chainlesschain 0.162.148 → 0.162.150

package/src/lib/sandbox-egress-proxy.js

@@ -0,0 +1,262 @@
+/**
+ * Sandbox egress-filtering proxy (Phase 1 enforcement).
+ *
+ * The domain policy in `sandbox-network-policy.js` DECIDES whether a host is
+ * reachable; this turns that decision into ENFORCEMENT against real
+ * subprocesses. A local forward proxy consults `evaluateNetworkAccess` for
+ * every request (plain HTTP) and CONNECT tunnel (HTTPS) and refuses the blocked
+ * ones. Point a sandboxed process's `HTTP_PROXY`/`HTTPS_PROXY` at it and its
+ * `curl`/`npm`/`pip`/`git`/`wget`/`fetch` traffic is filtered.
+ *
+ * This is a proxy-level control, not a kernel one: a tool that deliberately
+ * ignores proxy env can still open a raw socket, so a hard guarantee also needs
+ * OS network isolation (Docker `--network`, bwrap netns). But it is fully
+ * cross-platform (works on Windows, no root) and closes the common egress path
+ * that the domain allow/deny list is actually about.
+ */
+
+import http from "node:http";
+import net from "node:net";
+import dns from "node:dns";
+import {
+  evaluateNetworkAccess,
+  isPrivateHost,
+} from "./sandbox-network-policy.js";
+
+/** Promisified `dns.lookup` returning ALL resolved addresses. */
+function defaultLookup(host) {
+  return new Promise((resolve, reject) => {
+    dns.lookup(host, { all: true }, (err, addrs) =>
+      err ? reject(err) : resolve(addrs),
+    );
+  });
+}
+
+/**
+ * DNS-rebinding / SSRF-by-resolution guard. The domain policy is decided by
+ * NAME, but a public-looking name can RESOLVE to a private / metadata IP
+ * (`rebind.evil.com → 127.0.0.1` / `169.254.169.254`) and the name check would
+ * never see it — a classic rebinding bypass (Phase 1 acceptance "DNS 重绑定有
+ * 安全测试"). After a wildcard/permissive allow, resolve the host and reject if
+ * ANY address is private (unless `allowPrivate`). Fail CLOSED on an unresolvable
+ * host. On success, pin the connection to the exact validated address so a
+ * second resolution at connect time can't rebind to a different (private) IP.
+ * A `specific` allow (exact/subdomain name the user vetted) is exempt — the
+ * caller skips this — so intentional internal-name allowlisting still works.
+ * @returns {Promise<{ok:boolean, ip?:string, reason?:string}>}
+ */
+async function guardResolvedTarget(host, policy, lookup) {
+  let addrs;
+  try {
+    addrs = await lookup(host);
+  } catch (e) {
+    return {
+      ok: false,
+      reason: `unresolvable host (fail-closed): ${e.code || e.message}`,
+    };
+  }
+  const list = Array.isArray(addrs) ? addrs : addrs ? [addrs] : [];
+  if (list.length === 0) {
+    return { ok: false, reason: "host resolved to no addresses (fail-closed)" };
+  }
+  for (const a of list) {
+    const ip = typeof a === "string" ? a : a && a.address;
+    if (ip && isPrivateHost(ip) && !policy.allowPrivate) {
+      return {
+        ok: false,
+        reason: `dns-rebinding: ${host} resolves to private ${ip}`,
+      };
+    }
+  }
+  const first = list[0];
+  return { ok: true, ip: typeof first === "string" ? first : first.address };
+}
+
+/**
+ * Build the proxy env vars a child process needs to route through the proxy.
+ * `NO_PROXY` is intentionally empty so nothing bypasses the filter.
+ * @param {number} port
+ * @param {string} host  address the CHILD uses to reach the proxy (for a Docker
+ *                       container this is `host.docker.internal`, not localhost)
+ */
+export function proxyEnv(port, host = "127.0.0.1") {
+  const url = `http://${host}:${port}`;
+  return {
+    HTTP_PROXY: url,
+    HTTPS_PROXY: url,
+    ALL_PROXY: url,
+    http_proxy: url,
+    https_proxy: url,
+    all_proxy: url,
+    NO_PROXY: "",
+    no_proxy: "",
+  };
+}
+
+/**
+ * Create (but do not yet listen on) an egress-filtering proxy for a policy.
+ * @param {object} policy  { allowedDomains?, deniedDomains?, allowPrivate? }
+ * @param {object} [opts]  { onDecision?(info), bindHost? }
+ * @returns {{ listen():Promise<{port,env,server}>, close():Promise<void>,
+ *             server:import('http').Server, blocked:number, allowed:number }}
+ */
+export function createEgressProxy(policy = {}, opts = {}) {
+  const bindHost = opts.bindHost || "127.0.0.1";
+  const state = { blocked: 0, allowed: 0 };
+  const decide = (target, kind) => {
+    const verdict = evaluateNetworkAccess(target, policy);
+    if (verdict.allowed) state.allowed += 1;
+    else state.blocked += 1;
+    if (typeof opts.onDecision === "function") {
+      try {
+        opts.onDecision({ kind, target, ...verdict });
+      } catch {
+        /* observation is best-effort */
+      }
+    }
+    return verdict;
+  };
+
