chainlesschain 0.162.123 → 0.162.125

package/src/lib/claude-code-bridge.js

@@ -29,6 +29,13 @@ export const AGENT_STATUS = {
   TIMEOUT: "timeout",
 };
 
+// Bound how much of a child's stdout/stderr we retain in memory. A verbose or
+// runaway `claude -p` can stream unbounded stream-json; without a cap,
+// outputChunks.join("") OOMs the orchestrator. We keep the TAIL (oldest chunks
+// dropped) because stream-json's terminal `result` / last-assistant line — the
+// only thing _parseStreamJson needs — is at the end.
+export const MAX_AGENT_OUTPUT_BYTES = 32 * 1024 * 1024;
+
 // ─── Detection ───────────────────────────────────────────────────
 
 /**
@@ -98,6 +105,7 @@ export class ClaudeCodeAgent extends EventEmitter {
       context = "",
       allowedTools = null,
       killGraceMs = 3000,
+      maxOutputBytes = MAX_AGENT_OUTPUT_BYTES,
     } = options;
 
     const fullPrompt = context
@@ -126,6 +134,19 @@ export class ClaudeCodeAgent extends EventEmitter {
       const outDecoder = new TextDecoder("utf-8");
       const errDecoder = new TextDecoder("utf-8");
       let timedOut = false;
+      // Tail-bounded byte counters for the two buffers (see MAX_AGENT_OUTPUT_BYTES).
+      let outBytes = 0;
+      let errBytes = 0;
+      let outputTruncated = false;
+      // Drop oldest chunks until the buffer is back under the cap, keeping ≥1
+      // chunk (the most recent, where the result line lives).
+      const trim = (chunks, bytesRef) => {
+        let bytes = bytesRef;
+        while (bytes > maxOutputBytes && chunks.length > 1) {
+          bytes -= Buffer.byteLength(chunks.shift());
+        }
+        return bytes;
+      };
 
       const proc = _deps.spawn(this.cliCommand, args, {
         cwd,
@@ -155,15 +176,26 @@ export class ClaudeCodeAgent extends EventEmitter {
             ? data
             : outDecoder.decode(data, { stream: true });
         outputChunks.push(chunk);
+        outBytes += Buffer.byteLength(chunk);
+        if (outBytes > maxOutputBytes) {
+          outputTruncated = true;
+          outBytes = trim(outputChunks, outBytes);
+        }
+        // The live `output` event still streams every chunk verbatim — the cap
+        // only bounds what we RETAIN for the final rawOutput.
         this.emit("output", { agentId: this.id, chunk });
       });
 
       proc.stderr.on("data", (data) => {
-        errorChunks.push(
+        const chunk =
           typeof data === "string"
             ? data
-            : errDecoder.decode(data, { stream: true }),
-        );
+            : errDecoder.decode(data, { stream: true });
+        errorChunks.push(chunk);
+        errBytes += Buffer.byteLength(chunk);
+        if (errBytes > maxOutputBytes) {
+          errBytes = trim(errorChunks, errBytes);
+        }
       });
 
       proc.on("close", (code) => {
@@ -188,6 +220,7 @@ export class ClaudeCodeAgent extends EventEmitter {
           success: code === 0 && !timedOut,
           output: parsedOutput || rawOutput.slice(-4000), // last 4K chars fallback
           rawOutput,
+          outputTruncated, // true when the child exceeded maxOutputBytes
           exitCode: code,
           duration,
           timedOut,
@@ -257,6 +290,15 @@ export class ClaudeCodePool extends EventEmitter {
     this.model = options.model || null;
     this.agentTimeout = options.agentTimeout || 300_000;
 
