ccprofiles-core 0.6.0 → 0.7.1

package/dist/manifest.js

@@ -1,9 +1,10 @@
 import { z } from 'zod';
 import YAML from 'yaml';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { atomicWrite } from './fsutil.js';
 const exec = promisify(execFile);
 export class ManifestError extends Error {
 }
@@ -26,19 +27,39 @@ const ProfileSchema = z.object({
     settingsEnv: z.record(z.string()).default({}),
     skipPermissions: z.boolean().default(false),
     sharedSessions: z.boolean().default(false),
+    plugins: z.array(z.string()).default([]),
 });
+const MarketplaceSchema = z.object({ source: z.string().min(1) });
 const ManifestSchema = z.object({
     version: z.literal(1),
     hub: z.string().nullable(),
     profiles: z.array(ProfileSchema),
     mcpServers: z.record(McpServerSchema),
+    marketplaces: z.record(MarketplaceSchema).default({}),
 });
 // identifiers that get interpolated into shell launcher code must be injection-safe
-const SAFE_NAME = /^[A-Za-z0-9_-]+$/; // profile names, launcher names, secret refs
+// leading '-' is forbidden (but internal '-' still allowed) so a value can never be parsed as a
+// CLI flag when passed as a positional argv entry (e.g. `claude plugin install <id>`)
+const SAFE_NAME = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/; // profile names, launcher names, secret refs
 const SAFE_ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/; // POSIX/PowerShell env var names
 const SAFE_LINK_ENTRY = /^[A-Za-z0-9._-]+$/; // one profile-dir child; never a path
+const SAFE_SOURCE = /^[A-Za-z0-9._@:/][A-Za-z0-9._/@:-]*$/; // marketplace source (interpolated into `claude plugin` shell-out); no leading '-'
 const SHELL_META = /["`$;|&()\n\r<>]/; // chars that could break out of a quoted shell context
 const SECRET_PREFIX = 'secret://';
+// plaintext provider tokens that must never be committed to manifest git history
+const PLAINTEXT_TOKEN = /sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}/;
+/**
+ * True if `yaml` (raw manifest.yaml text, or any string) contains a plaintext provider
+ * token. saveManifest() uses this to decide whether to skip the git commit; doctor checks
+ * (CLI + UI) use it to surface that skip as a visible problem instead of a stderr-only warning.
+ */
+export function manifestHasPlaintextSecret(yaml) {
+    return PLAINTEXT_TOKEN.test(yaml);
+}
+/** Reject any path with a literal `..` path-traversal segment, on either `/` or `\` separators. */
+function hasDotDotSegment(path) {
+    return path.split(/[/\\]/).includes('..');
+}
 /**
  * Reject manifests whose identifiers could break out of the shell launcher context.
  * Applies to every manifest — an untrusted bundle/peer manifest reaches this before
@@ -52,6 +73,8 @@ export function assertSafeManifest(m) {
             throw new ManifestError(`unsafe launcher name in profile "${p.name}": ${JSON.stringify(p.launcher)}`);
         if (SHELL_META.test(p.dir))
             throw new ManifestError(`unsafe profile dir in profile "${p.name}": ${JSON.stringify(p.dir)}`);
+        if (hasDotDotSegment(p.dir))
+            throw new ManifestError(`unsafe profile dir in profile "${p.name}": ${JSON.stringify(p.dir)} (must not contain a ".." segment)`);
         for (const [k, v] of Object.entries(p.env)) {
             if (!SAFE_ENV_KEY.test(k))
                 throw new ManifestError(`unsafe env var name in profile "${p.name}": ${JSON.stringify(k)}`);
@@ -75,6 +98,19 @@ export function assertSafeManifest(m) {
                 throw new ManifestError(`unsafe link entry in profile "${p.name}": ${JSON.stringify(entry)} (must be one file or directory name)`);
         }
     }
+    for (const [name, mk] of Object.entries(m.marketplaces ?? {})) {