+  const lookup = opts.lookup || defaultLookup;
+  const rebindGuard = opts.checkDnsRebinding !== false; // on by default
+
+  // Second gate: after a NAME-based allow, re-check the RESOLVED address for
+  // DNS rebinding (unless the allow was `specific` — a name the user vetted —
+  // or the guard is disabled). Returns the verdict to ACT on plus `ip`, the
+  // exact address to pin the connection to (null → connect by the original
+  // name). When the resolved IP is private the name-based allow is overturned:
+  // fix the counters and re-notify observers with the block reason.
+  const guard = async (verdict, kind) => {
+    if (!verdict.allowed || verdict.specific || !rebindGuard) {
+      return { verdict, ip: null };
+    }
+    const res = await guardResolvedTarget(verdict.host, policy, lookup);
+    if (res.ok) return { verdict, ip: res.ip };
+    state.allowed -= 1;
+    state.blocked += 1;
+    const blocked = { allowed: false, host: verdict.host, reason: res.reason };
+    if (typeof opts.onDecision === "function") {
+      try {
+        opts.onDecision({ kind, target: verdict.host, ...blocked });
+      } catch {
+        /* observation is best-effort */
+      }
+    }
+    return { verdict: blocked, ip: null };
+  };
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      // A forward-proxy request carries the absolute URL in the request line.
+      const { verdict, ip } = await guard(decide(req.url, "http"), "http");
+      if (!verdict.allowed) {
+        res.writeHead(403, { "content-type": "text/plain" });
+        res.end(`egress blocked: ${verdict.host} — ${verdict.reason}\n`);
+        return;
+      }
+      let u;
+      try {
+        u = new URL(req.url);
+      } catch {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("bad request target\n");
+        return;
+      }
+      const upstream = http.request(
+        {
+          hostname: ip || u.hostname, // pin to the validated IP when re-checked
+          port: u.port || 80,
+          path: `${u.pathname}${u.search}`,
+          method: req.method,
+          headers: req.headers, // preserves the original Host header
+        },
+        (upRes) => {
+          res.writeHead(upRes.statusCode || 502, upRes.headers);
+          upRes.pipe(res);
+        },
+      );
+      upstream.on("error", () => {
+        if (!res.headersSent)
+          res.writeHead(502, { "content-type": "text/plain" });
+        res.end("upstream error\n");
+      });
+      req.pipe(upstream);
+    } catch {
+      if (!res.headersSent)
+        res.writeHead(502, { "content-type": "text/plain" });
+      res.end("proxy error\n");
+    }
+  });
+
+  // HTTPS (and any TLS) goes through CONNECT — tunnel only allowed hosts.
+  server.on("connect", async (req, clientSocket, head) => {
+    try {
+      const { verdict, ip } = await guard(
+        decide(req.url, "connect"),
+        "connect",
+      ); // req.url = "host:port"
+      if (!verdict.allowed) {
+        clientSocket.write(
+          "HTTP/1.1 403 Forbidden\r\n" +
+            "Content-Type: text/plain\r\n\r\n" +
+            `egress blocked: ${verdict.host} — ${verdict.reason}\n`,
+        );
+        clientSocket.end();
+        return;
+      }
+      const [host, portStr] = req.url.split(":");
+      const port = parseInt(portStr, 10) || 443;
+      // Connect to the pinned validated IP so a rebind at connect time can't
+      // swap in a private address between our check and the socket.
+      const upstream = net.connect(port, ip || host, () => {
+        clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head && head.length) upstream.write(head);
+        upstream.pipe(clientSocket);
+        clientSocket.pipe(upstream);
+      });
+      upstream.on("error", () => {
+        try {
+          clientSocket.end();
+        } catch {
+          /* already closed */
+        }
+      });
+      clientSocket.on("error", () => {
+        try {
+          upstream.destroy();
+        } catch {
+          /* already gone */
+        }
+      });
+    } catch {
+      try {
+        clientSocket.end();
+      } catch {
+        /* already closed */
+      }
+    }
+  });
+
+  return {
+    server,
+    get blocked() {
+      return state.blocked;
+    },
+    get allowed() {
+      return state.allowed;
+    },
+    listen() {
+      return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, bindHost, () => {
+          server.removeListener("error", reject);
+          const port = server.address().port;
+          resolve({ port, env: proxyEnv(port), server });
+        });
+      });
+    },
+    close() {
+      return new Promise((resolve) => server.close(() => resolve()));
+    },
+  };
+}

