chainlesschain 0.162.123 → 0.162.125

package/src/commands/incentive.js

@@ -482,8 +482,8 @@ export function registerIncentiveCommand(program) {
     .command("register-account-v2 <account-id>")
     .description("V2: register a tracked account (tags ACTIVE)")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -511,8 +511,8 @@ export function registerIncentiveCommand(program) {
     .description("V2: transition account status (active|frozen|closed)")
     .option("-r, --reason <reason>", "Reason")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((accountId, status, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, status, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -530,8 +530,8 @@ export function registerIncentiveCommand(program) {
     .command("freeze-account <account-id>")
     .description("V2: shortcut → frozen")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = freezeAccount(db, accountId, opts.reason);
@@ -545,8 +545,8 @@ export function registerIncentiveCommand(program) {
     .command("unfreeze-account <account-id>")
     .description("V2: shortcut → active (from frozen)")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = unfreezeAccount(db, accountId, opts.reason);
@@ -560,8 +560,8 @@ export function registerIncentiveCommand(program) {
     .command("close-account <account-id>")
     .description("V2: shortcut → closed")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = closeAccount(db, accountId, opts.reason);
@@ -578,8 +578,8 @@ export function registerIncentiveCommand(program) {
     .requiredOption("-a, --amount <amount>", "Amount")
     .option("-c, --contribution <id>", "Contribution ID")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -613,8 +613,8 @@ export function registerIncentiveCommand(program) {
     .description("V2: transition claim (pending|approved|paid|rejected)")
     .option("-r, --reason <reason>", "Reason")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((claimId, status, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, status, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -632,8 +632,8 @@ export function registerIncentiveCommand(program) {
     .command("approve-claim <claim-id>")
     .description("V2: shortcut → approved")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = approveClaim(db, claimId, opts.reason);
@@ -647,8 +647,8 @@ export function registerIncentiveCommand(program) {
     .command("reject-claim <claim-id>")
     .description("V2: shortcut → rejected")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = rejectClaim(db, claimId, opts.reason);
@@ -662,8 +662,8 @@ export function registerIncentiveCommand(program) {
     .command("pay-claim <claim-id>")
     .description("V2: shortcut → paid (stamps paidAt)")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = payClaim(db, claimId, opts.reason);
@@ -676,8 +676,8 @@ export function registerIncentiveCommand(program) {
   inc
     .command("auto-expire-unclaimed-claims")
     .description("V2: bulk-reject stale PENDING claims")
-    .action(() => {
-      const ctx = bootstrap();
+    .action(async () => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const expired = autoExpireUnclaimedClaims(db);

package/src/commands/init.js

@@ -6,6 +6,7 @@
  */
 
 import chalk from "chalk";
+import { firstBalancedJson } from "../lib/json-schema-output.js";
 import fs from "fs";
 import path from "path";
 import { logger } from "../lib/logger.js";
@@ -1841,8 +1842,8 @@ with open(r"""\${tmpJson}""", "w", encoding="utf-8") as f:
     // Parse LLM result
     let updatedCells;
     try {
-      const jsonMatch = llmResult.match(/\\[\\s*\\{[\\s\\S]*\\}\\s*\\]/);
-      updatedCells = JSON.parse(jsonMatch ? jsonMatch[0] : llmResult);
+      const jsonText = firstBalancedJson(llmResult, "[");
+      updatedCells = JSON.parse(jsonText || llmResult);
     } catch (_e) {
       return { success: false, error: "LLM 返回格式不正确，无法解析 JSON", hint: "请重试或简化修改指令" };
     }
@@ -1947,8 +1948,8 @@ with open(r"""\${tmpJson}""", "w", encoding="utf-8") as f:
 
     let updatedRuns;
     try {
-      const jsonMatch = llmResult.match(/\\[\\s*\\{[\\s\\S]*\\}\\s*\\]/);
-      updatedRuns = JSON.parse(jsonMatch ? jsonMatch[0] : llmResult);
+      const jsonText = firstBalancedJson(llmResult, "[");
+      updatedRuns = JSON.parse(jsonText || llmResult);
     } catch (_e) {
       return { success: false, error: "LLM 返回格式不正确，无法解析 JSON", hint: "请重试或简化修改指令" };
     }