+        if (!SAFE_NAME.test(name))
+            throw new ManifestError(`unsafe marketplace name: ${JSON.stringify(name)}`);
+        if (!SAFE_SOURCE.test(mk.source))
+            throw new ManifestError(`unsafe marketplace source for "${name}": ${JSON.stringify(mk.source)}`);
+    }
+    for (const p of m.profiles)
+        for (const id of p.plugins) {
+            const at = id.lastIndexOf('@');
+            const nm = at > 0 ? id.slice(0, at) : id, mkt = at > 0 ? id.slice(at + 1) : '';
+            if (!SAFE_NAME.test(nm) || !SAFE_NAME.test(mkt))
+                throw new ManifestError(`unsafe plugin id in profile "${p.name}": ${JSON.stringify(id)}`);
+        }
 }
 export function parseManifest(text) {
     let raw;
@@ -92,6 +128,13 @@ export function parseManifest(text) {
         for (const name of p.mcp)
             if (!m.mcpServers[name])
                 throw new ManifestError(`profile "${p.name}" references undefined mcp server "${name}"`);
+    for (const p of m.profiles)
+        for (const id of p.plugins) {
+            const at = id.lastIndexOf('@');
+            const mkt = at > 0 ? id.slice(at + 1) : '';
+            if (!mkt || !m.marketplaces[mkt])
+                throw new ManifestError(`profile "${p.name}" references undefined marketplace for plugin "${id}"`);
+        }
     assertSafeManifest(m);
     return m;
 }
@@ -104,12 +147,38 @@ export async function loadManifest(root) {
 export async function saveManifest(root, m) {
     const yaml = serializeManifest(m);
     parseManifest(yaml); // guard: never write a manifest that cannot be reloaded
-    await mkdir(root, { recursive: true });
-    await writeFile(join(root, 'manifest.yaml'), yaml, 'utf8');
+    // manifestRoot also holds secrets.enc/devices.json — lock it down here since this is often
+    // the first thing (adopt/manifest init) to create it.
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    // settingsEnv can carry plaintext secrets until `secrets migrate` runs — write at 0600.
+    await atomicWrite(join(root, 'manifest.yaml'), yaml, { mode: 0o600 });
+    if (manifestHasPlaintextSecret(yaml)) {
+        // never let a plaintext token land in git history — the file is still written above
+        // (callers may still need it on disk), we just refuse to commit it.
+        process.stderr.write('warn: manifest contains a plaintext secret — skipping git commit; run: ccprofiles secrets migrate\n');
+        return;
+    }
     try {
         await exec('git', ['-C', root, 'rev-parse', '--git-dir']);
         await exec('git', ['-C', root, 'add', '-A']);
         await exec('git', ['-C', root, 'commit', '-m', 'ccprofiles: update manifest']);
     }
-    catch { /* not a repo or nothing to commit — fine */ }
+    catch (e) {
+        if (!isBenignGitError(e)) {
+            // manifest.yaml is already written above — don't throw, but don't silently drop history
+            // either. Anything other than "not a repo" / "nothing to commit" is a real failure
+            // (hook rejection, disk full, corrupt index, ...) the user should know about.
+            process.stderr.write(`warn: manifest.yaml written but git commit failed: ${gitErrorMessage(e)}\n`);
+        }
+        // else: not a git repo, or nothing changed to commit — expected, nothing to report
+    }
+}
+/** True for the two git outcomes saveManifest treats as expected/benign, not a real failure. */
+function isBenignGitError(e) {
+    const text = gitErrorMessage(e);
+    return /nothing to commit/i.test(text) || /not a git repository/i.test(text);
+}
+function gitErrorMessage(e) {
+    const err = e;
+    return [err?.stderr, err?.stdout, err?.message].filter(Boolean).join(' ').trim() || String(e);
 }

