chainlesschain 0.162.123 → 0.162.125

package/src/lib/llm-pricing.js

@@ -96,9 +96,10 @@ const round = (n, dp = 6) => {
  *
  * Per provider, a user entry whose `match` equals a built-in pattern REPLACES
  * it; brand-new patterns are prepended so they win ties; unknown providers are
- * added. Malformed entries (missing match / non-numeric rate) are skipped so a
- * bad config line can't crash cost reporting. Returns a new table; never
- * mutates PRICE_TABLE or the input.
+ * added. Malformed entries (missing match / non-numeric / negative / Infinity
+ * rate) are skipped so a bad config line can't crash cost reporting or produce a
+ * negative cost that undercounts spend. Returns a new table; never mutates
+ * PRICE_TABLE or the input.
  *
  * @param {object} [overrides]
  * @param {object} [base=PRICE_TABLE]
@@ -123,8 +124,14 @@ export function mergePricing(overrides, base = PRICE_TABLE) {
           e &&
           typeof e.match === "string" &&
           e.match.trim() &&
+          // Rates must be finite AND non-negative — a negative price would
+          // produce a negative cost that undercounts spend (and could keep a
+          // CostBudget under its cap). `>= 0` also rejects NaN (NaN >= 0 is
+          // false); isFinite additionally rejects Infinity.
           Number.isFinite(Number(e.in)) &&
-          Number.isFinite(Number(e.out)),
+          Number(e.in) >= 0 &&
+          Number.isFinite(Number(e.out)) &&
+          Number(e.out) >= 0,
       )
       .map((e) => ({
         match: e.match.toLowerCase(),

package/src/lib/llm-providers.js

@@ -181,12 +181,22 @@ export class LLMProviderRegistry {
       .prepare("SELECT * FROM llm_providers WHERE custom = 1")
       .all();
     for (const row of rows) {
+      // Tolerate a corrupt `models` TEXT column: `|| "[]"` only covers null,
+      // not malformed JSON, and an unguarded throw here would abort the whole
+      // custom-provider load (and the registry constructor) over one bad row.
+      let models = [];
+      try {
+        const parsed = JSON.parse(row.models || "[]");
+        if (Array.isArray(parsed)) models = parsed;
+      } catch {
+        /* corrupt models column — fall back to no models for this provider */
+      }
       this.providers.set(row.name, {
         name: row.name,
         displayName: row.display_name,
         baseUrl: row.base_url,
         apiKeyEnv: row.api_key_env,
-        models: JSON.parse(row.models || "[]"),
+        models,
         custom: true,
         free: false,
       });

package/src/lib/mcp-oauth.js

@@ -62,6 +62,43 @@ export function randomState(bytes = 16) {
   return base64url(_deps.randomBytes(bytes));
 }
 
