@moxxy/core 0.4.0 → 0.5.1

package/src/run-turn.ts

@@ -1,4 +1,4 @@
-import type { EmittedEvent, ModeContext, MoxxyEvent, RunTurnOptions } from '@moxxy/sdk';
+import type { EmittedEvent, LLMProvider, ModeContext, MoxxyEvent, RunTurnOptions } from '@moxxy/sdk';
 import type { SessionRuntime } from './session-runtime.js';
 import { createSubagentSpawner } from './subagents.js';
 
@@ -20,16 +20,11 @@ export async function* runTurn(
   // Use a caller-supplied turnId when present (the runner mints it up front so
   // it can return the id before the turn runs); otherwise mint one here.
   const turnId = opts.turnId ?? session.startTurn().turnId;
-  const provider = session.providers.getActive();
-  const model = opts.model ?? provider.models[0]?.id ?? 'default';
-  // Record the resolution so out-of-band spawns (workflow triggers) can
-  // inherit the conversation's current model. Last-writer-wins when turns
-  // run concurrently — see the field's doc in SessionRuntime.
-  session.lastResolvedModel = model;
 
   const queue: MoxxyEvent[] = [];
   const waiters: Array<() => void> = [];
   let done = false;
+  let completed = false;
   let strategyError: unknown = null;
   // A mode can ask (via ctx.requestModeSwitch) to hand off to another mode
   // once this turn finishes — applied after the strategy drains, below.
@@ -42,6 +37,12 @@ export async function* runTurn(
     wake();
   });
 
+  // Generator-scoped controller so an early consumer return/throw (HTTP client
+  // disconnect, channel teardown) can abort the in-flight strategy instead of
+  // leaving it to run the whole agentic loop to completion in the background
+  // (burning tokens, holding resources) while the abandoned `finally` blocks on
+  // `strategyPromise`.
+  const turnController = new AbortController();
   let strategyPromise: Promise<void> | null = null;
 
   try {
@@ -56,12 +57,46 @@ export async function* runTurn(
         : {}),
     });
 
+    // Resolve provider + model AFTER the prompt is recorded so a
+    // missing/misconfigured provider doesn't silently discard the user's
+    // prompt or orphan the turnId. On failure, append a structured error event
+    // (channels see a normal failed turn) and rethrow.
+    let provider: LLMProvider;
+    let model: string;
+    try {
+      provider = session.providers.getActive();
+      const resolvedModel = opts.model ?? provider.models[0]?.id;
+      if (!resolvedModel) {
+        throw new Error(
+          `Active provider '${provider.name}' has no models configured`,
+        );
+      }
+      model = resolvedModel;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      await session.log.append({
+        type: 'error',
+        sessionId: session.id,
+        turnId,
+        source: 'system',
+        kind: 'fatal',
+        message,
+      });
+      throw err;
+    }
+    // Record the resolution so out-of-band spawns (workflow triggers) can
+    // inherit the conversation's current model. Last-writer-wins when turns
+    // run concurrently — see the field's doc in SessionRuntime.
+    session.lastResolvedModel = model;
+
     const strategy = session.modes.getActive();
-    // Combine the session's signal with the per-turn one (if provided)
-    // so either firing cancels the turn.
-    const effectiveSignal = opts.signal
-      ? AbortSignal.any([session.signal, opts.signal])
-      : session.signal;
+    // Combine the session's signal, the per-turn one (if provided), and the
+    // generator-scoped abandonment signal so any of them firing cancels the turn.
+    const effectiveSignal = AbortSignal.any(
+      opts.signal
+        ? [session.signal, opts.signal, turnController.signal]
+        : [session.signal, turnController.signal],
+    );
     // The session's working dir + environment, mirrored onto the ModeContext
     // so the shared tool dispatcher can hand onToolCall hooks the real cwd/env
     // (path-based policy hooks gate on these) instead of empty placeholders.
@@ -105,16 +140,21 @@ export async function* runTurn(
     const turnStartCtx = { ...appCtx, turnId, iteration: 0 };
 
