@moxxy/core 0.5.0 → 0.5.2

package/src/session.ts

@@ -332,8 +332,17 @@ export class Session implements ClientSession, SessionRuntime {
     this.closed = true;
     try {
       // Tear down any open surfaces (PTYs, browser screencasts) before the
-      // plugin shutdown hooks dispose their underlying resources.
-      await this.surfaces.closeAll();
+      // plugin shutdown hooks dispose their underlying resources. Isolated in
+      // its own try/catch: a flaky native surface throwing during teardown must
+      // not pre-empt the plugin shutdown hooks below, which are how plugins
+      // flush state (memory journal, vault, audit logs).
+      try {
+        await this.surfaces.closeAll();
+      } catch (err) {
+        this.logger.warn('surface teardown failed during close', {
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
       await this.dispatcher.dispatchShutdown(this.appContext());
     } finally {
       // Drop THIS session's retained child sessions (the workflow `awaitInput`
@@ -348,13 +357,25 @@ export class Session implements ClientSession, SessionRuntime {
   }
 
   private closed = false;
+  /**
+   * Memoized one-time snapshot of `process.env`. `appContext()` is called per
+   * dispatched event (hundreds per turn during a streaming reply), per turn,
+   * and on every shutdown — eagerly spreading the whole env each time is
+   * thousands of O(envVars) clones of GC pressure for a value that does not
+   * change over a session's life. Frozen so a plugin can't mutate the shared
+   * snapshot out from under another.
+   */
+  private envSnapshot: Readonly<NodeJS.ProcessEnv> | null = null;
 
   appContext(): AppContext {
+    if (!this.envSnapshot) {
+      this.envSnapshot = Object.freeze({ ...process.env });
+    }
     return {
       sessionId: this.id,
       cwd: this.cwd,
       log: this.log.asReader(),
-      env: { ...process.env },
+      env: this.envSnapshot,
     };
   }
 

package/src/sessions/page.test.ts

@@ -3,7 +3,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 import type { MoxxyEvent } from '@moxxy/sdk';
-import { pageEvents, readEventPage, restoreEvents, seedSessionLog } from './persistence.js';
+import { pageEvents, readEventPage } from './persistence.js';
 
 const tempDirs: string[] = [];
 
@@ -78,6 +78,23 @@ describe('pageEvents (pure newest-first paging)', () => {
     expect(pageEvents([], 3, 5)).toEqual({ events: [], prevCursor: null });
   });
 
+  it('a non-finite `before` cursor degrades to the newest page (no NaN prevCursor)', () => {
+    const log = makeLog(10);
+    // `pageEvents` is exported public API; a corrupt cursor (NaN / Infinity from
+    // a hand-edited or wire-mangled page request) must not poison the result.
+    // Worst case if unguarded: every `seq < NaN` is false → empty page with
+    // `prevCursor: NaN`, which JSON-serializes to `null` and wedges the walk.
+    for (const bad of [NaN, Infinity, -Infinity, 1.5] as number[]) {
+      const page = pageEvents(log, bad, 3);
+      // Treated as the newest page (before=null) — last `limit` events.
+      expect(page.events.map((e) => e.seq)).toEqual([7, 8, 9]);
+      expect(page.prevCursor).toBe(7);
+      expect(Number.isNaN(page.prevCursor as number)).toBe(false);
+    }
+    // Empty-log path also never emits a NaN cursor for a bad `before`.
+    expect(pageEvents([], NaN, 5)).toEqual({ events: [], prevCursor: null });
+  });
+
   it('walking all pages reconstructs the full log exactly once, in order', () => {
     const log = makeLog(23);
     const collected: number[] = [];
@@ -177,41 +194,3 @@ describe('readEventPage (paged JSONL reader)', () => {
     expect(after).toBe(before);
   });
 });
-
-describe('seedSessionLog (NDJSON → runner-log migration)', () => {
-  it('writes a fresh session log, re-sequenced to 0..n-1, ids + content preserved', async () => {
-    const dir = await makeTempDir();
-    // Gapped original seqs — as rendered events pulled from the desktop mirror
-    // (which dropped the interleaved chunk/bookend events) would have.
-    const events = [
-      { id: 'a', seq: 3, ts: 0, sessionId: 'sess', turnId: 't0', source: 'user', type: 'user_prompt', text: 'q' },
-      { id: 'b', seq: 7, ts: 1, sessionId: 'sess', turnId: 't0', source: 'model', type: 'assistant_message', content: 'reply' },
-    ] as unknown as MoxxyEvent[];
-    expect(await seedSessionLog('sess', events, dir)).toBe(true);
-    // The runner restores it like any native log: contiguous seqs, ids preserved.
-    const restored = await restoreEvents('sess', dir);
-    expect(restored.map((e) => e.id)).toEqual(['a', 'b']);
-    expect(restored.map((e) => e.seq)).toEqual([0, 1]);
-    expect((restored[1] as { content?: string }).content).toBe('reply');
-  });
-
-  it('never overwrites a NON-EMPTY session the runner already owns', async () => {
-    const dir = await makeTempDir();
-    await writeLog(dir, 'sess', makeLog(2, 'sess')); // the runner already owns it
-    expect(await seedSessionLog('sess', makeLog(5, 'sess'), dir)).toBe(false);
-    const restored = await restoreEvents('sess', dir);
-    expect(restored).toHaveLength(2); // untouched
-  });
-
-  it('seeds OVER a 0-byte session log (the empty file attach leaves on every spawn)', async () => {
-    const dir = await makeTempDir();
-    await writeLog(dir, 'sess', []); // 0-byte file, holds no history
-    expect(await seedSessionLog('sess', makeLog(3, 'sess'), dir)).toBe(true);
-    expect(await restoreEvents('sess', dir)).toHaveLength(3);
-  });
-
-  it('is a no-op for an empty event list', async () => {
-    const dir = await makeTempDir();
-    expect(await seedSessionLog('sess', [], dir)).toBe(false);
-  });
-});

