chainlesschain 0.162.123 → 0.162.125

package/src/harness/mcp-client.js

@@ -101,6 +101,17 @@ export function isLikelyConnectionError(err) {
 const MCP_DISCOVERY_RETRIES = 2; // up to 3 attempts total
 const MCP_DISCOVERY_BACKOFF_MS = 250; // 250ms, 500ms
 
+/**
+ * Hard cap on the unterminated stdout tail buffered per stdio server. JSON-RPC
+ * frames are newline-delimited; a runaway or non-MCP process that streams
+ * without ever emitting a newline would otherwise grow `entry._buffer` without
+ * bound and exhaust memory. 16M chars is far above any legitimate single MCP
+ * message (even a tool result with embedded base64), so crossing it signals a
+ * misbehaving server. Override per server with `config.maxBufferChars` (0
+ * disables the cap).
+ */
+const MCP_MAX_BUFFER_CHARS = 16 * 1024 * 1024;
+
 /**
  * Is this a TRANSIENT error worth a short retry during capability discovery?
  * Narrower than isLikelyConnectionError: connection-level failures and 5xx
@@ -293,6 +304,20 @@ export class MCPClient extends EventEmitter {
           failPending(`MCP server "${name}" process error: ${err.message}`);
           this.emit("server-error", { name, error: err.message });
         });
+
+        // Writing to a stdio server that closed its stdin read end (or died
+        // mid-write) makes the stdin pipe emit an asynchronous 'error' (EPIPE).
+        // An 'error' event with no listener is an uncaught exception in Node and
+        // would CRASH the whole CLI — and the try/catch around stdin.write only
+        // catches synchronous throws, not this async event. Handle it: drain
+        // in-flight requests and surface it, mirroring the process 'error' path.
+        if (proc.stdin && typeof proc.stdin.on === "function") {
+          proc.stdin.on("error", (err) => {
+            entry.state = ServerState.ERROR;
+            failPending(`MCP server "${name}" stdin error: ${err.message}`);
+            this.emit("server-error", { name, error: err.message });
+          });
+        }
       } else {
         throw new Error(
           `transport "${transportKind}" is not supported by this client`,
@@ -384,6 +409,7 @@ export class MCPClient extends EventEmitter {
         try {
           entry.process.stdout?.removeAllListeners();
           entry.process.stderr?.removeAllListeners();
+          entry.process.stdin?.removeAllListeners?.();
           entry.process.removeAllListeners();
           entry.process.kill();
         } catch {
@@ -788,19 +814,18 @@ export class MCPClient extends EventEmitter {
       const contentType = response.headers?.get
         ? String(response.headers.get("content-type") || "").toLowerCase()
         : "";
+      // Bound the response body the same way the stdio path bounds its line
+      // buffer (per-server maxBufferChars override; 0 disables).
+      const cap = Number.isFinite(entry.config?.maxBufferChars)
+        ? entry.config.maxBufferChars
+        : MCP_MAX_BUFFER_CHARS;
 
       let envelope;
       if (contentType.includes("text/event-stream")) {
-        envelope = await _extractSseResponse(response, id);
+        envelope = await _extractSseResponse(response, id, cap);
       } else {
-        envelope =
-          typeof response.json === "function"
-            ? await response.json()
-            : JSON.parse(
-                typeof response.text === "function"
-                  ? await response.text()
-                  : "",
-              );
+        const text = await _readBodyCapped(response, cap);
+        envelope = text ? JSON.parse(text) : null;
       }
 
       if (!envelope || typeof envelope !== "object") {
@@ -868,6 +893,37 @@ export class MCPClient extends EventEmitter {
         // Skip malformed lines
       }
     }
+
+    // Guard against unbounded buffer growth: a runaway / non-MCP server that
+    // streams without ever sending a newline would grow the unterminated tail
+    // forever and exhaust memory. If the leftover partial line exceeds the cap,
+    // treat it as a fatal transport error (drop the buffer, drain in-flight
+    // requests, kill the process) rather than letting it grow without limit.
+    const cap = Number.isFinite(entry.config?.maxBufferChars)
+      ? entry.config.maxBufferChars
+      : MCP_MAX_BUFFER_CHARS;
+    if (cap > 0 && entry._buffer.length > cap) {
+      entry._buffer = "";
+      entry.state = ServerState.ERROR;
+      const errMsg = `MCP server "${serverName}" exceeded the ${cap}-char line buffer with no newline (runaway or non-MCP output)`;
+      for (const [, pending] of entry._pending) {
+        if (pending.timeout) clearTimeout(pending.timeout);
+        try {
+          pending.reject(new Error(errMsg));
+        } catch {
+          // already settled — ignore
+        }
+      }
+      entry._pending.clear();
+      if (entry.process) {
+        try {
+          entry.process.kill();
+        } catch {
+          // best-effort — surfacing the error is what matters
+        }
+      }
+      this.emit("server-error", { name: serverName, error: errMsg });
+    }
   }
 