package/dist/platform.js

@@ -16,5 +16,12 @@ export function renderPath(template, p) {
 export function toTemplate(absPath, p) {
     const norm = absPath.replaceAll('\\', '/');
     const home = p.home.replaceAll('\\', '/');
-    return norm.startsWith(home) ? '{home}' + norm.slice(home.length) : norm;
+    // require a path-separator boundary — a raw startsWith would also match sibling dirs
+    // that merely share a string prefix with home (e.g. home "/Users/tm" matching
+    // "/Users/tmfadhlul-old/...")
+    if (norm === home)
+        return '{home}';
+    if (norm.startsWith(home + '/'))
+        return '{home}' + norm.slice(home.length);
+    return norm;
 }

package/dist/plugins.d.ts

@@ -0,0 +1,21 @@
+export interface PluginRunner {
+    marketplaceAdd(configDir: string, source: string): Promise<void>;
+    install(configDir: string, id: string): Promise<void>;
+    uninstall(configDir: string, id: string): Promise<void>;
+}
+export declare function marketplaceOf(id: string): string | null;
+export declare function planPluginReconcile(desired: string[], current: string[]): {
+    install: string[];
+    uninstall: string[];
+};
+export declare function reconcileProfilePlugins(opts: {
+    configDir: string;
+    desired: string[];
+    current: string[];
+    marketplaces: Record<string, {
+        source: string;
+    }>;
+    runner: PluginRunner;
+}): Promise<string[]>;
+/** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
+export declare function restoreLegacyPluginSymlink(pluginsDir: string): Promise<boolean>;

package/dist/plugins.js

@@ -0,0 +1,56 @@
+import { cp, lstat, mkdir, readlink, unlink } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+export function marketplaceOf(id) {
+    const at = id.lastIndexOf('@');
+    return at > 0 ? id.slice(at + 1) : null;
+}
+export function planPluginReconcile(desired, current) {
+    const d = new Set(desired), c = new Set(current);
+    return { install: desired.filter(id => !c.has(id)), uninstall: current.filter(id => !d.has(id)) };
+}
+export async function reconcileProfilePlugins(opts) {
+    const log = [];
+    const { install, uninstall } = planPluginReconcile(opts.desired, opts.current);
+    for (const id of uninstall) {
+        await opts.runner.uninstall(opts.configDir, id);
+        log.push(`uninstall ${id}`);
+    }
+    const added = new Set();
+    for (const id of install) {
+        const mkt = marketplaceOf(id);
+        if (mkt && !added.has(mkt)) {
+            const src = opts.marketplaces[mkt]?.source;
+            if (src) {
+                await opts.runner.marketplaceAdd(opts.configDir, src);
+                added.add(mkt);
+                log.push(`add ${src}`);
+            }
+        }
+        await opts.runner.install(opts.configDir, id);
+        log.push(`install ${id}`);
+    }
+    return log;
+}
+/** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
+export async function restoreLegacyPluginSymlink(pluginsDir) {
+    let st = null;
+    try {
+        st = await lstat(pluginsDir);
+    }
+    catch {
+        return false;
+    }
+    if (!st.isSymbolicLink())
+        return false;
+    const target = await readlink(pluginsDir);
+    // Never unlink-and-empty when the pool target is gone — that would silently leave the
+    // profile with a permanently empty plugins/ and no way to recover the original content.
+    // Leave the symlink in place and fail loudly instead.
+    if (!existsSync(target)) {
+        throw new Error(`cannot restore ${pluginsDir}: symlink target ${target} does not exist — leaving the symlink in place`);
+    }
+    await unlink(pluginsDir);
+    await mkdir(pluginsDir, { recursive: true });
+    await cp(target, pluginsDir, { recursive: true, force: false, errorOnExist: false });
+    return true;
+}

package/dist/provider.d.ts

@@ -0,0 +1,10 @@
+export type AnthropicAuthMode = 'login' | 'api-key' | 'auth-token';
+/** Derive the current Anthropic auth mode from a settingsEnv map. */
+export declare function anthropicAuthMode(env: Record<string, string>): AnthropicAuthMode;
+/**
+ * New settingsEnv with `mode` applied. Non-auth keys preserved. `login` removes
+ * both token vars; `api-key`/`auth-token` set that var to `tokenRef` and remove
+ * the other. Throws if env has a custom ANTHROPIC_BASE_URL (non-Anthropic provider)
+ * or if a token mode is chosen without a tokenRef.
+ */
+export declare function setAnthropicAuthMode(env: Record<string, string>, mode: AnthropicAuthMode, tokenRef?: string): Record<string, string>;

package/dist/provider.js

@@ -0,0 +1,30 @@
+const API_KEY = 'ANTHROPIC_API_KEY';
+const AUTH_TOKEN = 'ANTHROPIC_AUTH_TOKEN';
+const BASE_URL = 'ANTHROPIC_BASE_URL';
+/** Derive the current Anthropic auth mode from a settingsEnv map. */
+export function anthropicAuthMode(env) {
+    if (env[API_KEY] !== undefined)
+        return 'api-key';
+    if (env[AUTH_TOKEN] !== undefined)
+        return 'auth-token';
+    return 'login';
+}
+/**
+ * New settingsEnv with `mode` applied. Non-auth keys preserved. `login` removes
+ * both token vars; `api-key`/`auth-token` set that var to `tokenRef` and remove
+ * the other. Throws if env has a custom ANTHROPIC_BASE_URL (non-Anthropic provider)
+ * or if a token mode is chosen without a tokenRef.
+ */
+export function setAnthropicAuthMode(env, mode, tokenRef) {
+    if (env[BASE_URL] !== undefined && env[BASE_URL].trim())
+        throw new Error(`profile uses a custom provider base URL (${env[BASE_URL]}) — manage its token in the Provider editor, not as an Anthropic auth mode`);
+    const out = { ...env };
+    delete out[API_KEY];
+    delete out[AUTH_TOKEN];
+    if (mode === 'login')
+        return out;
+    if (!tokenRef || !tokenRef.trim())
+        throw new Error(`${mode} mode requires a token reference`);
+    out[mode === 'api-key' ? API_KEY : AUTH_TOKEN] = tokenRef.trim();
+    return out;
+}

package/dist/rcblock.js

@@ -18,6 +18,7 @@ function profileDirExpr(pr, p) {
 }
 function renderPosix(pr, p) {
     const lines = [`${pr.launcher}() {`];
+    lines.push(`  if [ "$1" = handoff ]; then shift; command ccprofiles handoff --from ${pr.name} --to "$1"; return; fi`);
     for (const [k, v] of Object.entries(pr.env)) {
         lines.push(v.startsWith(SECRET_PREFIX)
             ? `  export ${k}="$(ccprofiles secrets get ${v.slice(SECRET_PREFIX.length)})"`
@@ -32,6 +33,7 @@ function renderPosix(pr, p) {
 }
 function renderPwsh(pr, p) {
     const lines = [`function ${pr.launcher} {`];
+    lines.push(`  if ($args[0] -eq 'handoff') { ccprofiles handoff --from ${pr.name} --to $args[1]; return }`);
     for (const [k, v] of Object.entries(pr.env)) {
         lines.push(v.startsWith(SECRET_PREFIX)
             ? `  $env:${k} = (ccprofiles secrets get ${v.slice(SECRET_PREFIX.length)})`

package/dist/secrets.js

@@ -35,12 +35,12 @@ export class FileBackend {
         const c = createCipheriv('aes-256-gcm', this.key(f.salt), iv);
         const data = Buffer.concat([c.update(value, 'utf8'), c.final()]);
         f.entries[key] = { iv: iv.toString('base64'), tag: c.getAuthTag().toString('base64'), data: data.toString('base64') };
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
     async delete(key) {
         const f = await this.load();
         delete f.entries[key];
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
 }
 const realExec = promisify(execFile);
@@ -150,12 +150,12 @@ export class DpapiBackend {
     async set(key, value) {
         const f = await this.load();
         f.entries[key] = await this.crypt.protect(value);
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
     async delete(key) {
         const f = await this.load();
         delete f.entries[key];
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
 }
 export class SecretsStore {
@@ -171,7 +171,7 @@ export class SecretsStore {
         return JSON.parse(await readFile(this.indexPath, 'utf8'));
     }
     async writeIndex(names) {
-        await atomicWrite(this.indexPath, JSON.stringify([...new Set(names)].sort()));
+        await atomicWrite(this.indexPath, JSON.stringify([...new Set(names)].sort()), { mode: 0o600 });
     }
     get backendName() { return this.backend.name; }
     async get(key) { return this.backend.get(key); }

