@alfe.ai/claude-code-host 0.1.6 → 0.1.7

package/dist/host-config.cjs

@@ -5,6 +5,7 @@ let node_path = require("node:path");
 let node_os = require("node:os");
 let node_child_process = require("node:child_process");
 let node_readline = require("node:readline");
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let _alfe_ai_config = require("@alfe.ai/config");
 //#region src/child-env.ts
@@ -72,6 +73,9 @@ function createMapperState() {
 }
 const MAX_ARGS_CHARS = 2e3;
 const MAX_RESULT_CHARS = 4e3;
+const MAX_THINKING_CHARS = 16e3;
+const MAX_PENDING_TOOLS = 256;
+const MAX_PERSISTED_TOOLS = 500;
 function capText(value, max) {
 	if (value.length <= max) return {
 		text: value,
@@ -94,8 +98,8 @@ function safeJson(value, max) {
 	if (!raw) return void 0;
 	return capText(raw, max);
 }
-function asRecord(v) {
-	return v && typeof v === "object" ? v : void 0;
+function asRecord$1(v) {
+	return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
 function asString(v) {
 	return typeof v === "string" && v.length > 0 ? v : void 0;
@@ -105,11 +109,26 @@ function asString(v) {
 * or an array of `{type:'text', text}` parts (Anthropic block form).
 */
 function toolResultText(content) {
-	if (typeof content === "string") return content;
-	if (Array.isArray(content)) return content.map((c) => {
-		const r = asRecord(c);
-		return r?.type === "text" && typeof r.text === "string" ? r.text : "";
-	}).join("");
+	if (typeof content === "string") return capText(content, MAX_RESULT_CHARS);
+	if (Array.isArray(content)) {
+		let text = "";
+		let truncated = false;
+		for (const [index, part] of content.entries()) {
+			const record = asRecord$1(part);
+			if (record?.type !== "text" || typeof record.text !== "string") continue;
+			const remaining = MAX_RESULT_CHARS - text.length;
+			if (record.text.length > remaining) truncated = true;
+			if (remaining > 0) text += record.text.slice(0, remaining);
+			if (text.length >= MAX_RESULT_CHARS) {
+				truncated ||= index < content.length - 1;
+				break;
+			}
+		}
+		return text ? {
+			text,
+			truncated
+		} : void 0;
+	}
 }
 /**
 * Map ONE stream-json event → zero or more emissions, mutating `state`.
@@ -118,8 +137,9 @@ function toolResultText(content) {
 * don't all carry ms epochs); the fixture test injects a fixed clock.
 */
 function mapStreamEvent(state, raw, nowMs) {
-	const evt = asRecord(raw);
+	const evt = asRecord$1(raw);
 	if (!evt) return [];
+	if (state.ended) return [];
 	const type = evt.type;
 	if (type === "system" && evt.subtype === "init") {
 		const sid = asString(evt.session_id);
@@ -127,10 +147,10 @@ function mapStreamEvent(state, raw, nowMs) {
 		return [];
 	}
 	if (type === "stream_event") {
-		const inner = asRecord(evt.event);
+		const inner = asRecord$1(evt.event);
 		if (!inner) return [];
 		if (inner.type === "content_block_delta") {
-			const delta = asRecord(inner.delta);
+			const delta = asRecord$1(inner.delta);
 			if (!delta) return [];
 			if (delta.type === "thinking_delta") {
 				const text = asString(delta.thinking);
@@ -141,7 +161,7 @@ function mapStreamEvent(state, raw, nowMs) {
 					ts: nowMs,
 					activity: {
 						kind: "thinking",
-						text,
+						text: text.slice(0, MAX_THINKING_CHARS),
 						delta: true,
 						ts: nowMs
 					}
@@ -163,17 +183,17 @@ function mapStreamEvent(state, raw, nowMs) {
 		return [];
 	}
 	if (type === "assistant") {
-		const content = asRecord(evt.message)?.content;
+		const content = asRecord$1(evt.message)?.content;
 		if (!Array.isArray(content)) return [];
 		const emissions = [];
 		for (const block of content) {
-			const b = asRecord(block);
+			const b = asRecord$1(block);
 			if (b?.type !== "tool_use") continue;
 			const id = asString(b.id);
 			const name = asString(b.name);
 			if (!id || !name) continue;
 			const args = safeJson(b.input, MAX_ARGS_CHARS);
-			state.pendingTools.set(id, {
+			if (state.pendingTools.has(id) || state.pendingTools.size < MAX_PENDING_TOOLS) state.pendingTools.set(id, {
 				name,
 				argsText: args?.text,
 				argsTruncated: args?.truncated,
@@ -198,18 +218,17 @@ function mapStreamEvent(state, raw, nowMs) {
 		return emissions;
 	}
 	if (type === "user") {
-		const content = asRecord(evt.message)?.content;
+		const content = asRecord$1(evt.message)?.content;
 		if (!Array.isArray(content)) return [];
 		const emissions = [];
 		for (const block of content) {
-			const b = asRecord(block);
+			const b = asRecord$1(block);
 			if (b?.type !== "tool_result") continue;
 			const toolUseId = asString(b.tool_use_id);
 			if (!toolUseId) continue;
 			const pending = state.pendingTools.get(toolUseId);