   _handleMessage(serverName, msg) {
@@ -900,28 +956,70 @@ export class MCPClient extends EventEmitter {
 }
 
 /**
- * Parse a `text/event-stream` HTTP response body and return the first
- * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
- * `data:` chunks, comments, and non-JSON-RPC events.
+ * Read an HTTP response body to text with a hard size cap, mirroring the stdio
+ * transport's MCP_MAX_BUFFER_CHARS guard. The per-call timeout bounds TIME but
+ * not MEMORY: a malicious/buggy HTTP MCP server could stream a multi-GB body
+ * within the timeout and OOM the client. When the body is a readable stream
+ * (real fetch) we accumulate with a running cap and cancel on overflow; for a
+ * non-stream response (test mocks) we fall back to text() + a post-hoc check.
+ * A declared Content-Length over the cap is rejected before any read. cap<=0
+ * disables the limit.
  */
-async function _extractSseResponse(response, requestId) {
-  let text;
-  if (typeof response.text === "function") {
-    text = await response.text();
-  } else if (response.body && typeof response.body.getReader === "function") {
+async function _readBodyCapped(response, cap) {
+  if (
+    cap > 0 &&
+    response.headers &&
+    typeof response.headers.get === "function"
+  ) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > cap) {
+      throw new Error(
+        `MCP HTTP response exceeds the ${cap}-byte cap (content-length ${declared})`,
+      );
+    }
+  }
+  if (response.body && typeof response.body.getReader === "function") {
     const reader = response.body.getReader();
     const decoder = new TextDecoder("utf-8");
     const chunks = [];
-    while (true) {
+    let total = 0;
+    for (;;) {
       const { value, done } = await reader.read();
       if (done) break;
+      total += value && value.length ? value.length : 0;
+      if (cap > 0 && total > cap) {
+        try {
+          await reader.cancel();
+        } catch {
+          /* best-effort — the throw below is what matters */
+        }
+        throw new Error(
+          `MCP HTTP response exceeded the ${cap}-byte cap (runaway server)`,
+        );
+      }
       chunks.push(decoder.decode(value, { stream: true }));
     }
     chunks.push(decoder.decode());
-    text = chunks.join("");
-  } else {
-    throw new Error("SSE response is not readable");
+    return chunks.join("");
+  }
+  if (typeof response.text !== "function") {
+    throw new Error("HTTP response is not readable");
+  }
+  const text = await response.text();
+  if (cap > 0 && text.length > cap) {
+    throw new Error(`MCP HTTP response exceeded the ${cap}-char cap`);
   }
+  return text;
+}
+
+/**
+ * Parse a `text/event-stream` HTTP response body and return the first
+ * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
+ * `data:` chunks, comments, and non-JSON-RPC events. `cap` bounds the body
+ * size (see _readBodyCapped).
+ */
+async function _extractSseResponse(response, requestId, cap = 0) {
+  const text = await _readBodyCapped(response, cap);
 
   // Split into events on blank line, parse each event's concatenated `data:` lines.
   const events = text.split(/\r?\n\r?\n/);

package/src/harness/prompt-compressor.js

@@ -12,6 +12,12 @@
 import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 
+// Bounds for the fuzzy near-dup pass in _deduplicate (see there). Generous
+// enough that real near-dups are still caught; small enough that compaction of
+// a long, tool-heavy history stays sub-second instead of O(n²·content).
+const DEDUP_JACCARD_MAX_CHARS = 4000;
+const DEDUP_FUZZY_WINDOW = 100;
+
 export function estimateTokens(text) {
   if (!text) return 0;
   const chineseChars = (text.match(/[\u4e00-\u9fa5]/g) || []).length;
@@ -320,8 +326,18 @@ export class PromptCompressor {
     const last = [...messages].reverse().find((m) => m.role === "user");
     const rest = messages.filter((m) => m.role !== "system" && m !== last);
 