+    // Bound retained completion history. dispatch() returns results directly,
+    // so _completed is only a recent-history buffer — but it was an unbounded
+    // array, so a long-lived pool dispatching many tasks leaked memory forever.
+    // Keep a recent window (FIFO). Default 1000; 0/invalid → 1000.
+    this.maxCompleted =
+      Number.isFinite(options.maxCompleted) && options.maxCompleted > 0
+        ? options.maxCompleted
+        : 1000;
+
     /** @type {Map<string, ClaudeCodeAgent>} */
     this._agents = new Map();
     this._completed = [];
@@ -315,6 +357,9 @@ export class ClaudeCodePool extends EventEmitter {
 
     this._agents.delete(agent.id);
     this._completed.push({ ...result, taskId: task.id });
+    if (this._completed.length > this.maxCompleted) {
+      this._completed.splice(0, this._completed.length - this.maxCompleted);
+    }
 
     this.emit("agent:complete", { taskId: task.id, ...result });
     return { taskId: task.id, ...result };

package/src/lib/cost-budget.js

@@ -86,8 +86,19 @@ export class CostBudget {
     if (est.free) {
       this.sawFree = true;
     } else if (est.matched) {
-      this.spentUsd = round(this.spentUsd + est.totalCost);
-      this.priced = true;
+      // Defense-in-depth for a SAFETY control: a non-finite/negative cost (e.g.
+      // a malformed price table entry, or a non-numeric token count in a
+      // provider's usage event) must NOT poison spentUsd into NaN — `NaN >=
+      // limit` is always false, which would silently DISABLE the hard cap and
+      // allow unbounded spend on an unattended run. Only fold a clean cost;
+      // otherwise treat the record as unpriced.
+      const cost = Number(est.totalCost);
+      if (Number.isFinite(cost) && cost >= 0) {
+        this.spentUsd = round(this.spentUsd + cost);
+        this.priced = true;
+      } else {
+        this.sawUnpriced = true;
+      }
     } else if (tokens > 0) {
       this.sawUnpriced = true;
     }

package/src/lib/credential-guard.js

@@ -25,8 +25,16 @@
  */
 
 import { createRequire } from "node:module";
+import fsDefault from "node:fs";
+import pathDefault from "node:path";
 
 const require_ = createRequire(import.meta.url);
+
+// Injectable for tests (realpath of a symlink without touching the real fs).
+export const _deps = {
+  realpathSync: fsDefault.realpathSync,
+  resolve: pathDefault.resolve,
+};
 // Reuse the shell policy's compound-command splitter (separators + $()/backtick
 // extraction). It is regex-based on separators and leaves backslashes intact,
 // so Windows paths survive (unlike the escaping tokenizer, which strips `\`).
@@ -51,6 +59,12 @@ const CREDENTIAL_BASENAMES = new Set([
   "id_dsa",
   "id_ecdsa",
   "id_ed25519", // private SSH keys (the `.pub` siblings have a different basename)
+  "id_ecdsa_sk",
+  "id_ed25519_sk", // FIDO/security-key SSH keys
+  ".htpasswd", // web-server basic-auth hashes
+  "kubeconfig", // bare KUBECONFIG file (the ~/.kube/config form is matched below)
+  ".terraformrc", // Terraform registry/API tokens
+  "terraform.rc",
 ]);
 
 // Extensions whose BYTES are the secret (private keys / cert bundles / keyrings).
@@ -67,6 +81,7 @@ const CREDENTIAL_PATH_RE = [
   /[\\/]\.docker[\\/]config\.json$/i,
   /[\\/]\.config[\\/]gh[\\/]hosts\.yml$/i, // GitHub CLI OAuth token
   /[\\/]\.gnupg[\\/]/i, // GPG keyring directory
+  /service[-_]account[^\\/]*\.json$/i, // GCP service-account key JSON
 ];
 
 // secret(s).{json,yml,yaml,env,txt}
@@ -101,6 +116,36 @@ export function credentialFileReason(targetPath) {
   return null;
 }
 