package/src/sessions/persistence.test.ts

@@ -4,7 +4,14 @@ import * as path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
 import { EventLog } from '../events/log.js';
 import type { Logger } from '../logger.js';
-import { SessionPersistence, readIndex, restoreEvents, type SessionMeta } from './persistence.js';
+import {
+  SessionPersistence,
+  deleteSession,
+  readEventPage,
+  readIndex,
+  restoreEvents,
+  type SessionMeta,
+} from './persistence.js';
 
 interface CapturedLine {
   readonly level: 'debug' | 'info' | 'warn' | 'error';
@@ -226,6 +233,91 @@ describe('SessionPersistence', () => {
     expect(again.lines).toHaveLength(0);
   });
 
+  it('rejects a path-traversal session id before touching the filesystem', async () => {
+    const dir = await makeTempDir();
+    // A secret file OUTSIDE the sessions dir that a traversal id would target.
+    const secretName = `traversal-target-${Date.now()}.jsonl`;
+    const secret = path.join(dir, '..', secretName);
+    await fs.writeFile(secret, 'do not delete me', 'utf8');
+    try {
+      await expect(restoreEvents('../etc/passwd', dir)).rejects.toThrow(/invalid session id/i);
+      await expect(readEventPage('a/../../b', { before: null, limit: 5 }, dir)).rejects.toThrow(
+        /invalid session id/i,
+      );
+      // deleteSession uses force:true — a traversal delete would otherwise
+      // silently succeed. The id resolving to our secret must be rejected so
+      // the file stays intact.
+      const evil = `..${path.sep}${secretName.replace(/\.jsonl$/, '')}`;
+      await expect(deleteSession(evil, dir)).rejects.toThrow(/invalid session id/i);
+      await expect(fs.readFile(secret, 'utf8')).resolves.toBe('do not delete me');
+    } finally {
+      await fs.rm(secret, { force: true });
+    }
+  });
+
+  it('firstPrompt label is sliced on code-point boundaries (no split surrogate pair)', async () => {
+    const dir = await makeTempDir();
+    const id = '01SURROGATE0000000000000AA';
+    const log = new EventLog();
+    const persistence = new SessionPersistence({ sessionId: id as never, cwd: '/tmp/p', dir });
+    const detach = persistence.attach(log);
+    // 80 emoji (each a surrogate pair) + a trailing char. A naive
+    // `slice(0, 80)` on UTF-16 code units would cut emoji #41 in half, leaving a
+    // lone surrogate at the boundary.
+    const text = '😀'.repeat(90) + 'x';
+    await log.append({
+      type: 'user_prompt',
+      sessionId: id as never,
+      turnId: 't1' as never,
+      source: 'user',
+      text,
+    });
+    await persistence.flush();
+    const [row] = await readIndex(dir);
+    const label = row!.firstPrompt!;
+    // Exactly 80 code points, all whole emoji — the cut never split a surrogate
+    // pair. A naive slice(0, 80) would yield 80 UTF-16 units = 40 emoji and the
+    // label would round-trip fine, but the worst case (cut INSIDE a pair) is
+    // what we guard: rebuild from code points must reproduce the label exactly.
+    expect([...label]).toHaveLength(80);
+    expect([...label].every((cp) => cp === '😀')).toBe(true);
+    // No lone (unpaired) surrogate survives a JSON round-trip as itself.
+    expect(JSON.parse(JSON.stringify(label))).toBe(label);
+
+    detach();
+  });
+
+  it('a user_prompt with a non-string text does not crash the persistence listener', async () => {
+    const dir = await makeTempDir();
+    const id = '01BADTEXT00000000000000000';
+    const { logger } = captureLogger();
+    const log = new EventLog();
+    const persistence = new SessionPersistence({ sessionId: id as never, cwd: '/tmp/p', dir, logger });
+    const detach = persistence.attach(log);
+
+    // A hostile / hand-built event whose `text` is not a string. `firstPromptLabel`
+    // runs `[...text]` inside the log listener chain — without the coercion this
+    // throws, latching the misleading "persistence degraded" warning and dropping