+/**
+ * Is `hostname` a loopback address? Plain http is tolerated only for these (a
+ * self-hosted MCP server on the dev box). Handles the bracketed IPv6 form that
+ * `new URL().hostname` yields (e.g. "[::1]") and the whole 127.0.0.0/8 range.
+ */
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || "")
+    .replace(/^\[|\]$/g, "")
+    .toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1") return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+
+/**
+ * Require an OAuth endpoint to be HTTPS (or plain http on loopback for local
+ * dev). Authorization codes, PKCE verifiers, client secrets, and bearer/refresh
+ * tokens flow through these endpoints, so a discovered (or stored) endpoint that
+ * downgrades to cleartext http on a remote host must be refused rather than
+ * leaking secrets over the wire (RFC 6749 §3.1.2.1 / RFC 8252). Returns the
+ * endpoint unchanged when allowed; throws otherwise.
+ */
+export function assertSecureEndpoint(endpoint, label = "endpoint") {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    throw new Error(`OAuth ${label} is not a valid URL: ${endpoint}`);
+  }
+  if (u.protocol === "https:") return endpoint;
+  if (u.protocol === "http:" && isLoopbackHost(u.hostname)) return endpoint;
+  throw new Error(
+    `refusing to use insecure OAuth ${label} (${endpoint}); ` +
+      `HTTPS is required for non-loopback endpoints`,
+  );
+}
+
 /** Minimal HTML-escape for values reflected into the callback page. */
 function escapeHtml(s) {
   return String(s).replace(
@@ -157,6 +194,12 @@ export async function discoverAuthMetadata(
   { resourceMetadataUrl } = {},
 ) {
   const origin = new URL(serverUrl).origin;
+  // Discovery itself carries no secrets, but its responses dictate the
+  // authorization/token endpoints — so a cleartext-remote discovery is a
+  // downgrade vector (a MITM could inject endpoints). Refuse a non-loopback
+  // http MCP URL up front (loopback http stays allowed for local dev), matching
+  // the endpoint enforcement below.
+  assertSecureEndpoint(origin, "MCP server URL");
   // 1. protected-resource metadata (RFC 9728) → authorization_servers[]
   let authServer = origin;
   try {
@@ -172,6 +215,12 @@ export async function discoverAuthMetadata(
   } catch {
     // no protected-resource doc → assume the origin is its own auth server
   }
+  // The authorization-server location can come from the REMOTE protected-
+  // resource doc, so a malicious/MITM'd doc could point discovery at a
+  // cleartext host. Refuse a non-loopback http authServer before fetching its
+  // metadata (the discovered endpoints are HTTPS-checked too, but this fails
+  // closed earlier and blocks the downgrade).
+  assertSecureEndpoint(authServer, "authorization server");
   // 2. authorization-server metadata (RFC 8414)
   const candidates = [
     `${authServer}/.well-known/oauth-authorization-server`,
@@ -209,6 +258,7 @@ export async function registerClient(
       "server has no registration_endpoint and no --client-id was given",
     );
   }
+  assertSecureEndpoint(metadata.registration_endpoint, "registration_endpoint");
   const reg = await fetchJson(metadata.registration_endpoint, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -230,6 +280,10 @@ export function buildAuthorizeUrl(
   metadata,
   { clientId, redirectUri, scope, codeChallenge, state, resource },
 ) {
+  assertSecureEndpoint(
+    metadata.authorization_endpoint,
+    "authorization_endpoint",
+  );
   const u = new URL(metadata.authorization_endpoint);
   u.searchParams.set("response_type", "code");
   u.searchParams.set("client_id", clientId);
@@ -261,6 +315,7 @@ export async function exchangeCodeForToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -287,6 +342,7 @@ export async function refreshAccessToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -372,26 +428,126 @@ function _writeStoreSecure(file, store) {
   }
 }
 