package/src/lib/sandbox-fs-policy.js

@@ -0,0 +1,112 @@
+/**
+ * Sandbox filesystem path policy (Phase 1) — decide whether a Shell subprocess
+ * (or the agent's own file tools) may read/write a given path under
+ * `sandbox.filesystem.{allowRead,denyRead,allowWrite,denyWrite}` (here the
+ * legacy `{read, write, denied}` shape). OS-level ENFORCEMENT is platform
+ * specific (bubblewrap `--bind`/`--ro-bind`/`--tmpfs`, seatbelt), but the POLICY
+ * DECISION is pure, shared, and must get the tricky cases right — the twin of
+ * `sandbox-network-policy.js`. The prior check used raw `filePath.startsWith()`,
+ * which let three attacks through:
+ *
+ *   - PATH TRAVERSAL: `/tmp/../etc/passwd` starts with an allowed `/tmp` but
+ *     resolves OUTSIDE it. We `path.resolve` first so `..` is collapsed.
+ *   - BOUNDARY CONFUSION: `/tmpfoo` starts with `/tmp` yet is a different tree.
+ *     We compare with `path.relative` (a real path boundary), not a substring.
+ *   - SYMLINK ESCAPE: an allowed dir containing a symlink to `/etc` would read
+ *     `/etc`. We resolve symlinks (of the longest existing ancestor) before the
+ *     boundary check, and resolve the policy roots the same way so they stay
+ *     comparable.
+ *
+ * Default-DENY: a path must match an allow root for the requested mode and must
+ * not fall under any deny root. This mirrors the previous behaviour (an empty
+ * allow list denied everything) while fixing the bypasses.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+/** Real path of `abs`, resolving symlinks of the LONGEST EXISTING ancestor and
+ * re-appending the non-existent tail — so a symlinked existing parent is caught
+ * even when the leaf (e.g. a not-yet-created write target) does not exist. */
+function resolveReal(abs, realpath) {
+  let cur = abs;
+  const tail = [];
+  // Bounded by the path depth; each iteration strips one segment.
+  for (;;) {
+    try {
+      const real = realpath(cur);
+      return tail.length ? path.join(real, ...tail.reverse()) : real;
+    } catch {
+      const parent = path.dirname(cur);
+      if (parent === cur) return abs; // hit the root, nothing on this path exists
+      tail.push(path.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+/** Is `target` the same as, or nested inside, `root`? Uses a real path boundary
+ * (via `path.relative`) so `/tmpfoo` is NOT inside `/tmp` and `..` can't sneak
+ * out. Cross-platform (handles Windows drive letters + separators). */
+export function isWithinRoot(root, target) {
+  if (!root) return false;
+  const rel = path.relative(root, target);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function normalizeRoot(root, cwd, realpath) {
+  return resolveReal(path.resolve(cwd, String(root)), realpath);
+}
+
+/**
+ * Evaluate filesystem access for a target path under a policy.
+ *
+ * @param {string} target  a path (relative resolves against `cwd`)
+ * @param {object} opts
+ * @param {"read"|"write"} [opts.mode="read"]
+ * @param {{read?:string[], write?:string[], denied?:string[]}} [opts.policy]
+ * @param {string} [opts.cwd]        base for relative targets/roots
+ * @param {(p:string)=>string} [opts.realpath]  injectable for tests
+ * @returns {{allowed:boolean, path:string|null, reason:string}}
+ */
+export function evaluatePathAccess(target, opts = {}) {
+  const {
+    mode = "read",
+    policy = {},
+    cwd = process.cwd(),
+    realpath = fs.realpathSync,
+  } = opts;
+
+  if (target == null || String(target).trim() === "") {
+    return { allowed: false, path: null, reason: "empty path" };
+  }
+  if (mode !== "read" && mode !== "write") {
+    return { allowed: false, path: null, reason: `unknown mode "${mode}"` };
+  }
+
+  const abs = path.resolve(cwd, String(target)); // collapses `..`
+  const real = resolveReal(abs, realpath); // resolves symlink escapes
+
+  const denied = policy.denied || [];
+  for (const d of denied) {
+    if (isWithinRoot(normalizeRoot(d, cwd, realpath), real)) {
+      return { allowed: false, path: real, reason: `denied by ${d}` };
+    }
+  }
+
+  const allowList = (mode === "read" ? policy.read : policy.write) || [];
+  for (const a of allowList) {
+    if (isWithinRoot(normalizeRoot(a, cwd, realpath), real)) {
+      return { allowed: true, path: real, reason: `within ${a}` };
+    }
+  }
+
+  // Default-deny: not under any allowed root for this mode.
+  return {
+    allowed: false,
+    path: real,
+    reason: allowList.length
+      ? `outside all allowed ${mode} roots`
+      : `no allowed ${mode} roots`,
+  };
+}