package/src/commands/instinct.js

@@ -86,9 +86,14 @@ export function registerInstinctCommand(program) {
           logger.log(chalk.bold(`Learned Instincts (${instincts.length}):\n`));
           for (const inst of instincts) {
             const pct = (inst.confidence * 100).toFixed(0);
-            const bar =
-              "█".repeat(Math.round(inst.confidence * 10)) +
-              "░".repeat(10 - Math.round(inst.confidence * 10));
+            // Clamp to [0,10] so a stored confidence outside [0,1]
+            // (recordBatch upserts caller-supplied values unclamped) can't
+            // make repeat() go negative and crash the whole list.
+            const lvl = Math.max(
+              0,
+              Math.min(10, Math.round(inst.confidence * 10) || 0),
+            );
+            const bar = "█".repeat(lvl) + "░".repeat(10 - lvl);
             logger.log(
               `  ${chalk.gray(inst.id.slice(0, 8))}  ${chalk.cyan(inst.category.padEnd(18))} ${bar} ${pct}%`,
             );
@@ -124,7 +129,13 @@ export function registerInstinctCommand(program) {
           const fs = await import("fs");
           fs.writeFileSync(options.output, JSON.stringify(rows), "utf-8");
           if (options.json) {
-            console.log(JSON.stringify({ ok: true, count: rows.length, output: options.output }));
+            console.log(
+              JSON.stringify({
+                ok: true,
+                count: rows.length,
+                output: options.output,
+              }),
+            );
           } else {
             logger.log(`exported ${rows.length} instincts → ${options.output}`);
           }
@@ -141,7 +152,9 @@ export function registerInstinctCommand(program) {
   // instinct import — §8.3 restore: idempotent upsert by id from a JSON-array file
   instinct
     .command("import")
-    .description("Import instincts from a JSON array file (idempotent upsert by id; §8.3)")
+    .description(
+      "Import instincts from a JSON array file (idempotent upsert by id; §8.3)",
+    )
     .requiredOption("--input <file>", "JSON array of instincts to import")
     .option("--json", "Output JSON result")
     .action(async (options) => {

package/src/commands/mcp.js

@@ -42,6 +42,25 @@ export function loginWantsNoBrowser(options = {}) {
   return options.open === false || options.browser === false;
 }
 
+/**
+ * Detect a headless environment where opening a browser is futile, so `mcp
+ * login` prints the authorize URL for manual opening instead of launching a
+ * popup that can never appear (Claude-Code 2.1.191 parity: "headless
+ * environments skip the browser popup and go straight to the paste-the-URL
+ * prompt"). The localhost callback still catches the code, so login completes.
+ *
+ * Heuristics: a CI marker forces headless on any OS; macOS/Windows otherwise
+ * always have a window server; on Linux/BSD a browser needs a display server
+ * (`DISPLAY`/`WAYLAND_DISPLAY`) — its absence (e.g. SSH without X11 forwarding)
+ * means headless. `CI=false`/`CI=0` are treated as not-CI.
+ */
+export function isHeadlessEnv(env = process.env, platform = process.platform) {
+  const ci = env.CI;
+  if (ci && ci !== "false" && ci !== "0") return true;
+  if (platform === "darwin" || platform === "win32") return false;
+  return !(env.DISPLAY || env.WAYLAND_DISPLAY);
+}
+
 // Singleton MCP client for session reuse
 let mcpClient = null;
 
@@ -146,7 +165,7 @@ export function registerMcpCommand(program) {
   mcp
     .command("login <target>")
     .description(
-      "Authorize a remote MCP server via OAuth (opens a browser); stores the token. <target> is a URL or a configured server name.",
+      "Authorize a remote MCP server via OAuth (opens a browser, or prints the URL in headless/SSH environments); stores the token. <target> is a URL or a configured server name.",
     )
     .option("--scope <scope>", "OAuth scope(s) to request")
     .option(
@@ -168,8 +187,16 @@ export function registerMcpCommand(program) {
       try {
         const url = await resolveAuthTargetUrl(program, target);
         const oauth = await import("../lib/mcp-oauth.js");
-        if (loginWantsNoBrowser(options)) {
-          oauth._deps.openBrowser = () => false; // --no-open / --no-browser
+        const explicitNoBrowser = loginWantsNoBrowser(options);
+        if (explicitNoBrowser || isHeadlessEnv()) {
+          oauth._deps.openBrowser = () => false; // --no-open / --no-browser / headless
+          if (!explicitNoBrowser) {
+            logger.log(
+              chalk.gray(
+                "Headless environment — printing the authorize URL instead of opening a browser.",
+              ),
+            );
+          }
         }
         logger.log(chalk.gray(`Authorizing ${url} …`));
         const rec = await oauth.authorizeInteractive(url, {