+/** Bounded synchronous sleep (the store lock is held only for a few file ops). */
+function _sleepSyncMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) {
+      /* spin — Atomics.wait unavailable (should not happen on modern Node) */
+    }
+  }
+}
+
+/**
+ * Run `fn` while holding a cross-process advisory lock on the token store.
+ *
+ * saveStoredToken / deleteStoredToken are read-modify-write (load → mutate →
+ * write). Two concurrent `cc mcp login` PROCESSES for different servers would
+ * each load the old store and the second writer would clobber the first's new
+ * entry (lost update) — the atomic temp+rename only prevents a torn file, not a
+ * lost update. An O_EXCL lockfile makes the whole RMW mutually exclusive across
+ * processes, so each writer re-reads the latest store inside the lock.
+ *
+ * Robustness: a stale lock (holder crashed) older than STALE_MS is stolen; if
+ * the lock can't be acquired within MAX_WAIT_MS we proceed anyway (degrading to
+ * the pre-lock last-writer-wins rather than failing the login). When the
+ * injected fs lacks the lock primitives (test fs / exotic fs) we run `fn`
+ * directly — single-process correctness is unchanged, only cross-process mutual
+ * exclusion is lost. Lock timing uses the wall clock (not the `now` test seam).
+ */
+function withStoreLock(file, fn) {
+  const fs = _deps.fs;
+  if (
+    typeof fs.openSync !== "function" ||
+    typeof fs.closeSync !== "function" ||
+    typeof fs.unlinkSync !== "function"
+  ) {
+    return fn(); // no lock primitives → run unlocked (back-compat)
+  }
+  const STALE_MS = 10_000;
+  const MAX_WAIT_MS = 5_000;
+  const lockPath = `${file}.lock`;
+  try {
+    fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
+  } catch {
+    /* dir may already exist — openSync below reports any real problem */
+  }
+  const start = Date.now();
+  let fd = null;
+  for (;;) {
+    try {
+      fd = fs.openSync(lockPath, "wx"); // O_CREAT|O_EXCL — fails if held
+      break;
+    } catch (err) {
+      if (!err || err.code !== "EEXIST") {
+        // Unexpected (e.g. ENOENT/EACCES): don't fail the login over the lock —
+        // proceed unlocked, same as a missing-primitives fs.
+        return fn();
+      }
+      let stale = false;
+      try {
+        const st = fs.statSync(lockPath);
+        const mtime = st.mtimeMs != null ? st.mtimeMs : 0;
+        stale = Date.now() - mtime > STALE_MS;
+      } catch {
+        /* lock vanished between open and stat → retry immediately */
+      }
+      if (stale) {
+        try {
+          fs.unlinkSync(lockPath); // steal a lock from a crashed holder
+        } catch {
+          /* someone else stole it first — retry */
+        }
+        continue;
+      }
+      if (Date.now() - start > MAX_WAIT_MS) break; // give up waiting; proceed
+      _sleepSyncMs(50);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        /* ignore */
+      }
+      try {
+        fs.unlinkSync(lockPath);
+      } catch {
+        /* ignore — a stale-steal by another process may have removed it */
+      }
+    }
+  }
+}
+
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
-  _writeStoreSecure(file, store);
-  return store[serverKey(serverUrl)];
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    _writeStoreSecure(file, store);
+    return store[serverKey(serverUrl)];
+  });
 }
 
 export function deleteStoredToken(serverUrl) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  const key = serverKey(serverUrl);
-  if (!(key in store)) return false;
-  delete store[key];
-  try {
-    _writeStoreSecure(file, store);
-  } catch {
-    /* best-effort */
-  }
-  return true;
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const key = serverKey(serverUrl);
+    if (!(key in store)) return false;
+    delete store[key];
+    try {
+      _writeStoreSecure(file, store);
+    } catch {
+      /* best-effort */
+    }
+    return true;
+  });
 }
 
 /** True when a record's access token is missing or within `skewMs` of expiry. */
@@ -440,12 +596,25 @@ function defaultOpenBrowser(url) {
   }
 }
 
-/** Wait for the OAuth redirect on a localhost callback server; resolve {code,state}. */
+/**
+ * Wait for the OAuth redirect on a localhost callback server; resolve
+ * {code,state}.
+ *
+ * When `expectedState` is given, a SUCCESS callback (`code`) is only accepted if
+ * its `state` matches: the callback port is fixed and guessable, so a duplicate
+ * browser request, a probe, or a drive-by request from a malicious local page
+ * must not abort the real login or inject a forged code — those are answered
+ * politely but the server keeps waiting for the genuine redirect (until the
+ * backstop timeout). A provider `error` is always terminal (so denying consent
+ * fails fast even if the provider omits state on error). With no `expectedState`
+ * the legacy contract is preserved (first `/callback` hit is terminal).
+ */
 export function waitForCallback({
   port,
   host = "127.0.0.1",
   path = "/callback",
   timeout = 300_000,
+  expectedState = null,
 }) {
   return new Promise((resolve, reject) => {
     const server = _deps.createServer((req, res) => {
@@ -465,13 +634,41 @@ export function waitForCallback({
       const code = u.searchParams.get("code");
       const state = u.searchParams.get("state");
       const error = u.searchParams.get("error");
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(renderCallbackPage(error));
+
+      // Provider error (e.g. user denied) — always terminal so we fail fast.
+      if (error) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(error));
+        server.close();
+        clearTimeout(timer);
+        reject(new Error(`authorization error: ${error}`));
+        return;
+      }
+
+      const stateOk = expectedState == null || state === expectedState;
+      if (code && stateOk) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(null));
+        server.close();
+        clearTimeout(timer);
+        resolve({ code, state });
+        return;
+      }
+
+      // A mismatched/forged/duplicate request to our fixed port must not abort
+      // the real login — answer it but keep listening for the genuine redirect.
+      if (expectedState != null) {
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage("state mismatch"));
+        return;
+      }
+
+      // Legacy contract (no expectedState): a /callback hit with no code ends it.
+      res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      res.end(renderCallbackPage("missing code"));
       server.close();
       clearTimeout(timer);
-      if (error) reject(new Error(`authorization error: ${error}`));
-      else if (!code) reject(new Error("no authorization code in callback"));
-      else resolve({ code, state });
+      reject(new Error("no authorization code in callback"));
     });
     const timer = setTimeout(() => {
       server.close();
@@ -540,6 +737,9 @@ export async function authorizeInteractive(serverUrl, opts = {}) {
     host,
     path: redirectPath,
     timeout,
+    // Ignore callbacks that don't carry the state we issued (forged / drive-by /
+    // duplicate hits to the fixed localhost port) instead of aborting the login.
+    expectedState: state,
   });
   const opened = _deps.openBrowser(authorizeUrl);
   writeOut(