     strategyPromise = (async () => {
+      let started = false;
       try {
         await session.dispatcher.dispatchTurnStart(turnStartCtx);
+        started = true;
         for await (const _ of strategy.run(ctx)) {
           // Events are surfaced via the log subscription above.
           void _;
         }
-        await session.dispatcher.dispatchTurnEnd(turnStartCtx);
       } catch (err) {
         strategyError = err;
       } finally {
+        // turnEnd must pair with turnStart even when the strategy throws/aborts,
+        // so plugins that allocate turn-scoped state in onTurnStart (spans,
+        // timers, token meters) always get the matching teardown.
+        if (started) await session.dispatcher.dispatchTurnEnd(turnStartCtx);
         done = true;
         wake();
       }
@@ -125,15 +165,25 @@ export async function* runTurn(
       if (done) break;
       await new Promise<void>((resolve) => waiters.push(resolve));
     }
+    completed = true;
   } finally {
     unsubscribe();
+    // If the consumer abandoned iteration early (broke out of the `for await`,
+    // an outer error), `completed` is still false: abort the strategy so it
+    // unwinds promptly instead of running the full loop in the background while
+    // this `finally` blocks on `strategyPromise`.
+    if (!completed) turnController.abort('runTurn iteration abandoned');
     if (strategyPromise) await strategyPromise;
     // Apply a mode hand-off the strategy requested, now that the turn has
-    // fully drained. Only on clean completion (a thrown/aborted turn keeps
-    // the current mode); an unknown target is ignored so a bad name can't
-    // wedge the session. The registry's setActive triggers the runner's
-    // InfoChanged broadcast, so channels see the new mode.
-    if (requestedModeSwitch && !strategyError) {
+    // fully drained. Only on clean completion: a thrown turn (strategyError) OR
+    // an ABANDONED turn (consumer broke out early — `completed` is false, and a
+    // mode that returns cleanly on `signal.aborted` leaves strategyError null)
+    // keeps the current mode, so an unwatched/cancelled turn can't silently
+    // flip the session into a different mode behind the user's back. An unknown
+    // target is ignored so a bad name can't wedge the session. The registry's
+    // setActive triggers the runner's InfoChanged broadcast, so channels see the
+    // new mode.
+    if (requestedModeSwitch && completed && !strategyError) {
       try {
         session.modes.setActive(requestedModeSwitch);
       } catch {

package/src/session.test.ts

@@ -72,6 +72,30 @@ describe('Session', () => {
     expect(s.signal.aborted).toBe(true);
   });
 
+  it('close() still runs plugin onShutdown when surface teardown rejects', async () => {
+    const s = new Session({ cwd: '/tmp', silent: true });
+    const onShutdown = vi.fn();
+    s.pluginHost.registerStatic(
+      definePlugin({ name: 'p', version: '0.0.0', hooks: { onShutdown } }),
+    );
+    // A flaky native surface (PTY/browser) throwing during teardown must not
+    // pre-empt the plugin shutdown hooks — those are how plugins flush state.
+    vi.spyOn(s.surfaces, 'closeAll').mockRejectedValue(new Error('PTY teardown blew up'));
+
+    await expect(s.close()).resolves.toBeUndefined();
+    expect(onShutdown).toHaveBeenCalledTimes(1);
+    expect(s.signal.aborted).toBe(true);
+  });
+
+  it('appContext env is a frozen, stable snapshot (reused across calls)', () => {
+    const s = new Session({ cwd: '/tmp', silent: true });
+    const a = s.appContext();
+    const b = s.appContext();
+    // Memoized: the same frozen object is handed out, not a fresh clone each call.
+    expect(a.env).toBe(b.env);
+    expect(Object.isFrozen(a.env)).toBe(true);
+  });
+
   it('close() is idempotent', async () => {
     const s = new Session({ cwd: '/tmp', silent: true });
     const onShutdown = vi.fn();