package/dist/sessions.d.ts

@@ -6,6 +6,9 @@ export interface SessionMeta {
     gitBranch: string | null;
     model: string | null;
     sizeBytes: number;
+    /** true when the transcript was too large to fully scan (per-file cap) or the per-request
+     *  byte budget ran out before reaching it — metadata is best-effort / incomplete. */
+    truncated?: boolean;
 }
 export interface ProjectSessions {
     agent: 'claude' | 'codex';
@@ -27,6 +30,12 @@ export interface SessionTranscript {
     project: string;
     messages: TranscriptEntry[];
 }
+/** Test/observability hook: cumulative cache hit/miss counts across all scanSessions() calls
+ *  in this process. Not reset automatically — callers that need deltas should diff two reads. */
+export declare function sessionScanCacheStats(): {
+    hits: number;
+    misses: number;
+};
 /** Best-effort decode of Claude Code's project dir name (cwd from a record is preferred). */
 export declare function decodeProjectDir(name: string): string;
 export declare function scanSessions(opts: {

package/dist/sessions.js

@@ -3,11 +3,52 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 const SAFE_SESSION_ID = /^[A-Za-z0-9_-]{1,160}$/;
 const MAX_ENTRY_CHARS = 100_000;
+const claudeSessionCache = new Map();
+const codexSessionCache = new Map();
+/** Per-file cap: a transcript above this size is summarized without reading its content. */
+const MAX_FILE_SCAN_BYTES = 10 * 1024 * 1024;
+/** Per-request cap: once this many bytes have been read from disk in one scanSessions() call,
+ *  remaining (uncached) files are summarized without reading their content either. */
+const MAX_TOTAL_SCAN_BYTES = 50 * 1024 * 1024;
+let scanCacheHits = 0;
+let scanCacheMisses = 0;
+/** Test/observability hook: cumulative cache hit/miss counts across all scanSessions() calls
+ *  in this process. Not reset automatically — callers that need deltas should diff two reads. */
+export function sessionScanCacheStats() {
+    return { hits: scanCacheHits, misses: scanCacheMisses };
+}
 /** Best-effort decode of Claude Code's project dir name (cwd from a record is preferred). */
 export function decodeProjectDir(name) {
     return name.replace(/^-/, '/').replace(/-/g, '/');
 }
-async function parseClaudeSession(file) {
+/**
+ * Shared mtime+size cache lookup for the two session-file formats. `parseFull` runs only on a
+ * cache miss with a fresh read; `makeTruncated` builds a summary-only result when the file is
+ * over the per-file cap or the per-request byte budget is exhausted. A size-cap truncation is
+ * deterministic (depends only on the file) and gets cached; a budget-cap truncation depends on
+ * request ordering, so it is *not* cached — a later request with a fresh budget may read it fully.
+ */
+async function cachedParse(file, cache, budget, parseFull, makeTruncated) {
+    let st;
+    try {
+        st = await stat(file);
+    }
+    catch {
+        return null;
+    }
+    const cached = cache.get(file);
+    if (cached && cached.mtimeMs === st.mtimeMs && cached.size === st.size) {
+        scanCacheHits++;
+        return cached.result;
+    }
+    scanCacheMisses++;
+    if (st.size > MAX_FILE_SCAN_BYTES) {
+        const result = makeTruncated(st);
+        cache.set(file, { mtimeMs: st.mtimeMs, size: st.size, result });
+        return result;
+    }
+    if (st.size > budget.bytesLeft)
+        return makeTruncated(st); // not cached — budget is per-request
     let raw;
     try {
         raw = await readFile(file, 'utf8');
@@ -15,36 +56,43 @@ async function parseClaudeSession(file) {
     catch {
         return null;
     }
-    const st = await stat(file);
-    const lines = raw.split('\n').filter(l => l.trim());
-    let firstPrompt = null, gitBranch = null, model = null, cwd = null;
-    for (const line of lines) {
-        let rec;
-        try {
-            rec = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        if (cwd === null && typeof rec.cwd === 'string')
-            cwd = rec.cwd;
-        if (gitBranch === null && typeof rec.gitBranch === 'string')
-            gitBranch = rec.gitBranch;
-        if (firstPrompt === null && rec.type === 'user') {
-            const c = rec.message?.content;
-            const text = typeof c === 'string' ? c : Array.isArray(c) ? c.find((x) => x?.type === 'text')?.text : null;
-            if (typeof text === 'string' && text.trim() && !text.trimStart().startsWith('<'))
-                firstPrompt = text.trim().slice(0, 200);
-        }
-        if (model === null && typeof rec.message?.model === 'string')
-            model = rec.message.model;
-        if (firstPrompt && model && gitBranch && cwd)
-            break;
-    }
+    budget.bytesLeft -= st.size;
+    const result = parseFull(raw, st);
+    cache.set(file, { mtimeMs: st.mtimeMs, size: st.size, result });
+    return result;
+}
+async function parseClaudeSession(file, budget) {
     const id = file.split(/[\\/]/).pop().replace(/\.jsonl$/, '');
-    return { meta: { id, mtime: st.mtimeMs, messageCount: lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
+    return cachedParse(file, claudeSessionCache, budget, (raw, st) => {
+        const lines = raw.split('\n').filter(l => l.trim());
+        let firstPrompt = null, gitBranch = null, model = null, cwd = null;
+        for (const line of lines) {
+            let rec;
+            try {
+                rec = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (cwd === null && typeof rec.cwd === 'string')
+                cwd = rec.cwd;
+            if (gitBranch === null && typeof rec.gitBranch === 'string')
+                gitBranch = rec.gitBranch;
+            if (firstPrompt === null && rec.type === 'user') {
+                const c = rec.message?.content;
+                const text = typeof c === 'string' ? c : Array.isArray(c) ? c.find((x) => x?.type === 'text')?.text : null;
+                if (typeof text === 'string' && text.trim() && !text.trimStart().startsWith('<'))
+                    firstPrompt = text.trim().slice(0, 200);
+            }
+            if (model === null && typeof rec.message?.model === 'string')
+                model = rec.message.model;
+            if (firstPrompt && model && gitBranch && cwd)
+                break;
+        }
+        return { meta: { id, mtime: st.mtimeMs, messageCount: lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
+    }, st => ({ meta: { id, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: null }));
 }
-async function scanProjectsDir(projectsDir, scope) {
+async function scanProjectsDir(projectsDir, scope, budget) {
     if (!existsSync(projectsDir))
         return [];
     const out = [];
@@ -71,7 +119,7 @@ async function scanProjectsDir(projectsDir, scope) {
         for (const f of files) {
             if (!f.endsWith('.jsonl'))
                 continue;
-            const parsed = await parseClaudeSession(join(pdir, f));
+            const parsed = await parseClaudeSession(join(pdir, f), budget);
             if (!parsed)
                 continue;
             sessions.push(parsed.meta);
@@ -218,60 +266,55 @@ async function parseCodexTranscript(file, scope) {
     }
     return { id, agent: 'codex', scope, project, messages };
 }
-async function parseCodexSession(file) {
-    let raw;
-    try {
-        raw = await readFile(file, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    const st = await stat(file);
-    const lines = raw.split('\n').filter(l => l.trim());
-    let id = null, firstPrompt = null, gitBranch = null;
-    let model = null, cwd = null, messageCount = 0;
-    for (const line of lines) {
-        let rec;
-        try {
-            rec = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        const payload = rec?.payload;
-        if (rec?.type === 'session_meta') {
-            if (typeof payload?.id === 'string')
-                id = payload.id;
-            else if (typeof payload?.session_id === 'string')
-                id = payload.session_id;
-            if (typeof payload?.cwd === 'string')
-                cwd = payload.cwd;
-            if (typeof payload?.git?.branch === 'string')
-                gitBranch = payload.git.branch;
-        }
-        if (rec?.type === 'turn_context') {
-            if (cwd === null && typeof payload?.cwd === 'string')
-                cwd = payload.cwd;
-            if (model === null && typeof payload?.model === 'string')
-                model = payload.model;
-        }
-        if (rec?.type === 'response_item' && payload?.type === 'message'
-            && (payload?.role === 'user' || payload?.role === 'assistant')) {
-            messageCount++;
-            if (firstPrompt === null && payload.role === 'user') {
-                const text = messageText(payload.content);
-                if (text?.trim() && !text.trimStart().startsWith('<'))
-                    firstPrompt = text.trim().slice(0, 200);
+async function parseCodexSession(file, budget) {
+    const filename = file.split(/[\\/]/).pop().replace(/\.jsonl$/, '');
+    const fallbackId = filename.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i)?.[0] ?? filename;