+    // Bound the fuzzy pass so it stays usable on the very conversations
+    // compaction targets (long + tool-heavy). The naive version compared every
+    // message against EVERY prior one (O(n²)) and ran jaccard over full content
+    // (O(content) per compare) — 300 msgs × ~8 KB tool results blocked ~3.4 s.
+    //  • Exact dedup (the md5 hash set) still covers ALL messages.
+    //  • The fuzzy near-dup compare uses a capped prefix (char-set jaccard is
+    //    alphabet-bounded, so a prefix barely changes the decision) and only the
+    //    most-recent kept entries (near-dups cluster; this can only UNDER-dedup,
+    //    never drop a genuinely-distinct message).
     const seen = new Map();
     const deduped = [];
+    const recent = []; // rolling window of recent kept {capped} contents
 
     for (const msg of rest) {
       const content = getContent(msg);
@@ -329,12 +345,13 @@ export class PromptCompressor {
 
       if (seen.has(hash)) continue;
 
+      const capped =
+        content.length > DEDUP_JACCARD_MAX_CHARS
+          ? content.slice(0, DEDUP_JACCARD_MAX_CHARS)
+          : content;
       let isDup = false;
-      for (const [, existing] of seen) {
-        if (
-          jaccardSimilarity(content, getContent(existing)) >=
-          this.similarityThreshold
-        ) {
+      for (const prev of recent) {
+        if (jaccardSimilarity(capped, prev) >= this.similarityThreshold) {
           isDup = true;
           break;
         }
@@ -343,6 +360,8 @@ export class PromptCompressor {
       if (!isDup) {
         seen.set(hash, msg);
         deduped.push(msg);
+        recent.push(capped);
+        if (recent.length > DEDUP_FUZZY_WINDOW) recent.shift();
       }
     }
 

package/src/harness/worktree-isolator.js

@@ -13,7 +13,9 @@ import { resolve } from "node:path";
 import {
   isGitRepo,
   gitExec,
+  gitExecArgs,
   assertSafeGitRef,
+  assertSafeGitPath,
 } from "../lib/git-integration.js";
 
 const WORKTREE_DIR = ".worktrees";
@@ -167,6 +169,7 @@ export function diffWorktree(repoDir, branchName, options = {}) {
   if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const base = options.baseBranch || "HEAD";
   const filePath = options.filePath || null;
+  if (filePath) assertSafeGitPath(filePath, "file path");
   const fileArg = filePath ? ` -- "${filePath}"` : "";
   const statOutput = gitExec(
     `diff ${base}...${branchName} --stat --numstat${fileArg}`,
@@ -223,14 +226,13 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
       const msg =
         options.message ||
         `feat: merge agent work from ${branchName} (squashed)`;
-      gitExec(`commit -m "${msg.replace(/"/g, '\\"')}"`, repoDir);
+      // Free-text message → argv (no shell) so `$()`/backticks/quotes in it
+      // can't inject a command (the old `-m "…"` only escaped `"`).
+      gitExecArgs(["commit", "-m", msg], repoDir);
     } else {
       const msg =
         options.message || `Merge branch '${branchName}' (agent task)`;
-      gitExec(
-        `merge ${branchName} --no-edit -m "${msg.replace(/"/g, '\\"')}"`,
-        repoDir,
-      );
+      gitExecArgs(["merge", branchName, "--no-edit", "-m", msg], repoDir);
     }
 
     if (deleteBranch) {
@@ -393,6 +395,7 @@ export function applyWorktreeAutomationCandidate(
   const conflictType = options.conflictType || null;
   const baseBranch = _resolveBaseBranchForMerge(repoDir, options.baseBranch);
 