package/src/session.ts

@@ -332,8 +332,17 @@ export class Session implements ClientSession, SessionRuntime {
     this.closed = true;
     try {
       // Tear down any open surfaces (PTYs, browser screencasts) before the
-      // plugin shutdown hooks dispose their underlying resources.
-      await this.surfaces.closeAll();
+      // plugin shutdown hooks dispose their underlying resources. Isolated in
+      // its own try/catch: a flaky native surface throwing during teardown must
+      // not pre-empt the plugin shutdown hooks below, which are how plugins
+      // flush state (memory journal, vault, audit logs).
+      try {
+        await this.surfaces.closeAll();
+      } catch (err) {
+        this.logger.warn('surface teardown failed during close', {
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
       await this.dispatcher.dispatchShutdown(this.appContext());
     } finally {
       // Drop THIS session's retained child sessions (the workflow `awaitInput`
@@ -348,13 +357,25 @@ export class Session implements ClientSession, SessionRuntime {
   }
 
   private closed = false;
+  /**
+   * Memoized one-time snapshot of `process.env`. `appContext()` is called per
+   * dispatched event (hundreds per turn during a streaming reply), per turn,
+   * and on every shutdown — eagerly spreading the whole env each time is
+   * thousands of O(envVars) clones of GC pressure for a value that does not
+   * change over a session's life. Frozen so a plugin can't mutate the shared
+   * snapshot out from under another.
+   */
+  private envSnapshot: Readonly<NodeJS.ProcessEnv> | null = null;
 
   appContext(): AppContext {
+    if (!this.envSnapshot) {
+      this.envSnapshot = Object.freeze({ ...process.env });
+    }
     return {
       sessionId: this.id,
       cwd: this.cwd,
       log: this.log.asReader(),
-      env: { ...process.env },
+      env: this.envSnapshot,
     };
   }
 

package/src/sessions/page.test.ts

@@ -78,6 +78,23 @@ describe('pageEvents (pure newest-first paging)', () => {
     expect(pageEvents([], 3, 5)).toEqual({ events: [], prevCursor: null });
   });
 
+  it('a non-finite `before` cursor degrades to the newest page (no NaN prevCursor)', () => {
+    const log = makeLog(10);
+    // `pageEvents` is exported public API; a corrupt cursor (NaN / Infinity from
+    // a hand-edited or wire-mangled page request) must not poison the result.
+    // Worst case if unguarded: every `seq < NaN` is false → empty page with
+    // `prevCursor: NaN`, which JSON-serializes to `null` and wedges the walk.
+    for (const bad of [NaN, Infinity, -Infinity, 1.5] as number[]) {
+      const page = pageEvents(log, bad, 3);
+      // Treated as the newest page (before=null) — last `limit` events.
+      expect(page.events.map((e) => e.seq)).toEqual([7, 8, 9]);
+      expect(page.prevCursor).toBe(7);
+      expect(Number.isNaN(page.prevCursor as number)).toBe(false);
+    }
+    // Empty-log path also never emits a NaN cursor for a bad `before`.
+    expect(pageEvents([], NaN, 5)).toEqual({ events: [], prevCursor: null });
+  });
+
   it('walking all pages reconstructs the full log exactly once, in order', () => {
     const log = makeLog(23);
     const collected: number[] = [];

package/src/sessions/persistence.test.ts

@@ -4,7 +4,14 @@ import * as path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 import { EventLog } from '../events/log.js';
 import type { Logger } from '../logger.js';
-import { SessionPersistence, readIndex, restoreEvents, type SessionMeta } from './persistence.js';
+import {
+  SessionPersistence,
+  deleteSession,
+  readEventPage,
+  readIndex,
+  restoreEvents,
+  type SessionMeta,
+} from './persistence.js';
 
 interface CapturedLine {
   readonly level: 'debug' | 'info' | 'warn' | 'error';
@@ -226,6 +233,91 @@ describe('SessionPersistence', () => {
     expect(again.lines).toHaveLength(0);
   });
 