package/src/lib/sandbox-network-policy.js

@@ -0,0 +1,151 @@
+/**
+ * Sandbox network domain policy (Phase 1) — decide whether a Shell subprocess is
+ * allowed to reach a given URL/host under `sandbox.network.allowedDomains` /
+ * `deniedDomains`. OS-level ENFORCEMENT is platform-specific (a proxy / seatbelt
+ * / bwrap egress filter), but the POLICY decision is pure, shared, and must get
+ * the tricky cases right — so it lives here, fully unit-tested:
+ *
+ *   - wildcard subdomains (`*.example.com` matches `api.example.com` AND the
+ *     apex `example.com`), exact hosts, and `*` (all);
+ *   - deny takes precedence over allow;
+ *   - default-DENY when an allowlist is set and the host isn't on it
+ *     (Phase 1 acceptance "未授权域名无法通过 curl/npm/pip 访问");
+ *   - private / loopback / link-local / metadata targets are blocked unless
+ *     explicitly allowed — an SSRF / DNS-rebinding guard, and it fixes the
+ *     `new URL()` IPv6-bracket gotcha where `[::1]` leaks brackets into the
+ *     hostname and defeats a naive string check.
+ */
+
+/** Extract a normalized lowercase host from a URL or bare host:port. */
+export function extractHost(target) {
+  if (target == null) return null;
+  let s = String(target).trim();
+  if (!s) return null;
+  // Try URL parse first (covers scheme://host:port/path, userinfo, etc.).
+  try {
+    // Add a scheme if it looks scheme-less so URL() can parse host:port.
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(s) ? s : `http://${s}`;
+    const u = new URL(withScheme);
+    s = u.hostname; // may be "[::1]" for IPv6 — normalize below
+  } catch {
+    // Not a URL — treat as a bare host, strip any :port.
+    s = s.replace(/:\d+$/, "");
+  }
+  // Strip IPv6 brackets ("[::1]" → "::1") — the documented SSRF gotcha.
+  if (s.startsWith("[") && s.endsWith("]")) s = s.slice(1, -1);
+  // Strip the trailing DNS root dot. "localhost." / "example.com." resolve to
+  // the exact same host as the dot-less form, but the extra dot defeats BOTH
+  // the deny/allow matcher (host !== "example.com") AND the loopback/private
+  // guard ("localhost." !== "localhost") — a one-character SSRF / deny-list
+  // bypass. (Node's URL already normalizes a trailing dot away for IPv4 literals
+  // but NOT for named hosts, so we must do it here.)
+  s = s.replace(/\.+$/, "");
+  return s.toLowerCase() || null;
+}
+
+/** Does `host` match a domain `pattern` (`*`, `*.example.com`, or exact)? */
+export function matchesDomain(host, pattern) {
+  if (!host || !pattern) return false;
+  const p = String(pattern).trim().toLowerCase();
+  if (p === "*") return true;
+  if (p.startsWith("*.")) {
+    const base = p.slice(2);
+    // `*.example.com` matches subdomains AND the apex `example.com`.
+    return host === base || host.endsWith(`.${base}`);
+  }
+  return host === p;
+}
+
+function anyMatch(host, patterns) {
+  return (patterns || []).some((p) => matchesDomain(host, p));
+}
+
+/** Private / loopback / link-local / cloud-metadata target? (SSRF guard) */
+export function isPrivateHost(host) {
+  if (!host) return false;
+  const h = host.toLowerCase();
+  if (h === "localhost" || h.endsWith(".localhost")) return true;
+  // Cloud metadata endpoint.
+  if (h === "169.254.169.254" || h === "metadata.google.internal") return true;
+  // IPv6 loopback / unique-local / link-local.
+  if (h === "::1" || h === "::") return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true; // fc00::/7 unique-local
+  if (/^fe80:/i.test(h)) return true; // link-local