 			const isError = b.is_error === true;
-			const resultRaw = toolResultText(b.content);
-			const result = resultRaw !== void 0 ? capText(resultRaw, MAX_RESULT_CHARS) : void 0;
+			const result = toolResultText(b.content);
 			const durationMs = pending ? Math.max(0, nowMs - pending.startTs) : void 0;
 			const truncated = {};
 			if (pending?.argsTruncated) truncated.args = true;
@@ -241,7 +260,7 @@ function mapStreamEvent(state, raw, nowMs) {
 		const isError = evt.is_error === true;
 		const finalText = asString(evt.result) ?? state.visibleText;
 		const durationRaw = evt.duration_ms;
-		const durationMs = typeof durationRaw === "number" && Number.isFinite(durationRaw) ? durationRaw : void 0;
+		const durationMs = typeof durationRaw === "number" && Number.isFinite(durationRaw) ? Math.max(0, durationRaw) : void 0;
 		const errorMessage = isError ? asString(evt.result) ?? asString(evt.subtype) ?? "Claude Code turn failed" : void 0;
 		return [{
 			type: "turn-end",
@@ -286,10 +305,11 @@ function collectTurnActivityRecords(emissions) {
 		if (e.type !== "chat-activity") continue;
 		if (e.activity.kind === "thinking") {
 			if (!thinking.text) thinking.ts = e.ts;
-			thinking.text += e.activity.text;
+			if (thinking.text.length < MAX_THINKING_CHARS) thinking.text += e.activity.text.slice(0, MAX_THINKING_CHARS - thinking.text.length);
 		} else {
 			const a = e.activity;
 			const prev = tools.get(a.toolCallId);
+			if (!prev && tools.size >= MAX_PERSISTED_TOOLS) continue;
 			const status = a.status === "running" ? prev?.status ?? "interrupted" : a.status;
 			tools.set(a.toolCallId, {
 				kind: "tool",
@@ -324,7 +344,7 @@ function collectTurnActivityRecords(emissions) {
 * TWO modes (Phase 2 plan, decision 2026-07-12):
 *
 *  1. **chat (per-turn spawn):** each Alfe turn spawns a fresh
-*     `claude -p <prompt> --resume <claudeSessionId> --output-format stream-json
+*     `claude -p --resume <claudeSessionId> --output-format stream-json
 *     --include-partial-messages ...`, streams its stdout line-by-line through
 *     `mapStreamEvent`, and resolves when the terminal `result` event lands (or
 *     the child exits). Each conversation carries its own claude session lineage
@@ -371,7 +391,7 @@ const DEFAULT_CLAUDE_BIN = "claude";
 * posture). An inbound chat message could try to induce a destructive shell
 * command, and these turns run unattended on the user's machine. We therefore
 * pass an explicit allow-list of read/analysis/edit tools and DENY Bash by
-* default, and use `--permission-mode default` (NEVER `bypassPermissions` /
+* default, and use `--permission-mode dontAsk` (NEVER `bypassPermissions` /
 * `--dangerously-skip-permissions`). See DEVELOPING.md → "Tool-permission
 * posture". Bash is intentionally absent — a bridged turn cannot run arbitrary
 * shell. Callers that want a wider set pass `allowedTools` explicitly.
@@ -388,8 +408,19 @@ const DEFAULT_ALLOWED_TOOLS = [
 	"Task",
 	"TodoWrite"
 ];
-/** Sane default permission posture. NEVER `bypassPermissions`. */
-const DEFAULT_PERMISSION_MODE = "default";
+const CLAUDE_PERMISSION_MODES = [
+	"acceptEdits",
+	"auto",
+	"manual",
+	"dontAsk",
+	"plan"
+];
+/**
+* Headless-safe permission posture supported by current Claude CLI releases.
+* Allow-listed tools run; any permission prompt the bridge cannot answer is
+* denied. `bypassPermissions` is deliberately not representable.
+*/
+const DEFAULT_PERMISSION_MODE = "dontAsk";
 /**
 * Hard cap on a single turn (E2). Deliberately BELOW the chat service's RPC
 * timeout (`AGENT_TIMEOUT_SEC=300` → 305s in daemon-server) so the host settles
@@ -399,6 +430,10 @@ const DEFAULT_PERMISSION_MODE = "default";
 * cap, but the late settle is harmlessly no-op'd by the chat service.
 */
 const TURN_TIMEOUT_MS = 3e5;
+/** Grace after SIGINT before SIGKILL + local settlement. Keeps E2 under 305s. */
+const TERMINATION_GRACE_MS = 2e3;
+const MAX_STDERR_CHARS = 16e3;
+const MAX_RETAINED_ACTIVITY_EMISSIONS = 1e3;
 /** Substrings that mark a subscription rate-limit → fail fast (E2). */
 const RATE_LIMIT_MARKERS = [
 	"rate limit",
@@ -418,6 +453,7 @@ function looksRateLimited(text) {
 */
 var SessionDriver = class {
 	child = null;
+	abortCurrent = null;
 	bin;
 	baseEnv;
 	log;
@@ -438,28 +474,30 @@ var SessionDriver = class {
 	* child's exit drives `runTurn` to settle with `aborted: true`.
 	*/
 	abort() {
-		if (this.child) try {
-			this.child.kill("SIGINT");
-		} catch {}
+		this.abortCurrent?.();
 	}
 	/**
 	* Run ONE turn. Modes reconcile to the same per-turn spawn (see header
 	* VERIFICATION) — `voice` is accepted for API symmetry and future warm mode.
