serializer.serialize(data)
       : data
diff --git a/test/ipc.test.ts b/test/ipc.test.ts
index f724bcd..779f250 100644
--- a/test/ipc.test.ts
+++ b/test/ipc.test.ts
@@ -354,6 +354,23 @@ describe('IPC', () => {
     }
   })
 
+  it('ignores self-sent send packet on loopback', () => {
+    const handler = vi.fn()
+    ipc.on('ping', handler)
+
+    ipc.send('ping', { msg: 'hello' })
+
+    const sentPayload = mockTransport.send.mock.calls[0][1]
+    const sentPacket = JSON.parse(sentPayload)
+
+    mockTransport.simulateReceive(
+      `${SYSTEM_DOMAINS.PREFIX}:${SYSTEM_DOMAINS.USER}:test:ping`,
+      JSON.stringify(sentPacket),
+    )
+
+    expect(handler).not.toHaveBeenCalled()
+  })
+
   it('ignores self-sent invoke packet on loopback', async () => {
     ipc.handle('echo', (data: string) => `echo:${data}`)