package/src/commands/memory.js

@@ -143,8 +143,11 @@ export function registerMemoryCommand(program) {
         } else {
           logger.log(chalk.bold(`Memory (${entries.length} entries):\n`));
           for (const e of entries) {
-            const stars =
-              "★".repeat(e.importance) + "☆".repeat(5 - e.importance);
+            // Clamp to [0,5] so an out-of-range stored importance (rows
+            // written outside the clamped `memory add` path) can't make
+            // repeat() go negative and crash the whole list.
+            const imp = Math.max(0, Math.min(5, Math.round(e.importance) || 0));
+            const stars = "★".repeat(imp) + "☆".repeat(5 - imp);
             logger.log(
               `  ${chalk.gray(e.id.slice(0, 12))}  ${chalk.yellow(stars)}  ${chalk.cyan(e.category)}`,
             );
@@ -180,9 +183,17 @@ export function registerMemoryCommand(program) {
           const fs = await import("fs");
           fs.writeFileSync(options.output, JSON.stringify(entries), "utf-8");
           if (options.json) {
-            console.log(JSON.stringify({ ok: true, count: entries.length, output: options.output }));
+            console.log(
+              JSON.stringify({
+                ok: true,
+                count: entries.length,
+                output: options.output,
+              }),
+            );
           } else {
-            logger.log(`exported ${entries.length} memory entries → ${options.output}`);
+            logger.log(
+              `exported ${entries.length} memory entries → ${options.output}`,
+            );
           }
         } else {
           console.log(JSON.stringify(entries)); // data command: emit the array
@@ -197,7 +208,9 @@ export function registerMemoryCommand(program) {
   // memory import — §8.3 restore: idempotent upsert by id from a JSON-array file
   memory
     .command("import")
-    .description("Import memory entries from a JSON array file (idempotent upsert by id; §8.3)")
+    .description(
+      "Import memory entries from a JSON array file (idempotent upsert by id; §8.3)",
+    )
     .requiredOption("--input <file>", "JSON array of memory entries to import")
     .option("--json", "Output JSON result")
     .action(async (options) => {

package/src/commands/mtc.js

@@ -595,7 +595,11 @@ export function registerMtcCommand(program) {
           return;
         }
         if (result.ok) {
-          logger.log(signerInfo ? signerInfo.banner : STOPGAP_BANNER);
+          // `verify` reads envelope+landmark from disk and creates no signer,
+          // so signerInfo is never defined here — referencing it threw a
+          // ReferenceError that the catch reported as "verify failed" on a
+          // SUCCESSFUL verify. Use the stopgap banner directly.
+          logger.log(STOPGAP_BANNER);
           logger.success(`Envelope verified`);
           logger.log(
             `  ${chalk.bold("Subject:")}   ${result.leaf.subject || "(no subject)"}`,

package/src/gateways/http/envelope-http-server.js

@@ -150,8 +150,23 @@ export function createEnvelopeHttpServer(options = {}) {
     }
     if (url === "/v1/health") return handleHealth(req, res);
     const match = SESSION_EVENTS_RE.exec(url);
-    if (match)
-      return handleSessionEvents(req, res, decodeURIComponent(match[1]));
+    if (match) {
+      let sessionId;
+      try {
+        sessionId = decodeURIComponent(match[1]);
+      } catch {
+        // Malformed percent-encoding (e.g. `/v1/sessions/%/events`) would
+        // otherwise throw URIError synchronously inside this request
+        // listener — an uncaught exception that crashes the whole server,
+        // unauthenticated. Reject as a bad request instead.
+        res.writeHead(400, {
+          "Content-Type": "application/json; charset=utf-8",
+        });
+        res.end(JSON.stringify({ error: "bad_request" }));
+        return;
+      }
+      return handleSessionEvents(req, res, sessionId);
+    }
     res.writeHead(404, { "Content-Type": "application/json; charset=utf-8" });
     res.end(JSON.stringify({ error: "not_found" }));
   }

package/src/gateways/terminal/PtyManager.js

@@ -75,7 +75,14 @@ export class PtyManager extends EventEmitter {
 
   create(req = {}) {
     if (this._stopped) throw new Error("pty_manager_stopped");
-    if (this._sessions.size >= this.config.maxConcurrentSessions) {
+    // Count only LIVE sessions against the cap. A just-exited session lingers
+    // in _sessions for ~60s before the reaper removes it (see onExit), so
+    // counting `_sessions.size` would spuriously reject new sessions right
+    // after a client closes shells — painful over a reconnecting Android link
+    // where open/close churn is normal.
+    let aliveCount = 0;
+    for (const s of this._sessions.values()) if (s.alive) aliveCount++;
+    if (aliveCount >= this.config.maxConcurrentSessions) {
       throw new Error("max_concurrent_sessions_exceeded");
     }
     const shell = req.shell || this.config.defaultShell;
@@ -97,12 +104,18 @@ export class PtyManager extends EventEmitter {
     const rows = Number.isFinite(req.rows) ? req.rows : 24;
     const cmd = resolveShellCmd(shell);
 
+    // req.env arrives from a remote WS frame; only merge a plain object, else a
+    // string/array would spread into garbage numeric env keys.
+    const extraEnv =
+      req.env && typeof req.env === "object" && !Array.isArray(req.env)
+        ? req.env
+        : {};
     const proc = pty.spawn(cmd, [], {
       name: "xterm-256color",
       cols,
       rows,
       cwd,
-      env: { ...process.env, ...(req.env || {}) },
+      env: { ...process.env, ...extraEnv },
     });
 
     const sessionId = randomUUID();

package/src/gateways/ws/message-dispatcher.js

@@ -23,7 +23,10 @@ export function createWsMessageDispatcher(server) {
       }
 
       const client = server.clients.get(clientId);
-      if (server.token && !client.authenticated && type !== "auth") {
+      // client may be undefined if it was removed mid-dispatch (heartbeat sweep
+      // / disconnect); treat a missing client as unauthenticated rather than
+      // throwing a TypeError (every sibling call site null-checks the client).
+      if (server.token && !client?.authenticated && type !== "auth") {
         server._send(ws, {
           id,
           type: "error",

package/src/gateways/ws/ws-server.js

@@ -184,6 +184,14 @@ export class ChainlessChainWSServer extends EventEmitter {
     this.token = options.token || null;
     this.maxConnections = options.maxConnections || 10;
     this.timeout = options.timeout || 30000;
+    // Cap inbound message size. The `ws` default is 100 MiB, and every frame is
+    // decoded + JSON.parsed in _handleConnection BEFORE the dispatcher's auth
+    // gate — so without a cap an UNAUTHENTICATED client could force a ~100 MB
+    // allocation per frame (×maxConnections) on a LAN-exposed (Android remote)
+    // deployment: a pre-auth memory-DoS. 32 MiB is generous for control frames
+    // and base64 image pastes while bounding abuse; `ws` closes oversize frames
+    // with code 1009 without buffering past the limit. Override per server.
+    this.maxPayloadBytes = options.maxPayloadBytes || 32 * 1024 * 1024;
 
     /** Optional Phase-5 envelope bus for fan-out to hosted HTTP SSE. */
     this.envelopeBus = options.envelopeBus || null;
@@ -214,6 +222,7 @@ export class ChainlessChainWSServer extends EventEmitter {
       this.wss = new WebSocketServer({
         port: this.port,
         host: this.host,
+        maxPayload: this.maxPayloadBytes,
       });
 
       this.wss.on("listening", () => {
@@ -341,6 +350,17 @@ export class ChainlessChainWSServer extends EventEmitter {
       this.emit("disconnection", { clientId });
     });
 
+    // A misbehaving client (oversize frame → 1009, malformed protocol, abrupt
+    // reset) makes the per-connection socket emit 'error'. With no listener Node
+    // treats it as an uncaught exception and could crash the whole server — so
+    // handle it here; the 'close' that follows removes the client from the map.
+    ws.on("error", (err) => {
+      this.emit("client-error", {
+        clientId,
+        error: (err && err.message) || String(err),
+      });
+    });
+
     ws.on("pong", () => {
       const client = this.clients.get(clientId);
       if (client) client.alive = true;