+  it('rejects a path-traversal session id before touching the filesystem', async () => {
+    const dir = await makeTempDir();
+    // A secret file OUTSIDE the sessions dir that a traversal id would target.
+    const secretName = `traversal-target-${Date.now()}.jsonl`;
+    const secret = path.join(dir, '..', secretName);
+    await fs.writeFile(secret, 'do not delete me', 'utf8');
+    try {
+      await expect(restoreEvents('../etc/passwd', dir)).rejects.toThrow(/invalid session id/i);
+      await expect(readEventPage('a/../../b', { before: null, limit: 5 }, dir)).rejects.toThrow(
+        /invalid session id/i,
+      );
+      // deleteSession uses force:true — a traversal delete would otherwise
+      // silently succeed. The id resolving to our secret must be rejected so
+      // the file stays intact.
+      const evil = `..${path.sep}${secretName.replace(/\.jsonl$/, '')}`;
+      await expect(deleteSession(evil, dir)).rejects.toThrow(/invalid session id/i);
+      await expect(fs.readFile(secret, 'utf8')).resolves.toBe('do not delete me');
+    } finally {
+      await fs.rm(secret, { force: true });
+    }
+  });
+
+  it('firstPrompt label is sliced on code-point boundaries (no split surrogate pair)', async () => {
+    const dir = await makeTempDir();
+    const id = '01SURROGATE0000000000000AA';
+    const log = new EventLog();
+    const persistence = new SessionPersistence({ sessionId: id as never, cwd: '/tmp/p', dir });
+    const detach = persistence.attach(log);
+    // 80 emoji (each a surrogate pair) + a trailing char. A naive
+    // `slice(0, 80)` on UTF-16 code units would cut emoji #41 in half, leaving a
+    // lone surrogate at the boundary.
+    const text = '😀'.repeat(90) + 'x';
+    await log.append({
+      type: 'user_prompt',
+      sessionId: id as never,
+      turnId: 't1' as never,
+      source: 'user',
+      text,
+    });
+    await persistence.flush();
+    const [row] = await readIndex(dir);
+    const label = row!.firstPrompt!;
+    // Exactly 80 code points, all whole emoji — the cut never split a surrogate
+    // pair. A naive slice(0, 80) would yield 80 UTF-16 units = 40 emoji and the
+    // label would round-trip fine, but the worst case (cut INSIDE a pair) is
+    // what we guard: rebuild from code points must reproduce the label exactly.
+    expect([...label]).toHaveLength(80);
+    expect([...label].every((cp) => cp === '😀')).toBe(true);
+    // No lone (unpaired) surrogate survives a JSON round-trip as itself.
+    expect(JSON.parse(JSON.stringify(label))).toBe(label);
+
+    detach();
+  });
+
+  it('a user_prompt with a non-string text does not crash the persistence listener', async () => {
+    const dir = await makeTempDir();
+    const id = '01BADTEXT00000000000000000';
+    const { logger } = captureLogger();
+    const log = new EventLog();
+    const persistence = new SessionPersistence({ sessionId: id as never, cwd: '/tmp/p', dir, logger });
+    const detach = persistence.attach(log);
+
+    // A hostile / hand-built event whose `text` is not a string. `firstPromptLabel`
+    // runs `[...text]` inside the log listener chain — without the coercion this
+    // throws, latching the misleading "persistence degraded" warning and dropping
+    // the row. It must instead degrade gracefully (label coerced, write succeeds).
+    await log.append({
+      type: 'user_prompt',
+      sessionId: id as never,
+      turnId: 't1' as never,
+      source: 'user',
+      text: null as unknown as string,
+    });
+    await persistence.flush();
+    await persistence.settleWrites();
+
+    // The disk write was not poisoned by the bad label.
+    expect(persistence.degraded).toBe(false);
+    const [row] = await readIndex(dir);
+    expect(row?.id).toBe(id);
+    expect(typeof row?.firstPrompt).toBe('string');
+
+    detach();
+  });
+
   it('two concurrent sessions both survive (no shared-index clobber)', async () => {
     const dir = await makeTempDir();
     const idA = '01AAAA00000000000000000001';

package/src/sessions/persistence.ts

@@ -57,6 +57,49 @@ export function defaultSessionsDir(): string {
   return path.join(os.homedir(), '.moxxy', 'sessions');
 }
 