package/src/lib/mcp-serve.js

@@ -17,7 +17,7 @@
 import http from "http";
 import fsDefault from "fs";
 import pathDefault from "path";
-import { randomBytes } from "crypto";
+import { randomBytes, timingSafeEqual } from "crypto";
 
 export const MAX_READ_BYTES = 200 * 1024;
 export const MAX_LIST_ENTRIES = 500;
@@ -29,14 +29,65 @@ export const _deps = { fs: fsDefault, path: pathDefault };
 
 /** Resolve `rel` inside `root`; throws on escape (.. traversal, abs paths out). */
 export function confine(root, rel, deps = _deps) {
-  const abs = deps.path.resolve(root, rel || ".");
-  const normRoot = deps.path.resolve(root);
-  if (abs !== normRoot && !abs.startsWith(normRoot + deps.path.sep)) {
+  const { path } = deps;
+  const fs = deps.fs;
+  const normRoot = path.resolve(root);
+  const abs = path.resolve(normRoot, rel || ".");
+  // Fast string guard: blocks `..` traversal and absolute-path escapes.
+  if (abs !== normRoot && !abs.startsWith(normRoot + path.sep)) {
     throw new Error(`path escapes serve root: ${rel}`);
   }
+  // Symlink guard: path.resolve does NOT follow symlinks, so a symlink INSIDE
+  // root pointing OUTSIDE would pass the string check yet the fs op (read/write/
+  // list) would escape the serve boundary — e.g. reading ~/.ssh through a
+  // workspace symlink, defeating a `--read-only` exposure. Resolve the real path
+  // of the deepest EXISTING ancestor (a not-yet-created file can't be a symlink)
+  // and re-check containment against the real root.
+  if (fs && typeof fs.realpathSync === "function") {
+    let realRoot;
+    try {
+      realRoot = fs.realpathSync(normRoot);
+    } catch {
+      return abs; // root itself unresolvable → the string guard is all we have
+    }
+    let probe = abs;
+    for (;;) {
+      let real;
+      try {
+        real = fs.realpathSync(probe);
+      } catch {
+        const parent = path.dirname(probe);
+        if (parent === probe) break; // reached fs root, nothing existed
+        probe = parent;
+        continue;
+      }
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
+        throw new Error(`path escapes serve root (symlink): ${rel}`);
+      }
+      break;
+    }
+  }
   return abs;
 }
 