 	*/
 	async runTurn(params, mode = "chat") {
+		if (this.busy) throw new Error("SessionDriver is already running a turn");
 		return this.runPerTurn(params);
 	}
 	buildArgs(params) {
 		const allowed = (params.allowedTools ?? DEFAULT_ALLOWED_TOOLS).join(",");
+		const permissionMode = params.permissionMode ?? "dontAsk";
+		if (!CLAUDE_PERMISSION_MODES.includes(permissionMode)) throw new Error(`Unsupported Claude permission mode: ${permissionMode}`);
 		const args = [
 			"-p",
-			params.prompt,
+			"--input-format",
+			"text",
 			"--output-format",
 			"stream-json",
 			"--include-partial-messages",
 			"--verbose",
 			"--permission-mode",
-			params.permissionMode ?? "default",
+			permissionMode,
 			"--allowedTools",
 			allowed
 		];
@@ -473,9 +511,12 @@ var SessionDriver = class {
 		const now = params.now ?? (() => Date.now());
 		const state = createMapperState();
 		const emissions = [];
+		let latestTextEmission = null;
 		let aborted = false;
 		let settled = false;
-		const stderrChunks = [];
+		let terminationReason = null;
+		let stderr = "";
+		let rateLimited = false;
 		const args = this.buildArgs(params);
 		const env = buildChildEnv(this.baseEnv);
 		return new Promise((resolve) => {
@@ -503,39 +544,63 @@ var SessionDriver = class {
 				return;
 			}
 			this.child = child;
-			try {
-				child.stdin.end();
-			} catch {}
-			const timeout = setTimeout(() => {
-				this.log.warn("[session-driver] turn exceeded the time cap — aborting");
-				try {
-					child.kill("SIGINT");
-				} catch {}
-				finish(true, "Turn exceeded the time cap");
-			}, TURN_TIMEOUT_MS);
-			timeout.unref();
+			let escalation;
+			const rl = (0, node_readline.createInterface)({ input: child.stdout });
 			const finish = (isError, errorMessage) => {
 				if (settled) return;
 				settled = true;
 				clearTimeout(timeout);
-				this.child = null;
+				if (escalation) clearTimeout(escalation);
+				rl.close();
+				if (this.child === child) this.child = null;
+				this.abortCurrent = null;
 				const end = emissions.find((e) => e.type === "turn-end");
 				const endIsError = end?.type === "turn-end" ? end.isError : false;
 				const endText = end?.type === "turn-end" ? end.finalText : state.visibleText;
 				const endErrMsg = end?.type === "turn-end" ? end.errorMessage : void 0;
-				const stderr = stderrChunks.join("");
 				const finalIsError = isError || endIsError;
-				const finalErrMsg = errorMessage ?? endErrMsg ?? (finalIsError ? looksRateLimited(stderr) ? "Claude subscription rate limit hit — try again shortly" : stderr.trim().slice(0, 500) || "Claude Code turn failed" : void 0);
+				const finalErrMsg = errorMessage ?? endErrMsg ?? (finalIsError ? rateLimited || looksRateLimited(stderr) ? "Claude subscription rate limit hit — try again shortly" : stderr.trim().slice(0, 500) || "Claude Code turn failed" : void 0);
+				const retainedEmissions = latestTextEmission ? [...emissions, latestTextEmission].sort((a, b) => a.seq - b.seq) : emissions;
 				resolve({
 					claudeSessionId: state.claudeSessionId,
-					emissions,
+					emissions: retainedEmissions,
 					isError: finalIsError,
 					finalText: finalIsError ? "" : endText,
 					...finalErrMsg ? { errorMessage: finalErrMsg } : {},
 					aborted
 				});
 			};
-			(0, node_readline.createInterface)({ input: child.stdout }).on("line", (line) => {
+			const requestTermination = (reason) => {
+				if (settled || terminationReason) return;
+				terminationReason = reason;
+				aborted = reason === "abort";
+				if (reason === "timeout") this.log.warn("[session-driver] turn exceeded the time cap — aborting");
+				try {
+					child.kill("SIGINT");
+				} catch {}
+				escalation = setTimeout(() => {
+					if (settled) return;
+					try {
+						child.kill("SIGKILL");
+					} catch {}
+					finish(reason === "timeout", reason === "timeout" ? "Turn exceeded the time cap" : void 0);
+				}, TERMINATION_GRACE_MS);
+				escalation.unref();
+			};
+			this.abortCurrent = () => {
+				requestTermination("abort");
+			};
+			const timeout = setTimeout(() => {
+				requestTermination("timeout");
+			}, TURN_TIMEOUT_MS);
+			timeout.unref();
+			try {
+				child.stdin.end(params.prompt);
+			} catch {
+				requestTermination("abort");
+			}
+			rl.on("line", (line) => {
+				if (settled || terminationReason) return;
 				const trimmed = line.trim();
 				if (!trimmed) return;
 				let evt;
@@ -545,7 +610,8 @@ var SessionDriver = class {
 					return;
 				}
 				for (const emission of mapStreamEvent(state, evt, now())) {
-					emissions.push(emission);
+					if (emission.type === "chat-delta") latestTextEmission = emission;
+					else if (emission.type === "turn-end" || emissions.length < MAX_RETAINED_ACTIVITY_EMISSIONS) emissions.push(emission);
 					try {
 						params.onEmission(emission);
 					} catch (err) {
@@ -554,17 +620,26 @@ var SessionDriver = class {
 				}
 			});
 			child.stderr.on("data", (chunk) => {
-				stderrChunks.push(chunk.toString("utf-8"));
+				if (settled) return;
+				const text = chunk.toString("utf-8");
+				rateLimited ||= looksRateLimited(text);
+				stderr = `${stderr}${text}`.slice(-MAX_STDERR_CHARS);
 			});
 			child.on("error", (err) => {
-				finish(true, `claude process error: ${err.message}`);
+				if (terminationReason === "abort") finish(false);
+				else if (terminationReason === "timeout") finish(true, "Turn exceeded the time cap");
+				else finish(true, `claude process error: ${err.message}`);
 			});
 			child.on("close", (code, signal) => {
-				if (signal === "SIGINT" || signal === "SIGTERM") {
+				if (terminationReason === "abort" || signal === "SIGINT" || signal === "SIGTERM") {
 					aborted = true;
 					finish(false);
 					return;
 				}
+				if (terminationReason === "timeout") {
+					finish(true, "Turn exceeded the time cap");
+					return;
+				}
 				const sawResult = emissions.some((e) => e.type === "turn-end");
 				if (code !== 0 && !sawResult) {
 					finish(true);
@@ -576,6 +651,28 @@ var SessionDriver = class {
 	}
 };
 //#endregion
+//#region src/atomic-write.ts
+/**
+* Replace a local state file atomically. The temporary file deliberately does
+* not end in `.json`, so session scanners never mistake an interrupted write
+* for a real session.