package/src/gateways/ws/ws-session-gateway.js

@@ -98,6 +98,31 @@ export class WSSessionManager {
 
     /** @type {Map<string, Session>} */
     this.sessions = new Map();
+
+    // Cap concurrent in-memory sessions. Each session holds a handler +
+    // interaction adapter + agent context, and nothing reaps them on client
+    // disconnect (they persist for resume; only closeSession removes one). An
+    // authenticated WS client could otherwise spam session-create to exhaust
+    // memory — this bounds it (mirrors the PTY manager's cap). Generous enough
+    // for legit multi-session use; resume does not create, so reconnecting to
+    // an existing session is never blocked by the cap. Override per manager.
+    this.maxSessions = Number.isFinite(options.maxSessions)
+      ? options.maxSessions
+      : 100;
+
+    // Cap patch bookkeeping per session. `patchHistory` is append-only (every
+    // applyPatch/rejectPatch pushes, nothing trims) and `pendingPatches` grows
+    // with each proposePatch — both are serialized in full by
+    // _persistSessionState on every session op, so unbounded growth means
+    // O(n) memory AND an O(n²) rewrite cost over a long session (and a tool
+    // proposing many large before/after/diff blobs amplifies it). Keep a
+    // recent window; oldest entries fall off (FIFO).
+    this.maxPatchHistory = Number.isFinite(options.maxPatchHistory)
+      ? options.maxPatchHistory
+      : 200;
+    this.maxPendingPatches = Number.isFinite(options.maxPendingPatches)
+      ? options.maxPendingPatches
+      : 50;
   }
 
   _normalizeEnabledToolNames(enabledToolNames) {
@@ -264,6 +289,11 @@ export class WSSessionManager {
    * @returns {{ sessionId: string }}
    */
   createSession(options = {}) {
+    if (this.sessions.size >= this.maxSessions) {
+      throw new Error(
+        `max_sessions_exceeded: ${this.maxSessions} concurrent sessions reached — close some before creating more`,
+      );
+    }
     const sessionId = this._generateId();
     const type = options.type || "agent";
     const baseProjectRoot = options.projectRoot || this.defaultProjectRoot;
@@ -483,9 +513,7 @@ export class WSSessionManager {
         permanentMemory,
         reviewState: metadata.reviewState || null,
         pendingPatches: this._hydratePendingPatches(metadata.pendingPatches),
-        patchHistory: Array.isArray(metadata.patchHistory)
-          ? metadata.patchHistory
-          : [],
+        patchHistory: this._boundPatchHistory(metadata.patchHistory),
         taskGraph: this._hydrateTaskGraph(metadata.taskGraph),
         interaction: null,
         createdAt: dbSession.created_at,
@@ -873,6 +901,15 @@ export class WSSessionManager {
     if (!(session.pendingPatches instanceof Map)) {
       session.pendingPatches = new Map();
     }
+    // Bound un-reviewed proposals: evict the oldest pending (Map preserves
+    // insertion order) once at cap. 50 unresolved patches is already
+    // pathological; dropping the stalest keeps memory + persisted state bounded
+    // without blocking a legitimate new proposal.
+    while (session.pendingPatches.size >= this.maxPendingPatches) {
+      const oldestKey = session.pendingPatches.keys().next().value;
+      if (oldestKey === undefined) break;
+      session.pendingPatches.delete(oldestKey);
+    }
     session.pendingPatches.set(patchId, patch);
     session.lastActivity = now;
     this._persistSessionState(sessionId);
@@ -901,11 +938,35 @@ export class WSSessionManager {
       session.patchHistory = [];
     }
     session.patchHistory.push(patch);
+    this._trimPatchHistory(session);
     session.lastActivity = patch.resolvedAt;
     this._persistSessionState(sessionId);
     return patch;
   }
 