+/**
+ * Constant-time check of an `Authorization: Bearer <token>` header against the
+ * expected token. A plain `!==` leaks timing that could let a caller recover the
+ * token byte-by-byte; hash-length differs are rejected up front (the token is a
+ * fixed-length random value, so its length is not secret), then `timingSafeEqual`
+ * compares the bytes. Mirrors the ws-server's token check.
+ */
+export function bearerMatches(authHeader, token) {
+  const prefix = "Bearer ";
+  if (typeof authHeader !== "string" || !authHeader.startsWith(prefix)) {
+    return false;
+  }
+  const a = Buffer.from(authHeader.slice(prefix.length), "utf-8");
+  const b = Buffer.from(String(token), "utf-8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 function ok(text) {
   return { content: [{ type: "text", text: String(text) }] };
 }
@@ -57,6 +108,35 @@ export function buildTools({ root, readOnly = false, deps = _deps }) {
       },
       handler: ({ path: rel }) => {
         const abs = confine(root, rel, deps);
+        // Bounded read: pull at most MAX_READ_BYTES+1 bytes into memory. The
+        // old `readFileSync(abs)` loaded the WHOLE file before truncating, so
+        // MAX_READ_BYTES only capped the RESPONSE — a multi-GB file under the
+        // serve root would OOM the process. The +1 byte detects "longer than
+        // the cap" without reading the rest. Fall back to readFileSync only
+        // when the fd API isn't available on an injected fs.
+        if (typeof fs.openSync === "function") {
+          const fd = fs.openSync(abs, "r");
+          try {
+            const buf = Buffer.alloc(MAX_READ_BYTES + 1);
+            const n = fs.readSync(fd, buf, 0, MAX_READ_BYTES + 1, 0);
+            const truncated = n > MAX_READ_BYTES;
+            const text = buf
+              .slice(0, truncated ? MAX_READ_BYTES : n)
+              .toString("utf-8");
+            if (!truncated) return ok(text);
+            let total = null;
+            try {
+              total = fs.statSync(abs).size;
+            } catch {
+              /* size is best-effort for the message */
+            }
+            return ok(
+              `${text}\n… [truncated${total != null ? ` ${total} bytes` : ""}]`,
+            );
+          } finally {
+            fs.closeSync(fd);
+          }
+        }
         const buf = fs.readFileSync(abs);
         const truncated = buf.length > MAX_READ_BYTES;
         const text = (truncated ? buf.slice(0, MAX_READ_BYTES) : buf).toString(
@@ -194,8 +274,7 @@ export function startMcpServe(opts = {}) {
       return send(405, rpcError(null, -32600, "POST only"));
     }
     if (token) {
-      const auth = req.headers.authorization || "";
-      if (auth !== `Bearer ${token}`) {
+      if (!bearerMatches(req.headers.authorization, token)) {
         return send(401, rpcError(null, -32001, "unauthorized"));
       }
     }

package/src/lib/orchestrator.js

@@ -27,6 +27,7 @@ import crypto from "crypto";
 import { AgentRouter } from "./agent-router.js";
 import { NotificationManager } from "./notifiers/index.js";
 import { createChatFn } from "./cowork-adapter.js";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /* ---------- _deps injection (Vitest CJS mock pattern) ---------- */
 export const _deps = { execSync };
@@ -81,6 +82,16 @@ export class Orchestrator extends EventEmitter {
     this.ciCommand = options.ciCommand || "npm test";
     this.verbose = options.verbose || false;
 
+    // Cap retained task history. Every addTask stores a record in _tasks and
+    // nothing ever removes it, so a long-running orchestrator (cron-watch /
+    // daemon) accumulates tasks without bound. Prune the oldest TERMINAL tasks
+    // beyond this cap (in-flight tasks are never dropped). Generous default;
+    // 0/invalid → 500.
+    this.maxTasks =
+      Number.isFinite(options.maxTasks) && options.maxTasks > 0
+        ? options.maxTasks
+        : 500;
+
     /** @type {Map<string, object>} taskId → task */
     this._tasks = new Map();
 