+/**
+ * Like credentialFileReason, but also follows a symlink to its real target and
+ * re-checks. The name-only guard is bypassable: `read_file({path:"notes.txt"})`
+ * where notes.txt → ~/.ssh/id_rsa reads the key while the guard sees only the
+ * innocent name. fs.readFileSync follows symlinks, so the guard must too —
+ * resolve the real path and re-check its basename/patterns. Falls back to the
+ * literal check when the path can't be resolved (non-existent → the read fails
+ * anyway, nothing to gate). `cwd` anchors a relative target before realpath.
+ *
+ * @param {string} targetPath
+ * @param {object} [opts] { cwd, deps }
+ * @returns {string|null}
+ */
+export function credentialFileReasonResolved(targetPath, opts = {}) {
+  const direct = credentialFileReason(targetPath);
+  if (direct) return direct;
+  const deps = opts.deps || _deps;
+  const cwd = opts.cwd || process.cwd();
+  try {
+    const real = deps.realpathSync(
+      deps.resolve(cwd, String(targetPath || ".")),
+    );
+    const viaLink = credentialFileReason(real);
+    if (viaLink) return `${viaLink} (via symlink)`;
+  } catch {
+    // Unresolvable / non-existent — the read itself would fail; nothing to gate.
+  }
+  return null;
+}
+
 // ── secret ENV-VAR + command detection ──────────────────────────────────────
 
 // Content-reader commands: when one of these is aimed at a credential file, the

package/src/lib/git-integration.js

@@ -2,7 +2,7 @@
  * Git integration — wraps system git commands for knowledge base versioning.
  */
 
-import { execSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
 import { existsSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
 
@@ -41,6 +41,62 @@ export function assertSafeGitRef(ref, label = "git ref") {
   }
 }
 
+/**
+ * Validate a repo-relative file path before it is interpolated into a shell git
+ * command (e.g. `diff … -- "${filePath}"`). Double-quoting does NOT neutralize
+ * `$()` / backticks / a closing `"`, so an unsanitized path from a WS frame is a
+ * shell-injection vector. Allow only ordinary path characters (no shell
+ * metacharacters), reject absolute paths, a leading `-` (flag injection), and
+ * `..` (traversal). Exported for reuse + tests.
+ *
+ * @param {string} p
+ * @param {string} [label="file path"]
+ */
+export function assertSafeGitPath(p, label = "file path") {
+  if (typeof p !== "string" || p.length === 0) {
+    throw new Error(`Invalid ${label}: expected a non-empty string`);
+  }
+  if (
+    !/^[A-Za-z0-9._/+@=, -]+$/.test(p) || // safe path chars only — no shell metachars
+    p.startsWith("-") || // no flag injection (e.g. `-- --output=…`)
+    p.startsWith("/") || // no absolute path (posix)
+    /^[A-Za-z]:/.test(p) || // no absolute path (windows drive)
+    p.includes("..") // no traversal / range tricks
+  ) {
+    throw new Error(`Unsafe ${label}: ${JSON.stringify(p)}`);
+  }
+}
+
+/**
+ * Run git with an ARGV array (no shell) — for commands that carry free-text the
+ * caller can't allowlist (a commit / merge message). spawnSync passes each arg
+ * verbatim, so `$()`, backticks, quotes, and `;` in the message are inert
+ * instead of being interpreted by a shell as they would be through `gitExec`.
+ * Throws git's stderr on failure, mirroring `gitExec`'s contract.
+ *
+ * @param {string[]} args
+ * @param {string} cwd
+ * @param {object} [opts] { input }
+ * @returns {string} trimmed stdout
+ */
+export function gitExecArgs(args, cwd, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    input: opts.input,
+  });
+  if (res.error) throw res.error;
+  if (res.status !== 0) {
+    const stderr = (res.stderr || res.stdout || "").toString().trim();
+    throw new Error(
+      stderr || `git ${args.join(" ")} failed (exit ${res.status})`,
+    );
+  }
+  return (res.stdout || "").toString().trim();
+}
+
 /**
  * Run a git command and return stdout.
  */
@@ -132,7 +188,11 @@ export function gitAutoCommit(dir, message) {
     message ||
     `auto: ${status.files.length} file(s) changed — ${new Date().toISOString().slice(0, 16)}`;
 