+*/
+async function writeTextAtomically(path, contents) {
+	const parent = (0, node_path.dirname)(path);
+	await (0, node_fs_promises.mkdir)(parent, { recursive: true });
+	const temporary = (0, node_path.join)(parent, `.${(0, node_path.basename)(path)}.${String(process.pid)}.${(0, node_crypto.randomUUID)()}.tmp`);
+	try {
+		await (0, node_fs_promises.writeFile)(temporary, contents, {
+			encoding: "utf-8",
+			mode: 384
+		});
+		await (0, node_fs_promises.rename)(temporary, path);
+	} catch (error) {
+		await (0, node_fs_promises.unlink)(temporary).catch(() => void 0);
+		throw error;
+	}
+}
+//#endregion
 //#region src/session/session-store.ts
 /**
 * Session Store — persists chat sessions to the local filesystem.
@@ -612,6 +709,18 @@ function sessionPath(sessionId) {
 	const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
 	return (0, node_path.join)(sessionsDir(), `${safe}.json`);
 }
+function asSessionData(value, expectedSessionId) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (typeof record.sessionId !== "string" || expectedSessionId !== void 0 && record.sessionId !== expectedSessionId || typeof record.agentId !== "string" || typeof record.channel !== "string" || typeof record.createdAt !== "string" || typeof record.updatedAt !== "string" || !Array.isArray(record.messages)) return null;
+	if (!record.messages.every((message) => {
+		if (!message || typeof message !== "object" || Array.isArray(message)) return false;
+		const item = message;
+		return (item.role === "user" || item.role === "assistant") && typeof item.content === "string" && typeof item.timestamp === "number" && Number.isFinite(item.timestamp);
+	})) return null;
+	if (record.activity !== void 0 && !Array.isArray(record.activity)) return null;
+	return value;
+}
 async function cleanupOldSessions() {
 	if (Date.now() - lastCleanupAt < CLEANUP_INTERVAL_MS) return;
 	const dir = sessionsDir();
@@ -623,6 +732,7 @@ async function cleanupOldSessions() {
 				const filePath = (0, node_path.join)(dir, file);
 				if (now - (await (0, node_fs_promises.stat)(filePath)).mtimeMs > MAX_AGE_MS) await (0, node_fs_promises.unlink)(filePath);
 			} catch {}
+			lastCleanupAt = Date.now();
 			return;
 		}
 		const fileStats = [];
@@ -650,7 +760,7 @@ async function cleanupOldSessions() {
 async function getSession(sessionId) {
 	try {
 		const data = await (0, node_fs_promises.readFile)(sessionPath(sessionId), "utf-8");
-		return JSON.parse(data);
+		return asSessionData(JSON.parse(data), sessionId);
 	} catch {
 		return null;
 	}
@@ -658,7 +768,7 @@ async function getSession(sessionId) {
 async function saveSession(session) {
 	await ensureDir();
 	session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-	await (0, node_fs_promises.writeFile)(sessionPath(session.sessionId), JSON.stringify(session, null, 2), "utf-8");
+	await writeTextAtomically(sessionPath(session.sessionId), JSON.stringify(session, null, 2));
 }
 async function createSession(sessionId, agentId, channel, tenantId, userId) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -734,7 +844,8 @@ async function listSessions(filters, limit = 50) {
 	const summaries = [];
 	for (const file of jsonFiles) try {
 		const data = await (0, node_fs_promises.readFile)((0, node_path.join)(dir, file), "utf-8");
-		const session = JSON.parse(data);
+		const session = asSessionData(JSON.parse(data));
+		if (!session) continue;
 		if (filters?.agentId && session.agentId !== filters.agentId) continue;
 		if (filters?.channel && session.channel !== filters.channel) continue;
 		if (filters?.tenantId && session.tenantId !== filters.tenantId) continue;
@@ -756,7 +867,8 @@ async function listSessions(filters, limit = 50) {
 		const aTime = a.lastMessageAt ?? a.createdAt;
 		return (b.lastMessageAt ?? b.createdAt).localeCompare(aTime);
 	});
-	return summaries.slice(0, limit);
+	const boundedLimit = Number.isFinite(limit) ? Math.min(100, Math.max(1, Math.trunc(limit))) : 50;
+	return summaries.slice(0, boundedLimit);
 }
 //#endregion
 //#region src/host.ts
@@ -807,6 +919,72 @@ const PERSONA_POINTER_SYSTEM_PROMPT = [
 	"Your identity, persona, voice, and operating instructions live in CLAUDE.md and the other files in your workspace.",
 	"Fully embody that persona in how you speak and act; respond AS that agent, not as a generic coding assistant."
 ].join("\n");
+const MAX_AGENT_MESSAGE_BYTES = 256 * 1024;
+const MAX_SESSION_KEY_CHARS = 768;
+const MAX_IDENTIFIER_CHARS = 512;
+const MAX_MEMORY_CONTEXT_CHARS = 64 * 1024;
+const MAX_CLAUDE_SESSION_IDS = 1e3;
+const MAX_IDEMPOTENCY_KEYS = 1e4;
+const SHUTDOWN_GRACE_MS = 3e3;
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function hasControlCharacters(value) {
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 32 || code === 127) return true;
+	}
+	return false;
+}
+function readBoundedString(record, key, maxChars, required = false) {
+	const value = record[key];
+	if (value === void 0 && !required) return void 0;
+	if (typeof value !== "string" || value.length === 0 || value.length > maxChars || hasControlCharacters(value)) throw new Error(`Invalid ${key}`);
+	return value;
+}
+function parseAgentRpcParams(value) {
+	const record = asRecord(value);
+	if (!record) throw new Error("Invalid agent params");
+	const message = record.message;
+	if (typeof message !== "string" || message.length === 0 || Buffer.byteLength(message, "utf-8") > MAX_AGENT_MESSAGE_BYTES) throw new Error("Invalid message");
+	const agentId = readBoundedString(record, "agentId", 128, true);
+	if (!/^[A-Za-z0-9_-]+$/u.test(agentId)) throw new Error("Invalid agentId");
+	const sessionKey = readBoundedString(record, "sessionKey", MAX_SESSION_KEY_CHARS, true);
+	const prefix = `agent:${agentId}:`;
+	if (!sessionKey.startsWith(prefix) || sessionKey.length === prefix.length) throw new Error("Invalid sessionKey");
+	const bareSessionId = stripAgentPrefix(sessionKey);
+	const conversationId = readBoundedString(record, "conversationId", MAX_IDENTIFIER_CHARS);
+	if (conversationId !== void 0 && conversationId !== bareSessionId) throw new Error("conversationId does not match sessionKey");
+	if (record.coalesce !== void 0 && record.coalesce !== "replace") throw new Error("Invalid coalesce mode");
+	if (record.origin !== void 0 && record.origin !== "voice") throw new Error("Invalid origin");
+	if (record.conversationType !== void 0 && record.conversationType !== "direct" && record.conversationType !== "group") throw new Error("Invalid conversationType");
+	return {
+		message,
+		agentId,
+		sessionKey,
+		...conversationId ? { conversationId } : {},
+		...record.coalesce === "replace" ? { coalesce: "replace" } : {},
+		...record.origin === "voice" ? { origin: "voice" } : {},
+		...record.conversationType === "direct" || record.conversationType === "group" ? { conversationType: record.conversationType } : {},
+		...copyOptionalStrings(record, [
+			["idempotencyKey", 256],
+			["clientType", 64],
+			["userId", MAX_IDENTIFIER_CHARS],
+			["identityId", MAX_IDENTIFIER_CHARS],
+			["tenantId", MAX_IDENTIFIER_CHARS],
+			["displayName", 256],
+			["chatMessageId", MAX_IDENTIFIER_CHARS]
+		])
+	};
+}
+function copyOptionalStrings(record, fields) {
+	const result = {};
+	for (const [key, maxChars] of fields) {
+		const value = readBoundedString(record, key, maxChars);
+		if (value !== void 0) result[key] = value;
+	}
+	return result;
+}
 /**
 * One FIFO backlog PER claude-session key. Unlike openclaw-chat's single
 * per-daemon queue, the Claude Code host spawns a distinct `claude -p` per
@@ -817,9 +995,23 @@ const PERSONA_POINTER_SYSTEM_PROMPT = [
 */
 var PerSessionQueues = class {
 	backlogs = /* @__PURE__ */ new Map();
-	draining = /* @__PURE__ */ new Set();
+	runningKeys = /* @__PURE__ */ new Set();
+	readyKeys = [];
+	readyKeySet = /* @__PURE__ */ new Set();
+	activeCount = 0;
+	queuedCount = 0;
+	stoppedError = null;
+	idleWaiters = [];
+	constructor(maxConcurrent = 4, maxQueued = 100) {
+		this.maxConcurrent = maxConcurrent;
+		this.maxQueued = maxQueued;
+	}
 	enqueue(key, task, opts) {
 		return new Promise((resolve, reject) => {
+			if (this.stoppedError) {
+				reject(this.stoppedError);
+				return;
+			}
 			const entry = {
 				run: task,
 				coalesceKey: opts?.coalesceKey,
@@ -835,40 +1027,83 @@ var PerSessionQueues = class {
 						queued.onSuperseded();
 					} catch {}
 					queued.resolve();
+					this.queuedCount -= 1;
 				} else survivors.push(queued);
 				backlog.length = 0;
 				backlog.push(...survivors);
 			}
+			if (this.queuedCount >= this.maxQueued) {
+				reject(/* @__PURE__ */ new Error("Claude Code turn queue is full"));
+				return;
+			}
 			backlog.push(entry);
+			this.queuedCount += 1;
 			this.backlogs.set(key, backlog);
-			this.drain(key);
+			this.markReady(key);
+			this.pump();
 		});
 	}
-	async drain(key) {
-		if (this.draining.has(key)) return;
-		this.draining.add(key);
-		try {
-			const backlog = this.backlogs.get(key);
-			while (backlog && backlog.length > 0) {
-				const entry = backlog.shift();
-				if (!entry) break;
-				try {
-					await entry.run();
-					entry.resolve();
-				} catch (err) {
-					entry.reject(err);
-				}
+	markReady(key) {
+		if (this.runningKeys.has(key) || this.readyKeySet.has(key)) return;
+		if ((this.backlogs.get(key)?.length ?? 0) === 0) return;
+		this.readyKeySet.add(key);
+		this.readyKeys.push(key);
+	}
+	pump() {
+		while (this.activeCount < this.maxConcurrent && this.readyKeys.length > 0) {
+			const key = this.readyKeys.shift();
+			if (!key) break;
+			this.readyKeySet.delete(key);
+			if (this.runningKeys.has(key)) continue;
+			const entry = this.backlogs.get(key)?.shift();
+			if (!entry) {
+				this.backlogs.delete(key);
+				continue;
 			}
+			this.queuedCount -= 1;
+			this.runningKeys.add(key);
+			this.activeCount += 1;
+			this.runOne(key, entry);
+		}
+	}
+	async runOne(key, entry) {
+		try {
+			await entry.run();
+			entry.resolve();
+		} catch (err) {
+			entry.reject(err);
 		} finally {
-			this.draining.delete(key);
-			if (this.backlogs.get(key)?.length === 0) this.backlogs.delete(key);
+			this.runningKeys.delete(key);
+			this.activeCount -= 1;
+			if (this.backlogs.get(key)?.length) this.markReady(key);
+			else this.backlogs.delete(key);
+			this.resolveIdleIfNeeded();
+			this.pump();
 		}
 	}
+	stop(error = /* @__PURE__ */ new Error("Claude Code host is stopping")) {
+		if (this.stoppedError) return;
+		this.stoppedError = error;
+		for (const backlog of this.backlogs.values()) for (const entry of backlog) entry.reject(error);
+		this.backlogs.clear();
+		this.readyKeys = [];
+		this.readyKeySet.clear();
+		this.queuedCount = 0;
+		this.resolveIdleIfNeeded();
+	}
+	whenIdle() {
+		if (this.activeCount === 0) return Promise.resolve();
+		return new Promise((resolve) => this.idleWaiters.push(resolve));
+	}
+	resolveIdleIfNeeded() {
+		if (this.activeCount !== 0) return;
+		const waiters = this.idleWaiters;
+		this.idleWaiters = [];
+		for (const resolve of waiters) resolve();
+	}
 	/** Test/introspection: total queued (not-yet-started) turns across all keys. */
 	backlogLength() {
-		let n = 0;
-		for (const b of this.backlogs.values()) n += b.length;
-		return n;
+		return this.queuedCount;
 	}
 };
 var ClaudeCodeHost = class {
@@ -893,6 +1128,9 @@ var ClaudeCodeHost = class {
 	seenIdempotencyKeys = /* @__PURE__ */ new Map();
 	/** RPC sessionKey → resolved SessionDriver so chat.abort can SIGINT the child. */
 	activeDriverBySession = /* @__PURE__ */ new Map();
+	claudeSessionSave = Promise.resolve();
+	stopping = false;
+	stopPromise = null;
 	constructor(cfg, deps) {
 		this.cfg = cfg;
 		this.log = cfg.logger ?? console;
@@ -919,18 +1157,38 @@ var ClaudeCodeHost = class {
 	}
 	/** Start the chat WS. Non-blocking — the client reconnects internally. */
 	async start() {
+		if (this.stopping) throw new Error("Claude Code host is stopping");
 		await this.loadClaudeSessionIds();
 		this.chat.start();
 	}
-	/** Stop the chat WS (SIGTERM path). */
+	/** Stop admission, abort owned children, and give active turns time to settle. */
 	stop() {
+		if (this.stopPromise) return this.stopPromise;
+		this.stopping = true;
+		this.queues.stop();
+		for (const driver of this.activeDriverBySession.values()) driver.abort();
 		this.chat.stop();
+		this.stopPromise = (async () => {
+			let timer;
+			try {
+				await Promise.race([this.queues.whenIdle(), new Promise((resolve) => {
+					timer = setTimeout(resolve, SHUTDOWN_GRACE_MS);
+				})]);
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+		})();
+		return this.stopPromise;
 	}
 	/**
 	* Inbound RPC dispatch. Invoked by the chat client's `onRequest` in
 	* production; also the test seam (drive `agent`/`chat.abort`/… directly).