+  if (filePath) assertSafeGitPath(filePath, "file path");
   if (!filePath) {
     throw new Error("filePath is required");
   }
@@ -459,7 +462,11 @@ export function applyWorktreeAutomationCandidate(
     const commitMessage =
       options.commitMessage ||
       `Resolve ${filePath} via ${candidate.label || candidateId}`;
-    gitExec(`commit -m "${commitMessage.replace(/"/g, '\\"')}"`, worktree.path);
+    // Free-text message → argv (no shell) so `$()` / backticks / quotes in a
+    // caller-supplied commitMessage can't inject a command. The prior
+    // `-m "${msg.replace(/"/g,'\\"')}"` only neutralized double quotes — the
+    // same gap already fixed in mergeWorktree.
+    gitExecArgs(["commit", "-m", commitMessage], worktree.path);
 
     const diff = diffWorktree(repoDir, branchName, { baseBranch });
     const filesChanged = diff.summary?.filesChanged || 0;
@@ -514,8 +521,10 @@ export function worktreeLog(repoDir, branchName, baseBranch = "HEAD") {
 
 function _fileStatus(repoDir, base, branch, filePath) {
   try {
-    const output = gitExec(
-      `diff ${base}...${branch} --name-status -- "${filePath}"`,
+    // filePath here comes from git's conflict output (a tracked file name);
+    // pass it via argv so an exotic / maliciously-named file can't inject.
+    const output = gitExecArgs(
+      ["diff", `${base}...${branch}`, "--name-status", "--", filePath],
       repoDir,
     );
     const status = output.trim().charAt(0);
@@ -603,7 +612,10 @@ function _buildConflictSummary(repoDir, filePath, branchName) {
 
 function _conflictStatusCode(repoDir, filePath) {
   try {
-    const output = gitExec(`status --porcelain -- "${filePath}"`, repoDir);
+    const output = gitExecArgs(
+      ["status", "--porcelain", "--", filePath],
+      repoDir,
+    );
     const firstLine = output.split("\n").find((line) => line.trim());
     return firstLine ? firstLine.slice(0, 2) : "UU";
   } catch (_e) {
@@ -779,7 +791,10 @@ function _buildDiffPreview(repoDir, filePath, branchName) {
   };
 
   try {
-    const diff = gitExec(`diff HEAD...${branchName} -- "${filePath}"`, repoDir);
+    const diff = gitExecArgs(
+      ["diff", `HEAD...${branchName}`, "--", filePath],
+      repoDir,
+    );
     preview.snippet =
       diff.length > 2000
         ? `${diff.slice(0, 2000)}\n... [diff truncated]`

package/src/lib/agent-core.js

@@ -3,8 +3,11 @@ export {
   AGENT_TOOLS,
   AGENT_TOOL_REGISTRY,
   MAX_SUB_AGENT_DEPTH,
+  MAX_SUB_AGENTS_PER_RUN,
   MAX_TOOL_RESULT_CHARS,
   capToolResultString,
+  safeStringifyToolResult,
+  tokenizeShellWords,
   reloadSkills,
   getAgentToolDefinitions,
   getAgentToolDescriptors,
@@ -25,6 +28,7 @@ export {
   listBackgroundShellTasks,
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
+  reapIdleBackgroundShellTasks,
   writeFileVerified,
   formatProviderHttpError,
   _accumulateOllamaStream,

package/src/lib/autonomous-agent.js

@@ -8,6 +8,7 @@
  */
 
 import { EventEmitter } from "events";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 // Exported for test injection
 export const _deps = {
@@ -47,6 +48,12 @@ export class CLIAutonomousAgent extends EventEmitter {
     this._initialized = false;
     this._maxIterations = 20;
     this._maxRetries = 3;
+    // Cap retained goal history. submitGoal stores every goal in _goals and
+    // nothing removes it; the REPL keeps one long-lived agent for the whole
+    // session, so goals (each holding steps/errors/result) accumulate without
+    // bound — and listGoals() returns the whole growing Map. Prune the oldest
+    // TERMINAL goals beyond this cap; running/pending/paused goals are kept.
+    this._maxGoals = 200;
   }
 
   /**
@@ -57,12 +64,14 @@ export class CLIAutonomousAgent extends EventEmitter {
     toolExecutor,
     hookManager,
     maxIterations,
+    maxGoals,
     iterationBudget,
   } = {}) {
     this._llmChat = llmChat || null;
     this._toolExecutor = toolExecutor || null;
     this._hookManager = hookManager || null;
     if (maxIterations) this._maxIterations = maxIterations;
+    if (Number.isFinite(maxGoals) && maxGoals > 0) this._maxGoals = maxGoals;
     this._iterationBudget = iterationBudget || null; // shared budget from caller
     this._initialized = true;
   }
@@ -95,6 +104,7 @@ export class CLIAutonomousAgent extends EventEmitter {
     };
 
     this._goals.set(goalId, goal);
+    this._pruneGoals();
     this.emit("goal:submitted", { goalId, description });
 