-  gitExec(`commit -m "${commitMsg.replace(/"/g, '\\"')}"`, dir);
+  // Free-text message → argv (no shell) so `$()` / backticks / `;` in a
+  // caller-supplied message (e.g. `cc git auto-commit --message …`) can't
+  // inject a command. The prior `-m "${msg.replace(/"/g,'\\"')}"` only escaped
+  // double quotes — same gap fixed in worktree-isolator / mergeWorktree.
+  gitExecArgs(["commit", "-m", commitMsg], dir);
 
   const hash = gitExec("rev-parse --short HEAD", dir);
 
@@ -153,12 +213,17 @@ export function gitLog(dir, limit = 10) {
   }
 
   try {
+    // Coerce `limit` to a bounded positive integer before it is interpolated
+    // into the shell string — a non-numeric value (`5; rm -rf ~`) would
+    // otherwise inject. The only in-tree caller already passes an int; this is
+    // defense-in-depth at the exported boundary.
+    const n = Math.min(10000, Math.max(1, Number.parseInt(limit, 10) || 10));
     // Subject (%s) is free text that often contains "|"; keep it LAST so a
     // pipe in the subject can't shift the date/author fields, then re-join the
     // remainder. (Field order kept as %X|%X — Windows cmd.exe expands adjacent
     // %VAR% pairs, so a control-char separator like %x1f is not portable here.)
     const output = gitExec(
-      `log --oneline --no-decorate -${limit} --format="%H|%h|%ai|%an|%s"`,
+      `log --oneline --no-decorate -${n} --format="%H|%h|%ai|%an|%s"`,
       dir,
     );
     return output

package/src/lib/goal-store.js

@@ -124,6 +124,13 @@ export function createGoal(input = {}, opts = {}) {
     throw new Error("createGoal requires an objective");
   }
   const id = input.id || newId("goal");
+  // Generated ids are always safe, but `input.id` is caller-supplied — guard it
+  // like every other op (getGoal/saveGoal/deleteGoal) so a crafted id such as
+  // `../../etc/x` can't make atomicWriteFileSync write a .json OUTSIDE the
+  // goals dir. createGoal was the one mutation missing this check.
+  if (isUnsafeGoalId(id)) {
+    throw new Error(`非法 goal id: ${String(id).slice(0, 60)}`);
+  }
   const keyResults = (input.keyResults || []).map((kr) => normalizeKr(kr));
   const goal = {
     id,
@@ -207,6 +214,10 @@ function mutate(id, fn, opts = {}) {
   // sharing the goals dir) so concurrent goal edits don't lose an update.
   // Best-effort lock (with-file-lock): on contention timeout it proceeds anyway,
   // so the CLI never hangs.
+  // Guard before deriving the lock path: an unsafe id would otherwise place the
+  // lock file at a traversal path (`<root>/../../x.json.lock`) before getGoal
+  // even runs. getGoal/saveGoal also guard, but keep the lock inside the dir.
+  if (isUnsafeGoalId(id)) throw new Error(`no such goal: ${id}`);
   const root = opts.root || defaultRoot();
   return withFileLock(goalFile(root, id), () => {
     const goal = getGoal(id, opts);

package/src/lib/hook-manager.js

@@ -285,6 +285,10 @@ export async function executeHook(hook, context = {}) {
       const output = execSync(cmd, {
         encoding: "utf-8",
         timeout: hook.timeout || 5000,
+        // execSync defaults maxBuffer to 1 MB; a hook that prints more (a
+        // linter/build dumping output) would throw ENOBUFS and be reported as a
+        // FAILURE even though it succeeded. Give hook output generous headroom.
+        maxBuffer: 16 * 1024 * 1024,
         env,
       });
       const executionTime = Date.now() - start;