 	*/
 	async handleRequest(req) {
+		if (this.stopping) {
+			this.chat.sendResponse(req.id, false, { message: "Claude Code host is stopping" });
+			return;
+		}
 		try {
 			switch (req.method) {
 				case "agent":
@@ -959,28 +1217,31 @@ var ClaudeCodeHost = class {
 		}
 	}
 	async handleAgent(req) {
-		const params = req.params;
+		const params = parseAgentRpcParams(req.params);
 		const sessionKey = params.sessionKey;
-		if (typeof sessionKey !== "string" || !sessionKey) {
-			this.chat.sendResponse(req.id, false, { message: "Missing sessionKey" });
-			return;
-		}
 		const idem = params.idempotencyKey;
+		if (idem) this.pruneIdempotency();
 		if (idem && this.seenIdempotencyKeys.has(idem)) {
 			this.chat.sendResponse(req.id, true, { sessionKey });
 			return;
 		}
-		if (idem) this.pruneIdempotency();
+		const claimedAt = idem ? Date.now() : void 0;
+		if (idem && claimedAt !== void 0) this.seenIdempotencyKeys.set(idem, claimedAt);
 		const coalesceKey = params.coalesce === "replace" ? sessionKey : void 0;
-		await this.queues.enqueue(sessionKey, () => this.runAgentTurn(req, params), coalesceKey ? {
-			coalesceKey,
-			onSuperseded: () => {
-				this.chat.sendResponse(req.id, true, {
-					superseded: true,
-					sessionKey
-				});
-			}
-		} : void 0);
+		try {
+			await this.queues.enqueue(sessionKey, () => this.runAgentTurn(req, params), coalesceKey ? {
+				coalesceKey,
+				onSuperseded: () => {
+					this.chat.sendResponse(req.id, true, {
+						superseded: true,
+						sessionKey
+					});
+				}
+			} : void 0);
+		} catch (error) {
+			if (idem && this.seenIdempotencyKeys.get(idem) === claimedAt) this.seenIdempotencyKeys.delete(idem);
+			throw error;
+		}
 	}
 	async runAgentTurn(req, params) {
 		const sessionKey = params.sessionKey;
@@ -991,10 +1252,11 @@ var ClaudeCodeHost = class {
 		await addMessage(bareSessionId, "user", params.message, params.identityId ?? params.userId, params.displayName);
 		let memoryContext = "";
 		try {
-			memoryContext = (await this.api.memoryLoadContext()).formatted;
+			memoryContext = (await this.api.memoryLoadContext()).formatted.slice(0, MAX_MEMORY_CONTEXT_CHARS);
 		} catch (err) {
 			this.log.warn(`[claude-host] memoryLoadContext failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (this.stopping) throw new Error("Claude Code host is stopping");
 		const appendSystemPrompt = this.buildSystemPrompt(memoryContext, isVoice);
 		const claudeSessionId = this.claudeSessionIds.get(bareSessionId) ?? null;
 		const driver = this.makeDriver();
@@ -1019,7 +1281,7 @@ var ClaudeCodeHost = class {
 			if (params.idempotencyKey) this.seenIdempotencyKeys.set(params.idempotencyKey, Date.now());
 		}
 		if (result.claudeSessionId && result.claudeSessionId !== claudeSessionId) {
-			this.claudeSessionIds.set(bareSessionId, result.claudeSessionId);
+			this.rememberClaudeSessionId(bareSessionId, result.claudeSessionId);
 			await this.saveClaudeSessionIds();
 		}
 		const activityRecords = collectTurnActivityRecords(result.emissions);
@@ -1061,7 +1323,7 @@ var ClaudeCodeHost = class {
 	*/
 	async runWithResumeFallback(driver, bareSessionId, _sessionKey, _runId, baseParams, isVoice) {
 		const first = await driver.runTurn(baseParams, isVoice ? "voice" : "chat");
-		if (!(baseParams.claudeSessionId !== null && first.isError && first.claudeSessionId === null && first.emissions.length === 0)) return first;
+		if (!(baseParams.claudeSessionId !== null && first.isError && first.claudeSessionId === null && first.emissions.length === 0) || this.stopping) return first;
 		this.log.warn(`[claude-host] --resume failed for ${bareSessionId}; starting a fresh claude session`);
 		this.claudeSessionIds.delete(bareSessionId);
 		const history = await this.buildHistoryPreamble(bareSessionId);
@@ -1118,24 +1380,25 @@ var ClaudeCodeHost = class {
 		this.chat.sendResponse(req.id, true, { aborted });
 	}
 	async handleSessionsList(req) {
-		const params = req.params;
+		const params = asRecord(req.params);
+		if (!params) throw new Error("Invalid sessions.list params");
 		const sessions = await listSessions({
-			channel: params.channel,
-			tenantId: params.tenantId,
-			userId: params.userId
+			channel: readBoundedString(params, "channel", 64),
+			tenantId: readBoundedString(params, "tenantId", MAX_IDENTIFIER_CHARS),
+			userId: readBoundedString(params, "userId", MAX_IDENTIFIER_CHARS)
 		});
 		this.chat.sendResponse(req.id, true, { sessions });
 	}
 	async handleSessionsGet(req) {
-		const params = req.params;
-		if (!params.sessionId) {
-			this.chat.sendResponse(req.id, false, { message: "Missing sessionId" });
-			return;
-		}