+    // the row. It must instead degrade gracefully (label coerced, write succeeds).
+    await log.append({
+      type: 'user_prompt',
+      sessionId: id as never,
+      turnId: 't1' as never,
+      source: 'user',
+      text: null as unknown as string,
+    });
+    await persistence.flush();
+    await persistence.settleWrites();
+
+    // The disk write was not poisoned by the bad label.
+    expect(persistence.degraded).toBe(false);
+    const [row] = await readIndex(dir);
+    expect(row?.id).toBe(id);
+    expect(typeof row?.firstPrompt).toBe('string');
+
+    detach();
+  });
+
   it('two concurrent sessions both survive (no shared-index clobber)', async () => {
     const dir = await makeTempDir();
     const idA = '01AAAA00000000000000000001';

package/src/sessions/persistence.ts

@@ -57,6 +57,49 @@ export function defaultSessionsDir(): string {
   return path.join(os.homedir(), '.moxxy', 'sessions');
 }
 
+/**
+ * Session ids are ULIDs internally, but `restoreEvents`/`readEventPage`/
+ * `deleteSession` are public APIs reachable from the runner/desktop IPC and the
+ * CLI. Reject anything outside the ULID-safe charset before path-joining so a
+ * `../`-laden or absolute-ish id can't read or `fs.rm` files outside the
+ * sessions dir (deleteSession uses `force:true`, so a traversal delete would
+ * otherwise silently succeed). Defense-in-depth at the trust boundary.
+ */
+const SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+
+function assertSafeSessionId(sessionId: string): void {
+  if (!SAFE_SESSION_ID.test(sessionId)) {
+    throw new Error(`Invalid session id: ${JSON.stringify(sessionId)}`);
+  }
+}
+
+/** Max concurrent fs operations in `readIndex` — bounds open file handles so a
+ *  user with thousands of sessions can't hit EMFILE on the list/resume path. */
+const READ_INDEX_CONCURRENCY = 32;
+
+/**
+ * Map `fn` over `items` with at most `limit` calls in flight at once, preserving
+ * input order in the returned array. A small dependency-free concurrency limiter
+ * (the framework avoids extra deps for this).
+ */
+async function mapWithConcurrency<T, R>(
+  items: ReadonlyArray<T>,
+  limit: number,
+  fn: (item: T) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let cursor = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (;;) {
+      const index = cursor++;
+      if (index >= items.length) return;
+      results[index] = await fn(items[index]!);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
 /**
  * Attaches a listener that streams every appended event to disk and
  * keeps the index in sync. Returns an `unsubscribe` callback the
@@ -76,6 +119,15 @@ export class SessionPersistence {
    * can flush.
    */
   private writeQueue: Mutex = createMutex();
+  /**
+   * Single-flight guard for the sidecar (`writeIndex`) write. The debounced
+   * timer and an explicit `flush()` can both call `writeIndex()` concurrently;
+   * without serialization two `writeFileAtomic`s would race on `metaPath` and
+   * the on-disk result would be last-rename-wins between two `this.meta`
+   * snapshots non-deterministically. Chaining them makes the latest meta win
+   * deterministically and drops the redundant work.
+   */
+  private indexWriteChain: Promise<void> = Promise.resolve();
   /**
    * Memoized one-time setup: `mkdir -p` the sessions dir and create the empty
    * `.jsonl` (so resume lists the session before any event). Awaited by both
@@ -201,7 +253,7 @@ export class SessionPersistence {
       lastActivity: new Date().toISOString(),
       firstPrompt:
         this.meta.firstPrompt ??
-        (event.type === 'user_prompt' ? event.text.slice(0, 80) : null),
+        (event.type === 'user_prompt' ? firstPromptLabel(event.text) : null),
     };
     this.scheduleIndexWrite();
     const line = JSON.stringify(event) + '\n';
@@ -285,7 +337,20 @@ export class SessionPersistence {
     this.indexTimer = timer;
   }
 