package/src/lib/hook-runner.cjs

@@ -107,7 +107,17 @@ function tryParseDecision(stdout) {
  *            nonBlockingError?:boolean, error?:string }}
  */
 function runCommandHook(command, input = {}, opts = {}) {
-  const { timeout = 60000, cwd, event } = opts;
+  const { cwd, event } = opts;
+  // spawnSync is SYNCHRONOUS — it blocks the whole agent until the hook returns
+  // or its timeout fires. Node treats a 0/undefined timeout as UNLIMITED, so a
+  // missing, zero, NaN, or negative value (e.g. a malformed settings.json
+  // `timeout`) would let a hung hook freeze the agent forever. Guarantee a
+  // positive, bounded timeout regardless of the caller's value (already in ms).
+  const _rawTimeout = Number(opts.timeout);
+  const timeout =
+    Number.isFinite(_rawTimeout) && _rawTimeout > 0
+      ? Math.min(_rawTimeout, 600000)
+      : 60000;
   if (!command) {
     return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
   }

package/src/lib/interactive-planner.js

@@ -9,6 +9,7 @@
 
 import { EventEmitter } from "events";
 import { createHash } from "crypto";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /**
  * Plan session statuses
@@ -345,12 +346,12 @@ Keep plans concise (3-8 steps). Use appropriate tools for each step.`;
     ]);
 
     const content = response?.message?.content || response?.content || "";
-    const jsonMatch = content.match(/\{[\s\S]*\}/);
-    if (!jsonMatch) {
+    const jsonText = firstBalancedJson(content, "{");
+    if (!jsonText) {
       throw new Error("Failed to parse plan from LLM response");
     }
 