+/**
+ * Session ids are ULIDs internally, but `restoreEvents`/`readEventPage`/
+ * `deleteSession` are public APIs reachable from the runner/desktop IPC and the
+ * CLI. Reject anything outside the ULID-safe charset before path-joining so a
+ * `../`-laden or absolute-ish id can't read or `fs.rm` files outside the
+ * sessions dir (deleteSession uses `force:true`, so a traversal delete would
+ * otherwise silently succeed). Defense-in-depth at the trust boundary.
+ */
+const SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+
+function assertSafeSessionId(sessionId: string): void {
+  if (!SAFE_SESSION_ID.test(sessionId)) {
+    throw new Error(`Invalid session id: ${JSON.stringify(sessionId)}`);
+  }
+}
+
+/** Max concurrent fs operations in `readIndex` — bounds open file handles so a
+ *  user with thousands of sessions can't hit EMFILE on the list/resume path. */
+const READ_INDEX_CONCURRENCY = 32;
+
+/**
+ * Map `fn` over `items` with at most `limit` calls in flight at once, preserving
+ * input order in the returned array. A small dependency-free concurrency limiter
+ * (the framework avoids extra deps for this).
+ */
+async function mapWithConcurrency<T, R>(
+  items: ReadonlyArray<T>,
+  limit: number,
+  fn: (item: T) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let cursor = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (;;) {
+      const index = cursor++;
+      if (index >= items.length) return;
+      results[index] = await fn(items[index]!);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
 /**
  * Attaches a listener that streams every appended event to disk and
  * keeps the index in sync. Returns an `unsubscribe` callback the
@@ -76,6 +119,15 @@ export class SessionPersistence {
    * can flush.
    */
   private writeQueue: Mutex = createMutex();
+  /**
+   * Single-flight guard for the sidecar (`writeIndex`) write. The debounced
+   * timer and an explicit `flush()` can both call `writeIndex()` concurrently;
+   * without serialization two `writeFileAtomic`s would race on `metaPath` and
+   * the on-disk result would be last-rename-wins between two `this.meta`
+   * snapshots non-deterministically. Chaining them makes the latest meta win
+   * deterministically and drops the redundant work.
+   */
+  private indexWriteChain: Promise<void> = Promise.resolve();
   /**
    * Memoized one-time setup: `mkdir -p` the sessions dir and create the empty
    * `.jsonl` (so resume lists the session before any event). Awaited by both
@@ -201,7 +253,7 @@ export class SessionPersistence {
       lastActivity: new Date().toISOString(),
       firstPrompt:
         this.meta.firstPrompt ??
-        (event.type === 'user_prompt' ? event.text.slice(0, 80) : null),
+        (event.type === 'user_prompt' ? firstPromptLabel(event.text) : null),
     };
     this.scheduleIndexWrite();
     const line = JSON.stringify(event) + '\n';
@@ -285,7 +337,20 @@ export class SessionPersistence {
     this.indexTimer = timer;
   }
 
-  private async writeIndex(): Promise<void> {
+  /**
+   * Serialize the sidecar write through `indexWriteChain` so a debounced write
+   * and a concurrent `flush()` never race on `metaPath`; resolves once THIS
+   * call's write (or a later one that supersedes it) has settled.
+   */
+  private writeIndex(): Promise<void> {
+    const next = this.indexWriteChain.then(() => this.doWriteIndex());
+    // Keep the chain unbroken even if a write rejects (doWriteIndex already
+    // swallows, but guard the chain itself defensively).
+    this.indexWriteChain = next.catch(() => undefined);
+    return next;
+  }
+
+  private async doWriteIndex(): Promise<void> {
     try {
       // Once closed (the final detach/flush write), don't re-create the dir or
       // log file: setup already made them, and resurrecting a directory a
@@ -352,31 +417,29 @@ export async function readIndex(dir = defaultSessionsDir()): Promise<SessionMeta
   } catch {
     dirents = [];
   }
-  await Promise.all(
-    dirents
-      .filter((d) => d.isFile() && d.name.endsWith('.meta.json'))
-      .map(async (d) => {
-        try {
-          const raw = await fs.readFile(path.join(dir, d.name), 'utf8');
-          const parsed = JSON.parse(raw) as unknown;
-          if (isSessionMeta(parsed)) byId.set(parsed.id, parsed);
-        } catch {
-          // skip a malformed/half-written sidecar
-        }
-      }),
-  );
+  // Cap fan-out: a user with thousands of sidecars in ~/.moxxy/sessions would
+  // otherwise open thousands of file handles at once (EMFILE) on every resume/
+  // list. Process in bounded batches instead.
+  const sidecarFiles = dirents.filter((d) => d.isFile() && d.name.endsWith('.meta.json'));
+  await mapWithConcurrency(sidecarFiles, READ_INDEX_CONCURRENCY, async (d) => {
+    try {
+      const raw = await fs.readFile(path.join(dir, d.name), 'utf8');
+      const parsed = JSON.parse(raw) as unknown;
+      if (isSessionMeta(parsed)) byId.set(parsed.id, parsed);
+    } catch {
+      // skip a malformed/half-written sidecar
+    }
+  });
 