     // Start the ReAct loop asynchronously
@@ -107,6 +117,26 @@ export class CLIAutonomousAgent extends EventEmitter {
     return { goalId };
   }
 
+  /**
+   * Bound retained goal history to _maxGoals. Evicts the oldest TERMINAL goals
+   * (completed/failed/cancelled) FIFO; a still-active goal (pending/running/
+   * paused) is never dropped, so a burst of concurrent goals can briefly exceed
+   * the cap rather than losing live work.
+   */
+  _pruneGoals() {
+    if (this._goals.size <= this._maxGoals) return;
+    for (const [id, g] of this._goals) {
+      if (this._goals.size <= this._maxGoals) break;
+      if (
+        g.status === GoalStatus.COMPLETED ||
+        g.status === GoalStatus.FAILED ||
+        g.status === GoalStatus.CANCELLED
+      ) {
+        this._goals.delete(id);
+      }
+    }
+  }
+
   /**
    * Pause a running goal.
    */
@@ -471,10 +501,10 @@ Reply with a JSON object: { "action": "retry|add_step|skip", "newParams": {...},
 
   _parseSteps(text) {
     try {
-      // Extract JSON array from response
-      const match = text.match(/\[[\s\S]*\]/);
-      if (match) {
-        return JSON.parse(match[0]);
+      // Extract the first balanced JSON array from the response
+      const jsonText = firstBalancedJson(text, "[");
+      if (jsonText) {
+        return JSON.parse(jsonText);
       }
     } catch (_err) {
       // Parse failure
@@ -484,8 +514,8 @@ Reply with a JSON object: { "action": "retry|add_step|skip", "newParams": {...},
 
   _parseJSON(text) {
     try {
-      const match = text.match(/\{[\s\S]*\}/);
-      if (match) return JSON.parse(match[0]);
+      const jsonText = firstBalancedJson(text, "{");
+      if (jsonText) return JSON.parse(jsonText);
     } catch (_err) {
       // Parse failure
     }

package/src/lib/chat-intent-service.js

@@ -18,6 +18,7 @@
  */
 
 import { chatWithStreaming, chatStream } from "./chat-core.js";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 const DEFAULT_INTENT_TIMEOUT_MS = 15000;
 
@@ -76,8 +77,9 @@ function extractJson(content) {
   if (fenced) return fenced[1].trim();
   const generic = content.match(/```\s*([\s\S]*?)```/);
   if (generic) return generic[1].trim();
-  const bare = content.match(/\{[\s\S]*\}/);
-  return bare ? bare[0] : null;
+  // Balanced extraction stops at the first complete object instead of the old
+  // greedy /\{[\s\S]*\}/, which over-captured trailing prose with a stray }.
+  return firstBalancedJson(content, "{");
 }
 
 /**
@@ -317,7 +319,12 @@ const FOLLOWUP_RULES = {
       /(颜色|字体|大小|位置|标题).*(是|用|为)/,
       /^.{1,20}(应该|具体)(是|为)/,
       /^数据(来源|是)/,
-      /.*(用|采用).*(字体|颜色|大小)/,
+      // De-catastrophized: the old `/.*(用|采用).*(字体…)/` had a leading greedy
+      // `.*` overlapping `(用)`, causing exponential backtracking (a 2 KB input
+      // of "用" took ~3 s). `.test()` already searches anywhere, so the leading
+      // `.*` is redundant; a lazy middle drops it to quadratic, and the input
+      // cap in ruleBasedClassify bounds that.
+      /(用|采用)[\s\S]*?(字体|颜色|大小)/,
     ],
   },
   CANCEL_TASK: {
@@ -332,8 +339,15 @@ const FOLLOWUP_RULES = {
   },
 };
 