-    return JSON.parse(jsonMatch[0]);
+    return JSON.parse(jsonText);
   }
 
   /**

package/src/lib/jetbrains-bridge.js

@@ -0,0 +1,147 @@
+/**
+ * JetBrains / IntelliJ IDEA built-in MCP discovery (cc-side).
+ *
+ * IntelliJ IDEA 2025.2+ ships a built-in MCP server (Settings | Tools | MCP
+ * Server) exposing the IDE's own indexed operations (find usages, file-by-path,
+ * search, run configs, VCS, …). Letting the agent call those instead of reading
+ * and grepping files itself is cheaper (fewer tokens) and faster (rides the IDE
+ * index) — that is the whole point of this bridge.
+ *
+ * Unlike our own ide/pdh bridges (ide-bridge.js / pdh-bridge.js), IDEA writes NO
+ * discovery lockfile, so cc cannot scan for it. Instead the ChainlessChain
+ * JetBrains plugin — which runs INSIDE the IDE and therefore knows whether MCP
+ * is supported (IDE >= 2025.2) and enabled, and on which endpoint — injects the
+ * exact endpoint into the env of the `cc agent` it spawns:
+ *
+ *     CHAINLESSCHAIN_JETBRAINS_MCP_URL    http://127.0.0.1:<port>/<path>
+ *     CHAINLESSCHAIN_JETBRAINS_TOKEN      optional bearer token
+ *     CHAINLESSCHAIN_JETBRAINS_TRANSPORT  optional: http | https | sse (else inferred)
+ *
+ * When the IDE does NOT support MCP (older than 2025.2) or it is disabled, the
+ * plugin injects nothing -> cc connects nothing. This is the product decision:
+ * if the IDE's MCP is unsupported, do not try to connect (no port scan, no
+ * external proxy fallback). Reserved server name `idea` -> tools `mcp__idea__*`.
+ *
+ * Pure CLI, no network scan, no external dependency: a deterministic
+ * env -> MCP-config mapping, fully unit-testable. The connect path reuses the
+ * existing MCP client (Streamable-HTTP) via mcp-config.js `loadJetbrainsMcp`.
+ */
+
+/** Transports the CLI's MCP client can actually talk (see mcp-client.js). */
+const SUPPORTED_TRANSPORTS = new Set(["http", "https", "sse"]);
+
+/**
+ * Only ever connect to a loopback endpoint. IDEA's built-in server binds
+ * localhost; refusing anything else keeps an injected env var from pointing cc
+ * at an arbitrary host. `new URL(...).hostname` strips the brackets from an
+ * IPv6 literal on most Node builds but keeps them on some — accept both forms.
+ */
+function isLoopbackUrl(url) {
+  try {
+    const h = new URL(url).hostname.toLowerCase();
+    return (
+      h === "127.0.0.1" || h === "::1" || h === "[::1]" || h === "localhost"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function inferTransportFromUrl(url) {
+  if (/\/sse(\b|\/|$)/i.test(url)) return "sse";
+  if (/^https:/i.test(url)) return "https";
+  if (/^http:/i.test(url)) return "http";
+  return null;
+}
+
+/**
+ * Are we running under the ChainlessChain JetBrains plugin with IDE MCP
+ * available? True iff the plugin injected an MCP URL — which it only does when
+ * the IDE is >= 2025.2 and the MCP server is enabled. No URL = treat as
+ * unsupported and stay out of the way.
+ */
+export function isInJetbrainsContext(env = process.env) {
+  return !!(env && env.CHAINLESSCHAIN_JETBRAINS_MCP_URL);
+}
+
+/**
+ * Resolve the IDEA built-in MCP server to connect to, or null.
+ *
+ * Deterministic: the plugin-injected `CHAINLESSCHAIN_JETBRAINS_MCP_URL` (a
+ * loopback http/https/sse endpoint) is the single source of truth. A missing,
+ * non-loopback, or unsupported-transport URL yields null (don't connect).
+ *
+ * @param {object} opts  { env? }
+ * @returns {{url:string, transport:string, token:(string|null)}|null}
+ */
+export function discoverJetbrainsServer({ env = process.env } = {}) {
+  const url = env && env.CHAINLESSCHAIN_JETBRAINS_MCP_URL;
+  if (!url || !isLoopbackUrl(url)) return null;
+
+  const transport = String(
+    env.CHAINLESSCHAIN_JETBRAINS_TRANSPORT || inferTransportFromUrl(url) || "",
+  ).toLowerCase();
+  if (!SUPPORTED_TRANSPORTS.has(transport)) return null;
+
+  return {
+    url,
+    transport,
+    token:
+      typeof env.CHAINLESSCHAIN_JETBRAINS_TOKEN === "string"
+        ? env.CHAINLESSCHAIN_JETBRAINS_TOKEN
+        : null,
+  };
+}
+
+/**
+ * A discovered server -> an MCP server config row for `setupMcpFromConfig`.
+ * `longRunning` exempts it from the agent loop's per-call timeout (some IDE
+ * operations — e.g. an indexing-gated search — can take a while), matching the
+ * ide/pdh bridges.
+ */
+export function jetbrainsServerToMcpConfig(found) {
+  if (!found || !found.url) return null;
+  const headers = {};
+  if (found.token) headers.Authorization = `Bearer ${found.token}`;
+  return {
+    url: found.url,
+    transport: found.transport,
+    headers,
+    longRunning: true,
+  };
+}
+
+/**
+ * Human-readable explanation of why discovery did / didn't pick a server —
+ * backs `cc ide jetbrains`. Never surfaces the raw token.
+ */
+export function diagnoseJetbrains({ env = process.env } = {}) {
+  const rawUrl = (env && env.CHAINLESSCHAIN_JETBRAINS_MCP_URL) || null;
+  const chosen = discoverJetbrainsServer({ env });
+
+  let reason;
+  if (chosen) {
+    reason = "CHAINLESSCHAIN_JETBRAINS_MCP_URL injected by the IDE plugin";
+  } else if (!rawUrl) {
+    reason =
+      "no CHAINLESSCHAIN_JETBRAINS_MCP_URL — IDE MCP is unsupported (IDEA < " +
+      "2025.2) / disabled, or cc was not launched from the JetBrains plugin";
+  } else if (!isLoopbackUrl(rawUrl)) {
+    reason =
+      "injected URL is not a loopback (127.0.0.1/::1/localhost) endpoint";
+  } else {
+    reason = "injected URL is not a supported transport (http/https/sse)";
+  }
+
+  return {
+    supported: !!rawUrl,
+    chosen: chosen
+      ? {
+          url: chosen.url,
+          transport: chosen.transport,
+          hasToken: !!chosen.token,
+        }
+      : null,
+    reason,
+  };
+}