   const metas = [...byId.values()];
-  const checks = await Promise.all(
-    metas.map(async (meta) => {
-      try {
-        await fs.access(path.join(dir, `${meta.id}.jsonl`));
-        return true;
-      } catch {
-        return false;
-      }
-    }),
-  );
+  const checks = await mapWithConcurrency(metas, READ_INDEX_CONCURRENCY, async (meta) => {
+    try {
+      await fs.access(path.join(dir, `${meta.id}.jsonl`));
+      return true;
+    } catch {
+      return false;
+    }
+  });
   return metas
     .filter((_, index) => checks[index])
     .sort((a, b) => b.lastActivity.localeCompare(a.lastActivity));
@@ -411,6 +474,7 @@ export async function restoreEvents(
   dir = defaultSessionsDir(),
   logger: Logger = createLogger(),
 ): Promise<MoxxyEvent[]> {
+  assertSafeSessionId(sessionId);
   const logPath = path.join(dir, `${sessionId}.jsonl`);
   let raw: string;
   try {
@@ -448,8 +512,25 @@ export async function restoreEvents(
       restoredEvents: events.length,
     });
     try {
-      const repaired = events.map((e) => JSON.stringify(e) + '\n').join('');
-      await writeFileAtomic(logPath, repaired);
+      // Conflict guard: only rewrite if the on-disk content still matches what
+      // we read. Another process (a desktop runner already attached + a CLI
+      // `resume` of the SAME id) may have appended/repaired between our read and
+      // this write; its appends are a newer snapshot than our re-sequenced one,
+      // and a blind `writeFileAtomic` would clobber them (silent history loss).
+      // The single-writer assumption the rest of persistence relies on does not
+      // hold across processes, so re-read and compare before the destructive
+      // rewrite. Restore still succeeds either way — the in-memory log is
+      // already repaired; only the next clean resume would re-run the repair.
+      const current = await fs.readFile(logPath, 'utf8').catch(() => null);
+      if (current !== raw) {
+        logger.warn('skipped repaired-log rewrite — file changed under us (another process attached?)', {
+          sessionId,
+          path: logPath,
+        });
+      } else {
+        const repaired = events.map((e) => JSON.stringify(e) + '\n').join('');
+        await writeFileAtomic(logPath, repaired);
+      }
     } catch (err) {
       // Restore still succeeds — the in-memory log is repaired; only the
       // next resume would re-run this same repair.
@@ -512,6 +593,7 @@ export async function readEventPage(
   opts: { before: number | null; limit: number },
   dir = defaultSessionsDir(),
 ): Promise<EventPage> {
+  assertSafeSessionId(sessionId);
   const logPath = path.join(dir, `${sessionId}.jsonl`);
   let raw: string;
   try {
@@ -552,16 +634,26 @@ export function pageEvents(
   limit: number,
 ): EventPage {
   const cap = Math.max(0, Math.floor(limit));
+  // `pageEvents` is an exported public API (runner + disk paths call it), so it
+  // must self-defend rather than trust every caller to pre-validate. A
+  // non-finite `before` (NaN/Infinity from a corrupt cursor) would otherwise
+  // make every `seq < before` comparison false, collapse the page to empty, and
+  // hand back `prevCursor: before` — a NaN that JSON-serializes to `null`,
+  // silently wedging the client's backward walk. Coerce any non-integer cursor
+  // to the newest page (`null`) so a bad cursor degrades to "start over from the
+  // top" instead of a poisoned cursor.
+  const safeBefore =
+    before === null || !Number.isInteger(before) ? null : before;
   if (cap === 0 || events.length === 0) {
-    return { events: [], prevCursor: events.length === 0 ? null : before };
+    return { events: [], prevCursor: events.length === 0 ? null : safeBefore };
   }
   // Exclusive upper bound by `seq`: the first index whose event is NOT older
   // than `before`. `before == null` (newest page) keeps the whole array.
   let end = events.length;
-  if (before !== null) {
+  if (safeBefore !== null) {
     end = 0;
     for (let i = 0; i < events.length; i += 1) {
-      if (events[i]!.seq < before) end = i + 1;
+      if (events[i]!.seq < safeBefore) end = i + 1;
       else break;
     }
   }
@@ -581,6 +673,7 @@ export async function deleteSession(
   sessionId: string,
   dir = defaultSessionsDir(),
 ): Promise<void> {
+  assertSafeSessionId(sessionId);
   await fs.rm(path.join(dir, `${sessionId}.jsonl`), { force: true });
   await fs.rm(metaPath(dir, sessionId), { force: true });
 }
@@ -590,6 +683,21 @@ function metaPath(dir: string, id: string): string {
   return path.join(dir, `${id}.meta.json`);
 }
 