-  private async writeIndex(): Promise<void> {
+  /**
+   * Serialize the sidecar write through `indexWriteChain` so a debounced write
+   * and a concurrent `flush()` never race on `metaPath`; resolves once THIS
+   * call's write (or a later one that supersedes it) has settled.
+   */
+  private writeIndex(): Promise<void> {
+    const next = this.indexWriteChain.then(() => this.doWriteIndex());
+    // Keep the chain unbroken even if a write rejects (doWriteIndex already
+    // swallows, but guard the chain itself defensively).
+    this.indexWriteChain = next.catch(() => undefined);
+    return next;
+  }
+
+  private async doWriteIndex(): Promise<void> {
     try {
       // Once closed (the final detach/flush write), don't re-create the dir or
       // log file: setup already made them, and resurrecting a directory a
@@ -352,31 +417,29 @@ export async function readIndex(dir = defaultSessionsDir()): Promise<SessionMeta
   } catch {
     dirents = [];
   }
-  await Promise.all(
-    dirents
-      .filter((d) => d.isFile() && d.name.endsWith('.meta.json'))
-      .map(async (d) => {
-        try {
-          const raw = await fs.readFile(path.join(dir, d.name), 'utf8');
-          const parsed = JSON.parse(raw) as unknown;
-          if (isSessionMeta(parsed)) byId.set(parsed.id, parsed);
-        } catch {
-          // skip a malformed/half-written sidecar
-        }
-      }),
-  );
+  // Cap fan-out: a user with thousands of sidecars in ~/.moxxy/sessions would
+  // otherwise open thousands of file handles at once (EMFILE) on every resume/
+  // list. Process in bounded batches instead.
+  const sidecarFiles = dirents.filter((d) => d.isFile() && d.name.endsWith('.meta.json'));
+  await mapWithConcurrency(sidecarFiles, READ_INDEX_CONCURRENCY, async (d) => {
+    try {
+      const raw = await fs.readFile(path.join(dir, d.name), 'utf8');
+      const parsed = JSON.parse(raw) as unknown;
+      if (isSessionMeta(parsed)) byId.set(parsed.id, parsed);
+    } catch {
+      // skip a malformed/half-written sidecar
+    }
+  });
 