@@ -150,6 +161,7 @@ export class Orchestrator extends EventEmitter {
     };
 
     this._tasks.set(task.id, task);
+    this._pruneTasks();
     this.emit("task:added", task);
 
     if (this.notifier.isConfigured && task.notify) {
@@ -182,7 +194,7 @@ export class Orchestrator extends EventEmitter {
     return {
       tasks,
       pool: this._router.summary(),
-      cliCommand: this.cliCommand,
+      ciCommand: this.ciCommand,
       cronActive: this._cronTimer !== null,
     };
   }
@@ -277,7 +289,7 @@ export class Orchestrator extends EventEmitter {
   async _dispatch(task) {
     this.emit("agents:dispatched", { task, count: task.subtasks.length });
     this._log(
-      `Dispatching ${task.subtasks.length} subtask(s) to ${this.cliCommand} agents`,
+      `Dispatching ${task.subtasks.length} subtask(s) to ${this._router.summary().length} agent backend(s)`,
     );
 
     const results = await this._router.dispatch(task.subtasks, {
@@ -371,6 +383,11 @@ export class Orchestrator extends EventEmitter {
         cwd,
         encoding: "utf-8",
         timeout: 180_000,
+        // execSync defaults maxBuffer to 1 MB; a verbose-but-PASSING test run
+        // that prints more than that throws ENOBUFS, which the catch below
+        // would misreport as a CI failure (triggering needless retries +
+        // re-dispatch). Give CI output generous headroom.
+        maxBuffer: 64 * 1024 * 1024,
         stdio: "pipe",
       });
       return {
@@ -386,6 +403,26 @@ export class Orchestrator extends EventEmitter {
     }
   }
 
+  /**
+   * Bound retained task history to maxTasks. Evicts the oldest TERMINAL tasks
+   * first (Map preserves insertion order = FIFO); an in-flight task is never
+   * dropped, so a burst of concurrent runs can briefly exceed the cap rather
+   * than losing live work. The dropped records are completed/failed history
+   * the caller has already seen via task:complete / task:failed events.
+   */
+  _pruneTasks() {
+    if (this._tasks.size <= this.maxTasks) return;
+    for (const [id, t] of this._tasks) {
+      if (this._tasks.size <= this.maxTasks) break;
+      if (
+        t.status === TASK_STATUS.COMPLETED ||
+        t.status === TASK_STATUS.FAILED
+      ) {
+        this._tasks.delete(id);
+      }
+    }
+  }
+
   async _cronTick() {
     this.emit("cron:tick", { at: new Date().toISOString() });
     // Override this method or listen to the event to add input source polling
@@ -403,8 +440,9 @@ export class Orchestrator extends EventEmitter {
 
 /** Extract the first JSON array from an LLM response string. */
 function _extractJson(text) {
-  const match = text.match(/\[[\s\S]*\]/);
-  return match ? match[0] : "[]";
+  // Balanced extraction stops at the first complete array, so trailing prose
+  // (or a second array) no longer over-captures into an unparseable string.
+  return firstBalancedJson(text, "[") || "[]";
 }
 
 /** Parse error lines from CI output (test failures, lint errors). */

package/src/lib/process-manager.js

@@ -58,6 +58,17 @@ export function startApp(options = {}) {
   return child.pid;
 }
 
+/**
+ * Parse a PID-file's contents into a valid positive integer, or null.
+ * A corrupt / empty / partially-written file must not yield NaN — that NaN
+ * would otherwise flow into `taskkill /PID NaN` or `process.kill(NaN, …)`,
+ * which silently fails to act on the real process.
+ */
+export function parsePid(content) {
+  const pid = parseInt(String(content).trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
 export function stopApp() {
   const pidFile = getPidFilePath();
 
@@ -66,7 +77,16 @@ export function stopApp() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    logger.warn("PID file is empty or corrupt; removing it.");
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     if (isWindows()) {
@@ -90,7 +110,15 @@ export function isAppRunning() {
     return false;
   }
 
-  const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  const pid = parsePid(readFileSync(pidFile, "utf-8"));
+  if (pid === null) {
+    try {
+      unlinkSync(pidFile);
+    } catch {
+      /* best-effort */
+    }
+    return false;
+  }
 
   try {
     process.kill(pid, 0);
@@ -104,7 +132,7 @@ export function isAppRunning() {
 export function getAppPid() {
   const pidFile = getPidFilePath();
   if (!existsSync(pidFile)) return null;
-  return parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+  return parsePid(readFileSync(pidFile, "utf-8"));
 }
 
 function findExecutable(binDir, extension) {