+    return cachedParse(file, codexSessionCache, budget, (raw, st) => {
+        const lines = raw.split('\n').filter(l => l.trim());
+        let id = null, firstPrompt = null, gitBranch = null;
+        let model = null, cwd = null, messageCount = 0;
+        for (const line of lines) {
+            let rec;
+            try {
+                rec = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            const payload = rec?.payload;
+            if (rec?.type === 'session_meta') {
+                if (typeof payload?.id === 'string')
+                    id = payload.id;
+                else if (typeof payload?.session_id === 'string')
+                    id = payload.session_id;
+                if (typeof payload?.cwd === 'string')
+                    cwd = payload.cwd;
+                if (typeof payload?.git?.branch === 'string')
+                    gitBranch = payload.git.branch;
+            }
+            if (rec?.type === 'turn_context') {
+                if (cwd === null && typeof payload?.cwd === 'string')
+                    cwd = payload.cwd;
+                if (model === null && typeof payload?.model === 'string')
+                    model = payload.model;
+            }
+            if (rec?.type === 'response_item' && payload?.type === 'message'
+                && (payload?.role === 'user' || payload?.role === 'assistant')) {
+                messageCount++;
+                if (firstPrompt === null && payload.role === 'user') {
+                    const text = messageText(payload.content);
+                    if (text?.trim() && !text.trimStart().startsWith('<'))
+                        firstPrompt = text.trim().slice(0, 200);
+                }
+            }
+            if (firstPrompt === null && rec?.type === 'event_msg' && payload?.type === 'user_message'
+                && typeof payload?.message === 'string' && payload.message.trim()) {
+                firstPrompt = payload.message.trim().slice(0, 200);
             }
         }
-        if (firstPrompt === null && rec?.type === 'event_msg' && payload?.type === 'user_message'
-            && typeof payload?.message === 'string' && payload.message.trim()) {
-            firstPrompt = payload.message.trim().slice(0, 200);
-        }
-    }
-    const filename = file.split(/[\\/]/).pop().replace(/\.jsonl$/, '');
-    id ??= filename.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i)?.[0] ?? filename;
-    return { meta: { id, mtime: st.mtimeMs, messageCount: messageCount || lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
+        id ??= fallbackId;
+        return { meta: { id, mtime: st.mtimeMs, messageCount: messageCount || lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
+    }, st => ({ meta: { id: fallbackId, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: null }));
 }
 async function codexSessionFiles(dir) {
     let entries;
@@ -311,10 +354,10 @@ async function claudeSessionFile(projectsDir, id) {
     }
     return null;
 }
-async function scanCodexSessionsDir(sessionsDir, scope) {
+async function scanCodexSessionsDir(sessionsDir, scope, budget) {
     const byProject = new Map();
     for (const file of await codexSessionFiles(sessionsDir)) {
-        const parsed = await parseCodexSession(file);
+        const parsed = await parseCodexSession(file, budget);
         if (!parsed)
             continue;
         const project = parsed.cwd ?? '(unknown project)';
@@ -328,9 +371,10 @@ async function scanCodexSessionsDir(sessionsDir, scope) {
     }));
 }
 export async function scanSessions(opts) {
+    const budget = { bytesLeft: MAX_TOTAL_SCAN_BYTES };
     const out = [];
-    out.push(...await scanProjectsDir(join(opts.sharedRoot, 'projects'), 'shared'));
-    out.push(...await scanCodexSessionsDir(join(opts.sharedRoot, 'sessions'), 'shared'));
+    out.push(...await scanProjectsDir(join(opts.sharedRoot, 'projects'), 'shared', budget));
+    out.push(...await scanCodexSessionsDir(join(opts.sharedRoot, 'sessions'), 'shared', budget));
     for (const p of opts.profiles) {
         const agent = p.agent ?? 'claude';
         const sessionDir = join(p.dir, agent === 'codex' ? 'sessions' : 'projects');
@@ -342,8 +386,8 @@ export async function scanSessions(opts) {
             continue;
         }
         out.push(...agent === 'codex'
-            ? await scanCodexSessionsDir(sessionDir, p.name)
-            : await scanProjectsDir(sessionDir, p.name));
+            ? await scanCodexSessionsDir(sessionDir, p.name, budget)
+            : await scanProjectsDir(sessionDir, p.name, budget));
     }
     return out;
 }