   const metas = [...byId.values()];
-  const checks = await Promise.all(
-    metas.map(async (meta) => {
-      try {
-        await fs.access(path.join(dir, `${meta.id}.jsonl`));
-        return true;
-      } catch {
-        return false;
-      }
-    }),
-  );
+  const checks = await mapWithConcurrency(metas, READ_INDEX_CONCURRENCY, async (meta) => {
+    try {
+      await fs.access(path.join(dir, `${meta.id}.jsonl`));
+      return true;
+    } catch {
+      return false;
+    }
+  });
   return metas
     .filter((_, index) => checks[index])
     .sort((a, b) => b.lastActivity.localeCompare(a.lastActivity));
@@ -411,6 +474,7 @@ export async function restoreEvents(
   dir = defaultSessionsDir(),
   logger: Logger = createLogger(),
 ): Promise<MoxxyEvent[]> {
+  assertSafeSessionId(sessionId);
   const logPath = path.join(dir, `${sessionId}.jsonl`);
   let raw: string;
   try {
@@ -448,8 +512,25 @@ export async function restoreEvents(
       restoredEvents: events.length,
     });
     try {
-      const repaired = events.map((e) => JSON.stringify(e) + '\n').join('');
-      await writeFileAtomic(logPath, repaired);
+      // Conflict guard: only rewrite if the on-disk content still matches what
+      // we read. Another process (a desktop runner already attached + a CLI
+      // `resume` of the SAME id) may have appended/repaired between our read and
+      // this write; its appends are a newer snapshot than our re-sequenced one,
+      // and a blind `writeFileAtomic` would clobber them (silent history loss).
+      // The single-writer assumption the rest of persistence relies on does not
+      // hold across processes, so re-read and compare before the destructive
+      // rewrite. Restore still succeeds either way — the in-memory log is
+      // already repaired; only the next clean resume would re-run the repair.
+      const current = await fs.readFile(logPath, 'utf8').catch(() => null);
+      if (current !== raw) {
+        logger.warn('skipped repaired-log rewrite — file changed under us (another process attached?)', {
+          sessionId,
+          path: logPath,
+        });
+      } else {
+        const repaired = events.map((e) => JSON.stringify(e) + '\n').join('');
+        await writeFileAtomic(logPath, repaired);
+      }
     } catch (err) {
       // Restore still succeeds — the in-memory log is repaired; only the
       // next resume would re-run this same repair.
@@ -512,6 +593,7 @@ export async function readEventPage(
   opts: { before: number | null; limit: number },
   dir = defaultSessionsDir(),
 ): Promise<EventPage> {
+  assertSafeSessionId(sessionId);
   const logPath = path.join(dir, `${sessionId}.jsonl`);
   let raw: string;
   try {
@@ -552,16 +634,26 @@ export function pageEvents(
   limit: number,
 ): EventPage {
   const cap = Math.max(0, Math.floor(limit));
+  // `pageEvents` is an exported public API (runner + disk paths call it), so it
+  // must self-defend rather than trust every caller to pre-validate. A
+  // non-finite `before` (NaN/Infinity from a corrupt cursor) would otherwise
+  // make every `seq < before` comparison false, collapse the page to empty, and
+  // hand back `prevCursor: before` — a NaN that JSON-serializes to `null`,
+  // silently wedging the client's backward walk. Coerce any non-integer cursor
+  // to the newest page (`null`) so a bad cursor degrades to "start over from the
+  // top" instead of a poisoned cursor.
+  const safeBefore =
+    before === null || !Number.isInteger(before) ? null : before;
   if (cap === 0 || events.length === 0) {
-    return { events: [], prevCursor: events.length === 0 ? null : before };
+    return { events: [], prevCursor: events.length === 0 ? null : safeBefore };
   }
   // Exclusive upper bound by `seq`: the first index whose event is NOT older
   // than `before`. `before == null` (newest page) keeps the whole array.
   let end = events.length;
-  if (before !== null) {
+  if (safeBefore !== null) {
     end = 0;
     for (let i = 0; i < events.length; i += 1) {
-      if (events[i]!.seq < before) end = i + 1;
+      if (events[i]!.seq < safeBefore) end = i + 1;
       else break;
     }
   }
@@ -572,44 +664,6 @@ export function pageEvents(
   return { events: page, prevCursor };
 }
 