+// A follow-up intent (continue / modify / clarify / cancel) is determinable
+// from the start of the message; cap the text the heuristic regexes see so a
+// huge paste can't drive their (quadratic) backtracking into a DoS. The full
+// input is still forwarded to the LLM path / downstream — only this local
+// classification is truncated.
+const MAX_CLASSIFY_INPUT = 2000;
+
 function ruleBasedClassify(userInput) {
-  const input = (userInput || "").trim();
+  const input = (userInput || "").trim().slice(0, MAX_CLASSIFY_INPUT);
 
   if (input.length === 0) {
     return {

package/src/lib/checkpoint-store.js

@@ -76,9 +76,19 @@ function gitDir(root) {
   return path.resolve(root, git(["rev-parse", "--git-dir"], { cwd: root }));
 }
 
-/** Ref-safe session segment. */
+/**
+ * Ref-safe session segment. Beyond the charset filter, enforce git's per-
+ * component ref rules so a legit-looking name never makes every checkpoint op
+ * throw: a component may not begin with `.`, contain `..`, or end with `.lock`
+ * (`/` is already collapsed to `-`, so the session is always a single segment
+ * and cannot traverse the ref namespace).
+ */
 function sanitizeSession(session) {
-  const s = String(session || "default").replace(/[^A-Za-z0-9._-]/g, "-");
+  let s = String(session || "default").replace(/[^A-Za-z0-9._-]/g, "-");
+  s = s.replace(/\.{2,}/g, "."); // git forbids ".." in a refname
+  s = s.replace(/^\.+/, ""); // a component may not begin with "."
+  s = s.replace(/\.lock$/i, "-lock"); // nor end with ".lock"
+  s = s.replace(/\.+$/, ""); // nor end with a dot
   return s || "default";
 }
 
@@ -86,9 +96,20 @@ function sessionPrefix(session) {
   return `${REF_NS}/${sanitizeSession(session)}`;
 }
 
+// Monotonic per-process counter so two temp-index paths minted in the same
+// millisecond never collide. pid disambiguates across processes; Date.now() +
+// this counter disambiguate within one. A collision would mean two operations
+// sharing one GIT_INDEX_FILE (corrupt snapshot) or one's cleanup deleting the
+// other's live index.
+let _indexSeq = 0;
+
 /** Unique temp index path inside .git (never the real index). */
 function tempIndexPath(dir) {
-  return path.join(dir, `cc-checkpoint-index-${process.pid}-${Date.now()}`);
+  _indexSeq = (_indexSeq + 1) >>> 0;
+  return path.join(
+    dir,
+    `cc-checkpoint-index-${process.pid}-${Date.now()}-${_indexSeq}`,
+  );
 }
 
 /**
@@ -256,6 +277,29 @@ export function createCheckpoint(cwd = process.cwd(), opts = {}) {
       /* non-critical */
     }
 
+    // Bound the session's checkpoint history when asked. Auto-checkpointing
+    // (one ref per mutating tool) passes a cap so a long agentic run can't
+    // accumulate unbounded refs — which also keeps nextId's per-create
+    // for-each-ref scan bounded. Best-effort: pruning never fails the
+    // checkpoint, and the dropped commit objects stay reachable via newer
+    // checkpoints' parent chain (only addressability by id is lost for the
+    // oldest entries). Manual `cc checkpoint create` omits the cap → unbounded.
+    if (Number.isFinite(opts.maxPerSession) && opts.maxPerSession > 0) {
+      try {
+        const rows = listRefs(root, session); // oldest-first (creatordate)
+        const excess = rows.length - opts.maxPerSession;
+        for (let i = 0; i < excess; i++) {
+          try {
+            git(["update-ref", "-d", rows[i].ref], { cwd: root });
+          } catch {
+            /* best-effort — a failed prune never affects the new checkpoint */
+          }
+        }
+      } catch {
+        /* pruning is entirely best-effort */
+      }
+    }
+
     return { id, ref, commit, tree, parent, label, session, createdAt, files };
   } finally {
     rmQuiet(tmpIndex);
@@ -557,4 +601,10 @@ export function clearCheckpoints(cwd = process.cwd(), opts = {}) {
 }
 
 // Exposed for unit tests / advanced callers.
-export const _internals = { git, repoRoot, sanitizeSession, snapshotTree };
+export const _internals = {
+  git,
+  repoRoot,
+  sanitizeSession,
+  snapshotTree,
+  tempIndexPath,
+};