package/src/lib/json-schema-output.js

@@ -80,6 +80,48 @@ export function validateAgainstSchema(value, schema, path = "$") {
   return errors;
 }
 
+/**
+ * Return the first *balanced* JSON object/array substring in `text`, honoring
+ * string literals so braces inside strings don't throw off the depth count.
+ *
+ * Unlike a greedy `/\{[\s\S]*\}/` match (which spans to the LAST bracket and
+ * over-captures trailing prose or a second object — making JSON.parse throw),
+ * this stops at the first complete top-level value.
+ *
+ * @param {string} text
+ * @param {"{"|"["} [only] restrict to object- or array-openers when set
+ * @returns {string|null} the balanced substring, or null if none is found
+ */
+export function firstBalancedJson(text, only) {
+  const s = String(text || "");
+  for (let i = 0; i < s.length; i++) {
+    const open = s[i];
+    if (open !== "{" && open !== "[") continue;
+    if (only && open !== only) continue;
+    const close = open === "{" ? "}" : "]";
+    let depth = 0;
+    let inStr = false;
+    let esc = false;
+    for (let j = i; j < s.length; j++) {
+      const c = s[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === "\\") esc = true;
+        else if (c === '"') inStr = false;
+        continue;
+      }
+      if (c === '"') inStr = true;
+      else if (c === open) depth++;
+      else if (c === close) {
+        depth--;
+        if (depth === 0) return s.slice(i, j + 1);
+      }
+    }
+    // opener at i never closed — try the next opener
+  }
+  return null;
+}
+
 /** Pull a JSON payload out of an LLM reply (bare, fenced, or embedded). */
 export function extractJsonPayload(text) {
   const raw = String(text || "").trim();
@@ -87,6 +129,11 @@ export function extractJsonPayload(text) {
   tries.push(raw);
   const fence = /```(?:json)?\s*([\s\S]*?)```/i.exec(raw);
   if (fence) tries.push(fence[1].trim());
+  // Prefer a balanced run (stops at the first complete value) over the greedy
+  // first-bracket..last-bracket slice below, which over-captures on trailing
+  // prose or a second object.
+  const balanced = firstBalancedJson(raw);
+  if (balanced) tries.push(balanced);
   const firstObj = raw.indexOf("{");
   const lastObj = raw.lastIndexOf("}");
   if (firstObj !== -1 && lastObj > firstObj)

package/src/lib/jsonl-session-store.js

@@ -30,5 +30,6 @@ export {
   validateAllJsonlSessions,
   sampleMigratedSessionsValidation,
   sessionPath,
+  isUnsafeSessionId,
   appendTokenUsage,
 } from "../harness/jsonl-session-store.js";

package/src/lib/learning/reflection-engine.js

@@ -12,6 +12,7 @@
  */
 
 import { extractToolNames } from "./skill-synthesizer.js";
+import { firstBalancedJson } from "../json-schema-output.js";
 
 // ── _deps for test injection ────────────────────────
 const _deps = {
@@ -268,9 +269,9 @@ export class ReflectionEngine {
     try {
       const messages = buildReflectionPrompt(reportData);
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-improver.js

@@ -12,6 +12,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -374,9 +375,9 @@ export class SkillImprover {
     if (!this.llmChat) return null;
     try {
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-synthesizer.js

@@ -17,6 +17,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -258,9 +259,9 @@ export class SkillSynthesizer {
 
     try {
       // Try to parse JSON from response
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }