@cjhyy/code-shell-core 0.8.9 → 0.8.11

package/dist/run/FileRunStore.js

@@ -9,34 +9,54 @@
  *     approvals/<id>.json   — approval records
  *     artifacts/refs.jsonl  — artifact reference log
  */
-import { mkdirSync, existsSync, readFileSync, writeFileSync, appendFileSync, readdirSync, renameSync, rmSync, } from "node:fs";
-import { join } from "node:path";
+import { mkdirSync, existsSync, readFileSync, writeFileSync, appendFileSync, closeSync, chmodSync, constants, fchmodSync, readdirSync, fstatSync, openSync, readSync, renameSync, rmSync, lstatSync, } from "node:fs";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { assertSafeRunFileId, assertSafeRunId } from "./ids.js";
+const MAX_RUN_JSON_BYTES = 8 * 1024 * 1024;
+const MAX_RUN_JSONL_BYTES = 128 * 1024 * 1024;
+const MAX_RUN_JSONL_RECORD_BYTES = 2 * 1024 * 1024;
+const MAX_RUN_DIRECTORIES = 100_000;
+const MAX_RUN_CHILD_FILES = 100_000;
 export class FileRunStore {
     runsDir;
     constructor(storageDir) {
         this.runsDir = storageDir ?? join(homedir(), ".code-shell", "runs");
-        mkdirSync(this.runsDir, { recursive: true });
+        mkdirSync(this.runsDir, { recursive: true, mode: 0o700 });
+        this.assertRealDirectory(this.runsDir);
+        if (process.platform !== "win32")
+            chmodSync(this.runsDir, 0o700);
     }
     // ─── Helpers ───────────────────────────────────────────────────
     runDir(runId) {
         assertSafeRunId(runId);
-        return join(this.runsDir, runId);
+        const dir = join(this.runsDir, runId);
+        if (existsSync(dir))
+            this.assertRealDirectory(dir);
+        return dir;
     }
     ensureRunDir(runId) {
         const dir = this.runDir(runId);
-        mkdirSync(dir, { recursive: true });
-        mkdirSync(join(dir, "checkpoints"), { recursive: true });
-        mkdirSync(join(dir, "approvals"), { recursive: true });
-        mkdirSync(join(dir, "artifacts"), { recursive: true });
+        const directories = [dir, join(dir, "checkpoints"), join(dir, "approvals"), join(dir, "artifacts")];
+        for (const directory of directories) {
+            mkdirSync(directory, { recursive: true, mode: 0o700 });
+            this.assertRealDirectory(directory);
+            if (process.platform !== "win32")
+                chmodSync(directory, 0o700);
+        }
         return dir;
     }
     writeJson(filePath, data) {
+        this.assertRealDirectory(dirname(filePath));
+        this.assertSafeFileTarget(filePath);
+        const serialized = JSON.stringify(data, null, 2);
+        if (Buffer.byteLength(serialized, "utf8") > MAX_RUN_JSON_BYTES) {
+            throw new Error(`Run JSON exceeds ${MAX_RUN_JSON_BYTES} bytes`);
+        }
         const tmp = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
+            writeFileSync(tmp, serialized, { encoding: "utf-8", mode: 0o600, flag: "wx" });
             // Atomic rename — prevents partial writes on crash
             renameSync(tmp, filePath);
         }
@@ -49,7 +69,42 @@ export class FileRunStore {
     readJson(filePath) {
         if (!existsSync(filePath))
             return null;
-        return JSON.parse(readFileSync(filePath, "utf-8"));
+        this.assertRealDirectory(dirname(filePath));
+        let fd;
+        try {
+            const entry = lstatSync(filePath);
+            if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_RUN_JSON_BYTES) {
+                throw new Error(`Run JSON is not a bounded regular file: ${filePath}`);
+            }
+            fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(fd);
+            if (!opened.isFile() || opened.size > MAX_RUN_JSON_BYTES) {
+                throw new Error(`Run JSON is not a bounded regular file: ${filePath}`);
+            }
+            return JSON.parse(readFileSync(fd, "utf-8"));
+        }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
+    }
+    assertRealDirectory(directory) {
+        const info = lstatSync(directory);
+        if (info.isSymbolicLink() || !info.isDirectory()) {
+            throw new Error(`Run storage path is not a real directory: ${directory}`);
+        }
+    }
+    assertSafeFileTarget(filePath) {
+        try {
+            const info = lstatSync(filePath);
+            if (info.isSymbolicLink() || !info.isFile()) {
+                throw new Error(`Run storage target is not a regular file: ${filePath}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
     }
     /** Serializes concurrent JSONL appends per file path. */
     appendLocks = new Map();
@@ -68,7 +123,39 @@ export class FileRunStore {
         this.appendLocks.set(filePath, lock);
         try {
             await prev.catch(() => { });
-            appendFileSync(filePath, JSON.stringify(data) + "\n", "utf-8");
+            this.assertRealDirectory(dirname(filePath));
+            this.assertSafeFileTarget(filePath);
+            const record = JSON.stringify(data);
+            if (Buffer.byteLength(record, "utf8") > MAX_RUN_JSONL_RECORD_BYTES) {
+                throw new Error(`Run JSONL record exceeds ${MAX_RUN_JSONL_RECORD_BYTES} bytes`);
+            }
+            // A process crash can leave a partial final JSONL record. Without a
+            // separator, the first append after restart would concatenate a valid
+            // record onto that fragment and lose both records. Inspect and repair
+            // the boundary through the same append-mode descriptor used to write.
+            const fd = openSync(filePath, constants.O_APPEND |
+                constants.O_CREAT |
+                constants.O_RDWR |
+                (constants.O_NOFOLLOW ?? 0), 0o600);
+            try {
+                if (process.platform !== "win32")
+                    fchmodSync(fd, 0o600);
+                const size = fstatSync(fd).size;
+                if (size + Buffer.byteLength(record, "utf8") + 2 > MAX_RUN_JSONL_BYTES) {
+                    throw new Error(`Run JSONL exceeds ${MAX_RUN_JSONL_BYTES} bytes`);
+                }
+                let prefix = "";
+                if (size > 0) {
+                    const lastByte = Buffer.allocUnsafe(1);
+                    readSync(fd, lastByte, 0, 1, size - 1);
+                    if (lastByte[0] !== 0x0a)
+                        prefix = "\n";
+                }
+                appendFileSync(fd, prefix + record + "\n", "utf-8");
+            }
+            finally {
+                closeSync(fd);
+            }
         }
         finally {
             // Release the lock for the next writer regardless of success/failure,
@@ -82,13 +169,41 @@ export class FileRunStore {
     readJsonl(filePath) {
         if (!existsSync(filePath))
             return [];
-        const content = readFileSync(filePath, "utf-8");
+        this.assertRealDirectory(dirname(filePath));
+        let fd;
+        let content;
+        try {
+            const entry = lstatSync(filePath);
+            if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_RUN_JSONL_BYTES) {
+                throw new Error(`Run JSONL is not a bounded regular file: ${filePath}`);
+            }
+            fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(fd);
+            if (!opened.isFile() || opened.size > MAX_RUN_JSONL_BYTES) {
+                throw new Error(`Run JSONL is not a bounded regular file: ${filePath}`);
+            }
+            content = readFileSync(fd, "utf-8");
+        }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
         if (!content)
             return [];
-        return content
-            .split("\n")
-            .filter((line) => line.trim())
-            .map((line) => JSON.parse(line));
+        const records = [];
+        for (const line of content.split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                records.push(JSON.parse(line));
+            }
+            catch {
+                // Append-only logs must remain readable after a torn final write. A
+                // malformed record is isolated to its line; later valid records still
+                // carry useful recovery state (same policy as Transcript.loadFromFile).
+            }
+        }
+        return records;
     }
     // ─── Snapshot ──────────────────────────────────────────────────
     async create(snapshot) {
@@ -109,11 +224,24 @@ export class FileRunStore {
         if (!existsSync(this.runsDir))
             return [];
         const entries = readdirSync(this.runsDir, { withFileTypes: true });
+        if (entries.length > MAX_RUN_DIRECTORIES)
+            throw new Error("Run registry has too many entries");
         const snapshots = [];
         for (const entry of entries) {
             if (!entry.isDirectory())
                 continue;
-            const snapshot = this.readJson(join(this.runsDir, entry.name, "run.json"));
+            let snapshot;
+            try {
+                snapshot = this.readJson(join(this.runsDir, entry.name, "run.json"));
+            }
+            catch (error) {
+                // One manually damaged/legacy partial snapshot must not make every
+                // healthy run disappear from the history list. Preserve real I/O
+                // failures, but isolate JSON corruption to the affected directory.
+                if (error instanceof SyntaxError)
+                    continue;
+                throw error;
+            }
             if (!snapshot)
                 continue;
             // Filter by status
@@ -123,8 +251,9 @@ export class FileRunStore {
                     continue;
             }
             // Filter by tag
-            if (query?.tag && !snapshot.tags.includes(query.tag))
+            if (query?.tag && (!Array.isArray(snapshot.tags) || !snapshot.tags.includes(query.tag))) {
                 continue;
+            }
             snapshots.push(snapshot);
         }
         // Sort by createdAt descending (newest first)
@@ -165,7 +294,10 @@ export class FileRunStore {
         const cpDir = join(this.runDir(runId), "checkpoints");
         if (!existsSync(cpDir))
             return null;
+        this.assertRealDirectory(cpDir);
         const files = readdirSync(cpDir).filter((f) => f.endsWith(".json"));
+        if (files.length > MAX_RUN_CHILD_FILES)
+            throw new Error("Run has too many checkpoints");
         if (files.length === 0)
             return null;
         // Find the latest by createdAt
@@ -194,7 +326,10 @@ export class FileRunStore {
         const approvalDir = join(this.runDir(runId), "approvals");
         if (!existsSync(approvalDir))
             return null;
+        this.assertRealDirectory(approvalDir);
         const files = readdirSync(approvalDir).filter((f) => f.endsWith(".json"));
+        if (files.length > MAX_RUN_CHILD_FILES)
+            throw new Error("Run has too many approvals");
         for (const file of files) {
             const approval = this.readJson(join(approvalDir, file));
             if (approval?.status === "pending")

package/dist/run/Heartbeat.js

@@ -8,10 +8,12 @@
  * File: ~/.code-shell/runs/<runId>/heartbeat
  * Content: JSON { pid, timestamp, runId }
  */
-import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { randomUUID } from "node:crypto";
 import { assertSafeRunId } from "./ids.js";
+const MAX_HEARTBEAT_BYTES = 64 * 1024;
 export class Heartbeat {
     runsDir;
     intervalMs;
@@ -66,14 +68,42 @@ export class Heartbeat {
     read(runId) {
         assertSafeRunId(runId);
         const filePath = this.filePath(runId);
+        try {
+            const parentInfo = lstatSync(dirname(filePath));
+            if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory())
+                return null;
+        }
+        catch {
+            return null;
+        }
         if (!existsSync(filePath))
             return null;
+        let fd;
         try {
-            return JSON.parse(readFileSync(filePath, "utf-8"));
+            const entry = lstatSync(filePath);
+            if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_HEARTBEAT_BYTES)
+                return null;
+            fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(fd);
+            if (!opened.isFile() || opened.size > MAX_HEARTBEAT_BYTES)
+                return null;
+            const value = JSON.parse(readFileSync(fd, "utf-8"));
+            if (value.runId !== runId ||
+                !Number.isSafeInteger(value.pid) ||
+                (value.pid ?? 0) <= 0 ||
+                !Number.isSafeInteger(value.timestamp) ||
+                (value.timestamp ?? -1) < 0) {
+                return null;
+            }
+            return value;
         }
         catch {
             return null;
         }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
     }
     /**
      * Check if a run's heartbeat is stale (older than threshold).
@@ -110,17 +140,46 @@ export class Heartbeat {
             timestamp: Date.now(),
             runId,
         };
+        const filePath = this.filePath(runId);
+        const temporary = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            writeFileSync(this.filePath(runId), JSON.stringify(data), "utf-8");
+            const parent = dirname(filePath);
+            const parentInfo = lstatSync(parent);
+            if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory())
+                return;
+            try {
+                const targetInfo = lstatSync(filePath);
+                if (targetInfo.isSymbolicLink() || !targetInfo.isFile())
+                    return;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return;
+            }
+            writeFileSync(temporary, JSON.stringify(data), {
+                encoding: "utf8",
+                mode: 0o600,
+                flag: "wx",
+            });
+            renameSync(temporary, filePath);
         }
         catch {
             // Run directory may have been deleted
         }
+        finally {
+            rmSync(temporary, { force: true });
+        }
     }
     remove(runId) {
         try {
             const filePath = this.filePath(runId);
+            const parentInfo = lstatSync(dirname(filePath));
+            if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory())
+                return;
             if (existsSync(filePath)) {
+                const targetInfo = lstatSync(filePath);
+                if (targetInfo.isSymbolicLink() || !targetInfo.isFile())
+                    return;
                 unlinkSync(filePath);
             }
         }

package/dist/services/auto-dream.js

@@ -4,7 +4,7 @@
  * Periodically consolidates and organizes memories using the LLM,
  * similar to the /dream command but running automatically.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, } from "node:fs";
 import { join } from "node:path";
 import { resolveMemoryBaseDir } from "../session/memory.js";
 import { mutateJsonFile } from "../utils/file-mutex.js";
@@ -13,6 +13,8 @@ const DEFAULT_CONFIG = {
     minTimeBetween: 24 * 60 * 60 * 1000, // 24 hours
     enabled: true,
 };
+const MAX_DREAM_STATE_BYTES = 64 * 1024;
+const MAX_SESSION_COUNT = 1_000_000;
 // Co-locate the dream-cadence state with the memories it tracks: both resolve
 // through resolveMemoryBaseDir (CODE_SHELL_HOME ?? $HOME ?? homedir()), so a
 // relocated/test HOME moves them together and never writes the real ~/.code-shell.
@@ -21,18 +23,38 @@ function getStateFile() {
 }
 function loadState() {
     const stateFile = getStateFile();
-    if (existsSync(stateFile)) {
-        try {
-            return JSON.parse(readFileSync(stateFile, "utf-8"));
+    let descriptor;
+    try {
+        const pathInfo = lstatSync(stateFile);
+        if (pathInfo.isSymbolicLink() || !pathInfo.isFile() || pathInfo.size > MAX_DREAM_STATE_BYTES) {
+            return { lastDreamAt: null, sessionsSinceLastDream: 0 };
         }
-        catch { }
+        descriptor = openSync(stateFile, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > MAX_DREAM_STATE_BYTES) {
+            return { lastDreamAt: null, sessionsSinceLastDream: 0 };
+        }
+        return parseDreamState(readFileSync(descriptor, "utf-8"));
+    }
+    catch {
+        return { lastDreamAt: null, sessionsSinceLastDream: 0 };
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
     }
-    return { lastDreamAt: null, sessionsSinceLastDream: 0 };
 }
-function saveState(state) {
-    const stateFile = getStateFile();
-    mkdirSync(resolveMemoryBaseDir(), { recursive: true });
-    writeFileSync(stateFile, JSON.stringify(state, null, 2), "utf-8");
+function parseDreamState(raw) {
+    const parsed = JSON.parse(raw);
+    const timestamp = typeof parsed.lastDreamAt === "string" ? parsed.lastDreamAt : null;
+    const lastDreamAt = timestamp && timestamp.length <= 64 && Number.isFinite(Date.parse(timestamp)) ? timestamp : null;
+    const count = parsed.sessionsSinceLastDream;
+    return {
+        lastDreamAt,
+        sessionsSinceLastDream: typeof count === "number" && Number.isSafeInteger(count) && count >= 0
+            ? Math.min(count, MAX_SESSION_COUNT)
+            : 0,
+    };
 }
 /**
  * Read-modify-write the cadence state under a cross-process lock.
@@ -47,11 +69,7 @@ function mutateState(change) {
             if (raw === undefined)
                 return { lastDreamAt: null, sessionsSinceLastDream: 0 };
             try {
-                const parsed = JSON.parse(raw);
-                return {
-                    lastDreamAt: parsed.lastDreamAt ?? null,
-                    sessionsSinceLastDream: Number(parsed.sessionsSinceLastDream) || 0,
-                };
+                return parseDreamState(raw);
             }
             catch {
                 return { lastDreamAt: null, sessionsSinceLastDream: 0 };
@@ -59,6 +77,7 @@ function mutateState(change) {
         },
         serialize: (state) => JSON.stringify(state, null, 2),
         mutation: (current) => ({ value: change(current) }),
+        maxBytes: MAX_DREAM_STATE_BYTES,
     });
 }
 /**
@@ -99,7 +118,7 @@ export function recordSession() {
     // reached its threshold and auto-consolidation silently stopped happening.
     mutateState((state) => ({
         ...state,
-        sessionsSinceLastDream: state.sessionsSinceLastDream + 1,
+        sessionsSinceLastDream: Math.min(MAX_SESSION_COUNT, state.sessionsSinceLastDream + 1),
     }));
 }
 /**
@@ -111,9 +130,12 @@ export function recordSession() {
  * resetting to 0 threw away increments that belonged to the next cycle.
  */
 export function recordDreamComplete(consumed) {
+    const safeConsumed = typeof consumed === "number" && Number.isSafeInteger(consumed) && consumed >= 0
+        ? consumed
+        : undefined;
     mutateState((state) => ({
         lastDreamAt: new Date().toISOString(),
-        sessionsSinceLastDream: consumed === undefined ? 0 : Math.max(0, state.sessionsSinceLastDream - consumed),
+        sessionsSinceLastDream: safeConsumed === undefined ? 0 : Math.max(0, state.sessionsSinceLastDream - safeConsumed),
     }));
 }
 /**

package/dist/services/session-memory.js

@@ -4,10 +4,15 @@
  * Extracts and maintains conversation context as persistent memory
  * entries that survive across sessions.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { userHome } from "../settings/manager.js";
 import { sortSessionMemoriesByRecency } from "./session-memory-sort.js";
+const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u;
+const MAX_MEMORY_FILE_BYTES = 1024 * 1024;
+const MAX_MEMORY_ENTRIES = 20_000;
+const MAX_MEMORY_LIST_ITEMS = 1_000;
 // Resolve per-call (NOT a module const): userHome() reads $HOME live, so a
 // relocated/test HOME redirects writes instead of pinning the real ~/.code-shell
 // at import time (bun freezes a module-level homedir() and never re-reads it).
@@ -22,23 +27,54 @@ function memoryDir(baseDir) {
  */
 export function saveSessionMemory(entry, baseDir) {
     const dir = memoryDir(baseDir);
-    mkdirSync(dir, { recursive: true });
+    assertSessionMemoryEntry(entry);
+    ensureRealMemoryDirectory(dir);
     const file = join(dir, `${entry.sessionId}.json`);
-    writeFileSync(file, JSON.stringify(entry, null, 2), "utf-8");
+    assertSafeMemoryTarget(file);
+    const serialized = JSON.stringify(entry, null, 2);
+    if (Buffer.byteLength(serialized, "utf8") > MAX_MEMORY_FILE_BYTES) {
+        throw new Error("session memory is too large");
+    }
+    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, serialized, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        renameSync(temporary, file);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
 }
 /**
  * Load a session memory by session ID.
  */
 export function loadSessionMemory(sessionId, baseDir) {
+    if (!validSessionId(sessionId))
+        return null;
     const file = join(memoryDir(baseDir), `${sessionId}.json`);
     if (!existsSync(file))
         return null;
+    let fd;
     try {
-        return JSON.parse(readFileSync(file, "utf-8"));
+        const dirInfo = lstatSync(memoryDir(baseDir));
+        if (dirInfo.isSymbolicLink() || !dirInfo.isDirectory())
+            return null;
+        const entry = lstatSync(file);
+        if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_MEMORY_FILE_BYTES)
+            return null;
+        fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.size > MAX_MEMORY_FILE_BYTES)
+            return null;
+        const parsed = JSON.parse(readFileSync(fd, "utf-8"));
+        return validSessionMemoryEntry(parsed) && parsed.sessionId === sessionId ? parsed : null;
     }
     catch {
         return null;
     }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
 }
 /**
  * List all session memories, most recent first.
@@ -47,21 +83,84 @@ export function listSessionMemories(limit = 50, baseDir) {
     const dir = memoryDir(baseDir);
     if (!existsSync(dir))
         return [];
+    try {
+        const info = lstatSync(dir);
+        if (info.isSymbolicLink() || !info.isDirectory())
+            return [];
+    }
+    catch {
+        return [];
+    }
     // Read all entries, then order by createdAt (not by filename — the filename
     // is the sessionId, which has no chronological meaning), then take `limit`.
     const entries = [];
-    for (const file of readdirSync(dir)) {
-        if (!file.endsWith(".json"))
+    const files = readdirSync(dir, { withFileTypes: true });
+    if (files.length > MAX_MEMORY_ENTRIES)
+        return [];
+    for (const file of files) {
+        if (!file.isFile() || !file.name.endsWith(".json"))
+            continue;
+        const sessionId = file.name.slice(0, -5);
+        if (!validSessionId(sessionId))
             continue;
         try {
-            entries.push(JSON.parse(readFileSync(join(dir, file), "utf-8")));
+            const entry = loadSessionMemory(sessionId, baseDir);
+            if (entry)
+                entries.push(entry);
         }
         catch {
             /* intentional: skip a corrupt/torn memory file rather than failing the
                whole listing — one bad entry must not hide all the others. */
         }
     }
-    return sortSessionMemoriesByRecency(entries).slice(0, limit);
+    const safeLimit = Number.isSafeInteger(limit) && limit > 0 ? Math.min(limit, MAX_MEMORY_LIST_ITEMS) : 0;
+    return sortSessionMemoriesByRecency(entries).slice(0, safeLimit);
+}
+function validSessionId(value) {
+    return typeof value === "string" && SESSION_ID_RE.test(value) && value !== "." && value !== "..";
+}
+function validSessionMemoryEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const entry = value;
+    return (validSessionId(entry.sessionId) &&
+        typeof entry.summary === "string" &&
+        entry.summary.length <= 100_000 &&
+        validMemoryStringList(entry.keyTopics) &&
+        validMemoryStringList(entry.decisions) &&
+        typeof entry.createdAt === "string" &&
+        entry.createdAt.length <= 64 &&
+        Number.isFinite(Date.parse(entry.createdAt)) &&
+        (entry.tokenCount === undefined ||
+            (Number.isSafeInteger(entry.tokenCount) && entry.tokenCount >= 0 && entry.tokenCount <= 10_000_000)));
+}
+function validMemoryStringList(value) {
+    return (Array.isArray(value) &&
+        value.length <= 1_000 &&
+        value.every((item) => typeof item === "string" && item.length <= 4_096 && !item.includes("\0")));
+}
+function assertSessionMemoryEntry(entry) {
+    if (!validSessionMemoryEntry(entry))
+        throw new Error("invalid session memory entry");
+}
+function ensureRealMemoryDirectory(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const info = lstatSync(dir);
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+        throw new Error("session memory directory must be a real directory");
+    }
+}
+function assertSafeMemoryTarget(file) {
+    try {
+        const info = lstatSync(file);
+        if (info.isSymbolicLink() || !info.isFile()) {
+            throw new Error("session memory target must be a regular file");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
 }
 /**
  * Search session memories by keyword.