-/**
- * Seed a session's event log from an external event list IFF the session has no
- * log on disk yet. This is the migration that makes the runner's authoritative
- * log the home of a chat whose history previously lived ONLY in a thin client's
- * own mirror (the desktop's NDJSON chat store) — after it runs, `loadHistory`
- * serves that chat from the runner like any other.
- *
- * Idempotent and NON-destructive: if `<sessionId>.jsonl` already exists AND is
- * NON-EMPTY this is a no-op returning `false`, so a session the runner already
- * owns is NEVER overwritten. A 0-byte log IS seeded: `persistence.attach`
- * creates an empty `<id>.jsonl` on every spawn (even a session with zero
- * events), so an existence-only guard would skip exactly the legacy chats this
- * migration targets — and an empty file holds no history, so seeding over it
- * loses nothing. Events are re-sequenced to contiguous `seq` 0..n-1 (order + ids
- * preserved) so the seeded log satisfies {@link EventLog}'s seq invariants when
- * it is later restored. Written temp+rename so a crash mid-seed can't leave a
- * half-written log. Returns `true` iff it wrote the log.
- */
-export async function seedSessionLog(
-  sessionId: string,
-  events: ReadonlyArray<MoxxyEvent>,
-  dir = defaultSessionsDir(),
-): Promise<boolean> {
-  if (events.length === 0) return false;
-  const logPath = path.join(dir, `${sessionId}.jsonl`);
-  try {
-    // A non-empty log is a session the runner already owns → never overwrite.
-    // A 0-byte log is the empty file attach() left behind → seed over it.
-    if ((await fs.stat(logPath)).size > 0) return false;
-  } catch {
-    /* no log yet → seed below */
-  }
-  await fs.mkdir(dir, { recursive: true });
-  const reseq = events.map((e, i) => (e.seq === i ? e : ({ ...e, seq: i } as MoxxyEvent)));
-  await writeFileAtomic(logPath, reseq.map((e) => JSON.stringify(e) + '\n').join(''));
-  return true;
-}
-
 /**
  * Remove a session's log file and its sidecar. A leftover legacy `index.json`
  * row, if any, is harmless — `readIndex` filters out sessions whose `.jsonl` is
@@ -619,6 +673,7 @@ export async function deleteSession(
   sessionId: string,
   dir = defaultSessionsDir(),
 ): Promise<void> {
+  assertSafeSessionId(sessionId);
   await fs.rm(path.join(dir, `${sessionId}.jsonl`), { force: true });
   await fs.rm(metaPath(dir, sessionId), { force: true });
 }
@@ -628,6 +683,21 @@ function metaPath(dir: string, id: string): string {
   return path.join(dir, `${id}.meta.json`);
 }
 
+/**
+ * First 80 chars of a prompt for the picker label, sliced on code-point (not
+ * UTF-16 code-unit) boundaries so the cut never splits a surrogate pair (emoji,
+ * astral CJK) into a lone half-character that renders as a broken glyph.
+ *
+ * `text` is typed `string`, but this runs inside the log listener chain — a
+ * throw here would latch the misleading "persistence degraded" warning. Coerce
+ * a non-string (a hand-built `EmittedEvent`, a future schema variant) instead of
+ * letting `[...text]` throw on `undefined`/`null`.
+ */
+function firstPromptLabel(text: string): string {
+  const s = typeof text === 'string' ? text : String(text ?? '');
+  return [...s].slice(0, 80).join('');
+}
+
 async function writeJsonAtomic(target: string, value: unknown): Promise<void> {
   await writeFileAtomic(target, JSON.stringify(value, null, 2) + '\n');
 }

package/src/skills/loader.test.ts

@@ -99,4 +99,22 @@ describe('discoverSkills', () => {
     });
     expect(skills).toEqual([]);
   });
+
+  it('bounds directory recursion depth (deep tree does not crash, deepest skill skipped)', async () => {
+    const root = path.join(tmp, 'project');
+    // A shallow skill (loaded) and a very deeply-nested one (beyond the depth cap).
+    await writeSkill(root, 'shallow');
+    let deep = root;
+    for (let i = 0; i < 20; i++) deep = path.join(deep, `lvl${i}`);
+    await writeSkill(deep, 'too-deep');
+
+    const skills = await discoverSkills({
+      projectDir: root,
+      userDir: path.join(tmp, 'noop'),
+      logger: silentLogger,
+    });
+    const names = skills.map((s) => s.frontmatter.name);
+    expect(names).toContain('shallow');
+    expect(names).not.toContain('too-deep');
+  });
 });

package/src/skills/loader.ts

@@ -33,10 +33,14 @@ export async function discoverSkills(opts: SkillLoadOptions = {}): Promise<Reado
   return [...seenNames.values()];
 }
 