-		const session = await getSession(params.sessionId);
-		if (!session) {
+		const params = asRecord(req.params);
+		if (!params) throw new Error("Invalid sessions.get params");
+		const sessionId = readBoundedString(params, "sessionId", MAX_IDENTIFIER_CHARS, true);
+		const tenantId = readBoundedString(params, "tenantId", MAX_IDENTIFIER_CHARS);
+		const userId = readBoundedString(params, "userId", MAX_IDENTIFIER_CHARS);
+		const session = await getSession(sessionId);
+		if (!session || tenantId !== void 0 && session.tenantId !== void 0 && session.tenantId !== tenantId || userId !== void 0 && session.userId !== void 0 && session.userId !== userId) {
 			this.chat.sendResponse(req.id, true, {
-				sessionId: params.sessionId,
+				sessionId,
 				messages: [],
 				activity: []
 			});
@@ -1172,29 +1435,54 @@ var ClaudeCodeHost = class {
 		return `Earlier in this conversation:\n${prior.map((m) => `${m.role === "assistant" ? "Assistant" : "User"}: ${m.content}`).join("\n")}`;
 	}
 	async ensureSession(bareSessionId, params) {
-		if (await getSession(bareSessionId)) return;
+		const existing = await getSession(bareSessionId);
+		if (existing) {
+			if (params.tenantId && existing.tenantId && params.tenantId !== existing.tenantId || params.userId && existing.userId && params.userId !== existing.userId) throw new Error("Session ownership metadata mismatch");
+			return;
+		}
 		await createSession(bareSessionId, params.agentId, params.clientType ?? "chat", params.tenantId, params.userId);
 	}
 	async loadClaudeSessionIds() {
 		try {
 			const raw = await (0, node_fs_promises.readFile)(this.claudeSessionsPath, "utf-8");
-			const parsed = JSON.parse(raw);
-			for (const [k, v] of Object.entries(parsed)) if (typeof v === "string") this.claudeSessionIds.set(k, v);
+			const parsed = asRecord(JSON.parse(raw));
+			if (!parsed) return;
+			this.claudeSessionIds.clear();
+			for (const [key, value] of Object.entries(parsed)) {
+				if (this.claudeSessionIds.size >= MAX_CLAUDE_SESSION_IDS) break;
+				if (key.length > 0 && key.length <= MAX_IDENTIFIER_CHARS && typeof value === "string" && value.length > 0 && value.length <= 256) this.claudeSessionIds.set(key, value);
+			}
 		} catch {}
 	}
 	async saveClaudeSessionIds() {
-		const obj = {};
-		for (const [k, v] of this.claudeSessionIds) obj[k] = v;
-		try {
-			await (0, node_fs_promises.mkdir)((0, node_path.dirname)(this.claudeSessionsPath), { recursive: true });
-			await (0, node_fs_promises.writeFile)(this.claudeSessionsPath, JSON.stringify(obj, null, 2), "utf-8");
-		} catch (err) {
-			this.log.warn(`[claude-host] failed to persist claude session ids: ${err instanceof Error ? err.message : String(err)}`);
+		this.claudeSessionSave = this.claudeSessionSave.then(async () => {
+			const obj = Object.create(null);
+			for (const [key, value] of this.claudeSessionIds) obj[key] = value;
+			try {
+				await writeTextAtomically(this.claudeSessionsPath, JSON.stringify(obj, null, 2));
+			} catch (err) {
+				this.log.warn(`[claude-host] failed to persist claude session ids: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		});
+		await this.claudeSessionSave;
+	}
+	rememberClaudeSessionId(sessionId, claudeSessionId) {
+		this.claudeSessionIds.delete(sessionId);
+		this.claudeSessionIds.set(sessionId, claudeSessionId);
+		while (this.claudeSessionIds.size > MAX_CLAUDE_SESSION_IDS) {
+			const oldest = this.claudeSessionIds.keys().next().value;
+			if (!oldest) break;
+			this.claudeSessionIds.delete(oldest);
 		}
 	}
 	pruneIdempotency() {
 		const cutoff = Date.now() - 10 * 6e4;
 		for (const [k, ts] of this.seenIdempotencyKeys) if (ts < cutoff) this.seenIdempotencyKeys.delete(k);
+		while (this.seenIdempotencyKeys.size >= MAX_IDEMPOTENCY_KEYS) {
+			const oldest = this.seenIdempotencyKeys.keys().next().value;
+			if (!oldest) break;
+			this.seenIdempotencyKeys.delete(oldest);
+		}
 	}
 };
 /** Strip the `agent:{agentId}:` prefix from a full server session key. */
@@ -1236,6 +1524,12 @@ Object.defineProperty(exports, "BRIDGE_ENV_VAR", {
 		return BRIDGE_ENV_VAR;
 	}
 });
+Object.defineProperty(exports, "CLAUDE_PERMISSION_MODES", {
+	enumerable: true,
+	get: function() {
+		return CLAUDE_PERMISSION_MODES;
+	}
+});
 Object.defineProperty(exports, "ClaudeCodeHost", {
 	enumerable: true,
 	get: function() {
@@ -1266,6 +1560,12 @@ Object.defineProperty(exports, "SessionDriver", {
 		return SessionDriver;
 	}
 });
+Object.defineProperty(exports, "TERMINATION_GRACE_MS", {
+	enumerable: true,
+	get: function() {
+		return TERMINATION_GRACE_MS;
+	}
+});
 Object.defineProperty(exports, "TURN_TIMEOUT_MS", {
 	enumerable: true,
 	get: function() {