+/**
+ * First 80 chars of a prompt for the picker label, sliced on code-point (not
+ * UTF-16 code-unit) boundaries so the cut never splits a surrogate pair (emoji,
+ * astral CJK) into a lone half-character that renders as a broken glyph.
+ *
+ * `text` is typed `string`, but this runs inside the log listener chain — a
+ * throw here would latch the misleading "persistence degraded" warning. Coerce
+ * a non-string (a hand-built `EmittedEvent`, a future schema variant) instead of
+ * letting `[...text]` throw on `undefined`/`null`.
+ */
+function firstPromptLabel(text: string): string {
+  const s = typeof text === 'string' ? text : String(text ?? '');
+  return [...s].slice(0, 80).join('');
+}
+
 async function writeJsonAtomic(target: string, value: unknown): Promise<void> {
   await writeFileAtomic(target, JSON.stringify(value, null, 2) + '\n');
 }

package/src/skills/loader.test.ts

@@ -99,4 +99,22 @@ describe('discoverSkills', () => {
     });
     expect(skills).toEqual([]);
   });
+
+  it('bounds directory recursion depth (deep tree does not crash, deepest skill skipped)', async () => {
+    const root = path.join(tmp, 'project');
+    // A shallow skill (loaded) and a very deeply-nested one (beyond the depth cap).
+    await writeSkill(root, 'shallow');
+    let deep = root;
+    for (let i = 0; i < 20; i++) deep = path.join(deep, `lvl${i}`);
+    await writeSkill(deep, 'too-deep');
+
+    const skills = await discoverSkills({
+      projectDir: root,
+      userDir: path.join(tmp, 'noop'),
+      logger: silentLogger,
+    });
+    const names = skills.map((s) => s.frontmatter.name);
+    expect(names).toContain('shallow');
+    expect(names).not.toContain('too-deep');
+  });
 });

package/src/skills/loader.ts

@@ -33,10 +33,14 @@ export async function discoverSkills(opts: SkillLoadOptions = {}): Promise<Reado
   return [...seenNames.values()];
 }
 
+/** Cap directory recursion so a pathologically deep (or hostile) skills tree can't blow the stack at boot. */
+const MAX_SKILL_DIR_DEPTH = 8;
+
 async function loadDir(
   dir: string,
   scope: SkillScope,
   logger?: Logger,
+  depth = 0,
 ): Promise<ReadonlyArray<DiscoveredSkill>> {
   let entries: import('node:fs').Dirent[];
   try {
@@ -47,7 +51,14 @@ async function loadDir(
   const out: DiscoveredSkill[] = [];
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      out.push(...(await loadDir(path.join(dir, entry.name), scope, logger)));
+      if (depth >= MAX_SKILL_DIR_DEPTH) {
+        logger?.warn('skill: directory too deep, not recursing', {
+          path: path.join(dir, entry.name),
+          maxDepth: MAX_SKILL_DIR_DEPTH,
+        });
+        continue;
+      }
+      out.push(...(await loadDir(path.join(dir, entry.name), scope, logger, depth + 1)));
       continue;
     }
     if (!entry.isFile() || !entry.name.endsWith('.md')) continue;