+  // IPv4-mapped IPv6 (::ffff:127.0.0.1) — check the tail.
+  const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  const ipv4 = mapped ? mapped[1] : h;
+  const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    if (a === 127) return true; // 127.0.0.0/8 loopback
+    if (a === 10) return true; // 10.0.0.0/8
+    if (a === 192 && b === 168) return true; // 192.168.0.0/16
+    if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12
+    if (a === 169 && b === 254) return true; // 169.254.0.0/16 link-local
+    if (a === 0) return true; // 0.0.0.0/8
+  }
+  return false;
+}
+
+/**
+ * Evaluate network access for a target under a policy.
+ *
+ * @param {string} target  URL or host (optionally with :port)
+ * @param {object} policy  { allowedDomains?:string[], deniedDomains?:string[],
+ *                           allowPrivate?:boolean }
+ * @returns {{ allowed:boolean, host:string|null, reason:string }}
+ */
+export function evaluateNetworkAccess(target, policy = {}) {
+  const allowed = policy.allowedDomains || [];
+  const denied = policy.deniedDomains || [];
+  const host = extractHost(target);
+  if (!host) {
+    return { allowed: false, host: null, reason: "unparseable target" };
+  }
+  // 1) Deny wins over everything.
+  if (anyMatch(host, denied)) {
+    return { allowed: false, host, reason: "denied by deniedDomains" };
+  }
+  // 2) A SPECIFIC (non-`*`) allow-list match overrides the private-host guard,
+  //    so an intentionally-allowed localhost/dev host still works. A bare `*`
+  //    does NOT — it means "all public domains", never internal/metadata.
+  const explicitNonStar = anyMatch(
+    host,
+    allowed.filter((p) => String(p).trim() !== "*"),
+  );
+  if (explicitNonStar) {
+    // `specific: true` marks a host the user vetted by exact/subdomain name (not
+    // a bare `*`). The egress proxy trusts these even when they resolve to a
+    // private IP (intentional internal/dev allowlisting) and so SKIPS the
+    // DNS-rebinding re-check for them — whereas `*`/permissive allows still get
+    // their resolved IP checked.
+    return {
+      allowed: true,
+      host,
+      reason: "matched allowedDomains",
+      specific: true,
+    };
+  }
+  // 3) Private / loopback / metadata targets are blocked unless allowed above.
+  if (isPrivateHost(host) && !policy.allowPrivate) {
+    return {
+      allowed: false,
+      host,
+      reason: "private/loopback target blocked (SSRF guard)",
+    };
+  }
+  // 4) A `*` (or any remaining) allow-list match → allow.
+  if (anyMatch(host, allowed)) {
+    return { allowed: true, host, reason: "matched allowedDomains" };
+  }
+  // 5) With an allow-list present, anything not on it is denied (default-deny).
+  if (allowed.length > 0) {
+    return {
+      allowed: false,
+      host,
+      reason: "not in allowedDomains (default-deny)",
+    };
+  }
+  // 6) No allow-list → permissive (deny-list + private guard still applied).
+  return { allowed: true, host, reason: "no allowlist (permissive)" };
+}

package/src/lib/sandbox-v2.js

@@ -5,6 +5,8 @@
 
 import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
+import { evaluateNetworkAccess } from "./sandbox-network-policy.js";
+import { evaluatePathAccess } from "./sandbox-fs-policy.js";
 import { createRequire } from "module";
 
 const _require = createRequire(import.meta.url);
@@ -141,28 +143,32 @@ export function ensureSandboxTables(db) {
 // ─── Permission checking ──────────────────────────────────────
 