+/** Cap directory recursion so a pathologically deep (or hostile) skills tree can't blow the stack at boot. */
+const MAX_SKILL_DIR_DEPTH = 8;
+
 async function loadDir(
   dir: string,
   scope: SkillScope,
   logger?: Logger,
+  depth = 0,
 ): Promise<ReadonlyArray<DiscoveredSkill>> {
   let entries: import('node:fs').Dirent[];
   try {
@@ -47,7 +51,14 @@ async function loadDir(
   const out: DiscoveredSkill[] = [];
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      out.push(...(await loadDir(path.join(dir, entry.name), scope, logger)));
+      if (depth >= MAX_SKILL_DIR_DEPTH) {
+        logger?.warn('skill: directory too deep, not recursing', {
+          path: path.join(dir, entry.name),
+          maxDepth: MAX_SKILL_DIR_DEPTH,
+        });
+        continue;
+      }
+      out.push(...(await loadDir(path.join(dir, entry.name), scope, logger, depth + 1)));
       continue;
     }
     if (!entry.isFile() || !entry.name.endsWith('.md')) continue;

package/src/skills/synthesize.test.ts

@@ -126,6 +126,65 @@ describe('synthesizeSkill', () => {
     expect(b.path).not.toBe(a.path);
     expect(b.path).toMatch(/-2\.md$/);
   });
+
+  it('does not overwrite a same-slug file already on disk (atomic wx create)', async () => {
+    const provider = new InlineProvider([draftReply()]);
+    const session = newSessionWithProvider(provider);
+    const skillsDir = path.join(tmp, 'skills');
+    await fs.mkdir(skillsDir, { recursive: true });
+    // Pre-existing skill file with the slug that this synthesis will produce.
+    const squatted = path.join(skillsDir, 'refactor-component.md');
+    await fs.writeFile(squatted, 'PRE-EXISTING — MUST NOT BE TRUNCATED');
+
+    const result = await synthesizeSkill(session, 'split component up', 'user', {
+      userDir: skillsDir,
+      auditPath: path.join(tmp, 'audit.jsonl'),
+    });
+
+    // The pre-existing file is untouched and the new skill landed on a bumped name.
+    expect(await fs.readFile(squatted, 'utf8')).toBe('PRE-EXISTING — MUST NOT BE TRUNCATED');
+    expect(result.path).toMatch(/-2\.md$/);
+  });
+
+  it('still returns the created skill when the audit append fails (audit is best-effort)', async () => {
+    const provider = new InlineProvider([draftReply()]);
+    const session = newSessionWithProvider(provider);
+    // Make the audit path unwritable by planting a FILE where its parent dir
+    // must be — appendAudit's mkdir(dirname) then throws ENOTDIR/EEXIST.
+    const blocker = path.join(tmp, 'blocker');
+    await fs.writeFile(blocker, 'i am a file, not a directory');
+    const auditPath = path.join(blocker, 'created.jsonl');
+
+    const result = await synthesizeSkill(session, 'split component up', 'user', {
+      userDir: path.join(tmp, 'skills'),
+      auditPath,
+    });
+
+    // The skill is the product — it was written, registered, and returned despite
+    // the telemetry write failing.
+    expect(result.skill.frontmatter.name).toBe('refactor-component');
+    expect(await fs.readFile(result.path, 'utf8')).toContain('refactor-component');
+    expect(session.skills.byName('refactor-component')).toBeDefined();
+  });
+
+  it('caps the audit JSONL at MAX_AUDIT_LINES', async () => {
+    const auditPath = path.join(tmp, 'audit.jsonl');
+    // Seed the audit with way more than the cap.
+    const seed = Array.from({ length: 2100 }, (_, i) => JSON.stringify({ n: i })).join('\n') + '\n';
+    await fs.writeFile(auditPath, seed);
+
+    const provider = new InlineProvider([draftReply()]);
+    const session = newSessionWithProvider(provider);
+    await synthesizeSkill(session, 'split component up', 'user', {
+      userDir: path.join(tmp, 'skills'),
+      auditPath,
+    });
+
+    const lines = (await fs.readFile(auditPath, 'utf8')).split('\n').filter((l) => l.length > 0);
+    expect(lines.length).toBeLessThanOrEqual(2000);
+    // The most-recent line is the one we just appended (the skill slug).
+    expect(lines[lines.length - 1]).toContain('refactor-component');
+  });
 });
 
 describe('buildSynthesizeSkillPlugin', () => {