+  /**
+   * Keep `patchHistory` bounded to the most recent maxPatchHistory entries.
+   * Oldest fall off the front (FIFO) so memory + persisted JSON stay bounded.
+   */
+  _trimPatchHistory(session) {
+    if (!Array.isArray(session.patchHistory)) return;
+    const overflow = session.patchHistory.length - this.maxPatchHistory;
+    if (overflow > 0) {
+      session.patchHistory.splice(0, overflow);
+    }
+  }
+
+  /**
+   * Bound a (possibly persisted/tampered) patchHistory array on load, keeping
+   * the most recent entries. Returns a fresh array (never the input).
+   */
+  _boundPatchHistory(list) {
+    if (!Array.isArray(list)) return [];
+    return list.length > this.maxPatchHistory
+      ? list.slice(list.length - this.maxPatchHistory)
+      : list.slice();
+  }
+
   /**
    * Discard a pending patch. Same bookkeeping as applyPatch but records a
    * "rejected" decision instead.
@@ -928,6 +989,7 @@ export class WSSessionManager {
       session.patchHistory = [];
     }
     session.patchHistory.push(patch);
+    this._trimPatchHistory(session);
     session.lastActivity = patch.resolvedAt;
     this._persistSessionState(sessionId);
     return patch;
@@ -1323,7 +1385,13 @@ export class WSSessionManager {
   _hydratePendingPatches(list) {
     const map = new Map();
     if (Array.isArray(list)) {
-      for (const patch of list) {
+      // Trim from the front so the most recent proposals survive a reload even
+      // if a prior (or tampered) persisted state exceeded the cap.
+      const bounded =
+        list.length > this.maxPendingPatches
+          ? list.slice(list.length - this.maxPendingPatches)
+          : list;
+      for (const patch of bounded) {
         if (patch && patch.patchId) {
           map.set(patch.patchId, patch);
         }

package/src/harness/background-task-manager.js

@@ -194,7 +194,11 @@ export class BackgroundTaskManager extends EventEmitter {
       return history;
     }
 
-    const items = history.slice(offset, offset + limit);
+    // offset + null === offset, so an offset-only page (no limit) used to
+    // slice(offset, offset) === [] and lose every item past the offset. Use
+    // history.length as the end when limit is null.
+    const end = limit === null ? history.length : offset + limit;
+    const items = history.slice(offset, end);
     return {
       items,
       total: history.length,

package/src/harness/jsonl-session-store.js

@@ -21,7 +21,32 @@ function getSessionsDir() {
   return dir;
 }
 
+/**
+ * A session id must be a single safe path segment. Ids are generated as
+ * `session-<ts>-<hex>`, but also arrive from CLI args (`cc agent --resume <id>`,
+ * `cc insights <id>`, `cc session show <id>`), so an id like `../../etc/x` would
+ * otherwise let sessionPath() read / append / delete a .jsonl OUTSIDE the
+ * sessions dir. Reject any separator or `..` (mirrors goal-store's
+ * isUnsafeGoalId / FileUploadService.isUnsafeSegment).
+ */
+export function isUnsafeSessionId(id) {
+  return (
+    id == null ||
+    id === "" ||
+    typeof id !== "string" ||
+    id.includes("/") ||
+    id.includes("\\") ||
+    id.includes("..")
+  );
+}
+
 export function sessionPath(sessionId) {
+  // Fail closed for path building: every write/delete goes through here, so a
+  // traversal id can never escape the sessions dir. Reads guard separately and
+  // degrade to not-found instead of throwing.
+  if (isUnsafeSessionId(sessionId)) {
+    throw new Error(`unsafe session id: ${String(sessionId).slice(0, 60)}`);
+  }
   return join(getSessionsDir(), `${sessionId}.jsonl`);
 }
 
@@ -69,6 +94,7 @@ export function appendCompactEvent(sessionId, stats) {
 }
 
 export function readEvents(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return []; // traversal id → treat as empty
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) return [];
 
@@ -184,6 +210,7 @@ export function forkSession(sourceId) {
 }
 
 export function sessionExists(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return false; // never resolve a traversal id
   return existsSync(sessionPath(sessionId));
 }
 
@@ -266,6 +293,15 @@ export function migrateLegacySessionFile(filePath, options = {}) {
 }
 
 export function validateJsonlSession(sessionId) {
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      sessionId,
+      valid: false,
+      reason: "invalid session id",
+      malformedLines: 0,
+      eventCount: 0,
+    };
+  }
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) {
     return {
@@ -335,6 +371,21 @@ function performLegacySessionMigration(sourcePath, options) {
   const legacy = normalizeLegacySession(parsed, basename(sourcePath, ".json"));
   const sessionId = legacy.id;
 
+  // A legacy file carries its OWN `id` (payload.id), so a crafted file could
+  // name a traversal target like "../../evil". sessionPath() throws on write
+  // (the backstop), but fail-fast HERE with a clear reason so the migration
+  // doesn't burn retry attempts on a deterministic error.
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      file: sourcePath,
+      sessionId,
+      migrated: false,
+      failed: true,
+      dryRun: Boolean(options.dryRun),
+      reason: "unsafe session id in legacy file",
+    };
+  }
+
   if (!options.force && sessionExists(sessionId)) {
     return {
       file: sourcePath,