 function checkFilePermission(permissions, filePath, mode) {
-  const fs = permissions.fileSystem || {};
-  const denied = fs.denied || [];
-  for (const d of denied) {
-    if (filePath.startsWith(d)) return false;
-  }
-  if (mode === "read") {
-    const allowed = fs.read || [];
-    return allowed.some((p) => filePath.startsWith(p));
-  }
-  if (mode === "write") {
-    const allowed = fs.write || [];
-    return allowed.some((p) => filePath.startsWith(p));
-  }
-  return false;
+  // Delegate to the shared path policy: `path.resolve` collapses `..` (traversal),
+  // a `path.relative` boundary rejects `/tmpfoo` matching `/tmp`, and symlinks are
+  // resolved so a link inside an allowed dir can't escape. The old check was
+  // `filePath.startsWith(root)` and let all three through.
+  const fsPol = permissions.fileSystem || {};
+  return evaluatePathAccess(filePath, {
+    mode,
+    policy: {
+      read: fsPol.read || [],
+      write: fsPol.write || [],
+      denied: fsPol.denied || [],
+    },
+  }).allowed;
 }
 
 function checkNetworkPermission(permissions, host) {
+  // Delegate to the shared domain policy: wildcard subdomains, deny-precedence,
+  // default-deny under an allowlist, URL/host normalization, and the SSRF /
+  // loopback / metadata guard (incl. the IPv6-bracket gotcha). The old check was
+  // exact-string only and let e.g. a URL or `[::1]` slip past.
   const net = permissions.network || {};
-  const denied = net.denied || [];
-  if (denied.includes(host)) return false;
-  const allowed = net.allowed || [];
-  return allowed.includes(host) || allowed.includes("*");
+  return evaluateNetworkAccess(host, {
+    allowedDomains: net.allowed || [],
+    deniedDomains: net.denied || [],
+    allowPrivate: net.allowPrivate === true,
+  }).allowed;
 }
 
 function checkSystemCallPermission(permissions, call) {

package/src/lib/scim-manager.js

@@ -211,6 +211,42 @@ export function _resetState() {
   _syncLog.length = 0;
 }
 
+/**
+ * Rehydrate the in-memory _users Map from the persisted scim_resources table.
+ * The CLI runs each `cc scim` subcommand in a fresh node process, so _users
+ * starts empty every invocation. createUser dual-writes (Map + INSERT INTO
+ * scim_resources) but listUsers/getUser/deleteUser/getStatus are Map-only and
+ * nothing SELECTed the table back — so a provisioned user was invisible next
+ * invocation (`No SCIM users.` / `User not found`), and deleteUser threw before
+ * its DELETE ran, orphaning rows with no CLI path to remove them. The duplicate
+ * check in createUser was also blind, allowing duplicate userNames on disk.
+ * Call after ensureSCIMTables(db).
+ *
+ * Mirrors the write-side shape exactly (active INTEGER→boolean).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureSCIMTables(db);
+  _users.clear();
+  for (const r of db
+    .prepare(
+      `SELECT id, display_name, user_name, email, active, created_at, updated_at
+         FROM scim_resources WHERE resource_type = 'User' ORDER BY created_at ASC`,
+    )
+    .all()) {
+    _users.set(r.id, {
+      id: r.id,
+      userName: r.user_name,
+      displayName: r.display_name || r.user_name,
+      email: r.email || null,
+      active: !!r.active,
+      createdAt: r.created_at,
+      updatedAt: r.updated_at,
+    });
+  }
+  return _users.size;
+}
+
 /* ═══════════════════════════════════════════════════════════════
  * V2 Surface — SCIM provisioning lifecycle layer.
  * Tracks identities and sync-job lifecycle independent of legacy

package/src/lib/session-manager.js

@@ -129,10 +129,13 @@ export function getSession(db, sessionId) {
 
   return {
     ...session,
-    messages: JSON.parse(session.messages || "[]"),
+    // A single corrupt (non-JSON, non-empty) column must not make the whole
+    // session unloadable — that would block resume of the user's own data.
+    // Matches the safeJsonParse fallback listSessions already uses.
+    messages: safeJsonParse(session.messages, []),
     metadata:
       typeof session.metadata === "string"
-        ? JSON.parse(session.metadata || "{}")
+        ? safeJsonParse(session.metadata, {})
         : session.metadata || {},
   };
 }