chainlesschain 0.162.94 → 0.162.96

package/src/commands/pdh.js

@@ -0,0 +1,162 @@
+/**
+ * `cc pdh` — inspect PDH bridge discovery (Phase 0).
+ *
+ * The agent auto-connects the Android app's "device capability" MCP server
+ * (collect / query / file / task tools) when the app spawns cc with
+ * `CHAINLESSCHAIN_PDH_PORT` set, or via a lockfile scan for external agents.
+ * These subcommands make that discovery visible and debuggable WITHOUT running
+ * an agent:
+ *
+ *   cc pdh list             list live PDH lockfiles found
+ *   cc pdh status           which server `cc agent` would connect to (+ its MCP config)
+ *   cc pdh doctor           explain WHY discovery did / didn't pick a server
+ *
+ * Pure read-only over ~/.chainlesschain/pdh-bridge/*.json — mirrors `cc ide`
+ * (module 98). See docs/design/modules/101_个人数据IDE桥接方案.md.
+ */
+import chalk from "chalk";
+import {
+  readPdhLocks,
+  discoverPdhServer,
+  pdhServerToMcpConfig,
+  isInPdhTerminal,
+  pdhLockDir,
+  diagnosePdh,
+} from "../lib/pdh-bridge.js";
+
+function emit(obj) {
+  console.log(JSON.stringify(obj, null, 2));
+}
+
+/** Strip the raw bearer token + internal _file path from a lock for output. */
+function redactLock(lock) {
+  if (!lock) return null;
+  const { token, _file, ...rest } = lock;
+  return { ...rest, hasToken: !!token };
+}
+
+export function registerPdhCommand(program) {
+  const pdh = program
+    .command("pdh")
+    .description(
+      "Inspect PDH bridge discovery (Android personal-data MCP server auto-connect)",
+    );
+
+  pdh
+    .command("list")
+    .description(
+      "List live PDH lockfiles (device capability MCP servers advertised)",
+    )
+    .option("--json", "Machine-readable output")
+    .action((options) => {
+      const locks = readPdhLocks();
+      if (options.json) {
+        // Never surface the raw bearer token or internal _file path.
+        const safe = locks.map(redactLock);
+        emit({ lockDir: pdhLockDir(), count: safe.length, locks: safe });
+        return;
+      }
+      if (!locks.length) {
+        console.log(chalk.gray(`No live PDH lockfiles in ${pdhLockDir()}`));
+        console.log(
+          chalk.gray(
+            "Start the app's PDH bridge server, or run `cc pdh doctor`.",
+          ),
+        );
+        return;
+      }
+      console.log(
+        chalk.bold(`PDH servers (${locks.length}) in ${pdhLockDir()}:`),
+      );
+      for (const l of locks) {
+        console.log(
+          `  ${chalk.cyan(l.device)}  port ${l.port}  ${l.transport}  ` +
+            `${l.token ? chalk.green("token") : chalk.yellow("no-token")}`,
+        );
+        console.log(chalk.gray(`    url ${l.url}`));
+        if (l.appUid != null) {
+          console.log(chalk.gray(`    uid ${l.appUid}`));
+        }
+      }
+    });
+
+  pdh
+    .command("status")
+    .description("Show the PDH server `cc agent` would connect to right now")
+    .option("--json", "Machine-readable output")
+    .action((options) => {
+      const env = process.env;
+      const inPdh = isInPdhTerminal(env);
+      const lock = discoverPdhServer({ env });
+      const cfg = lock ? pdhServerToMcpConfig(lock) : null;
+      // Redact the bearer token in the previewed config.
+      const safeCfg = cfg
+        ? {
+            ...cfg,
+            headers: cfg.headers?.Authorization
+              ? { ...cfg.headers, Authorization: "Bearer ***" }
+              : cfg.headers,
+          }
+        : null;
+      if (options.json) {
+        emit({
+          inPdhTerminal: inPdh,
+          chosen: redactLock(lock),
+          mcpConfig: safeCfg,
+        });
+        return;
+      }
+      console.log(
+        `In PDH terminal: ${inPdh ? chalk.green("yes") : chalk.gray("no")}`,
+      );
+      if (!lock) {
+        console.log(
+          chalk.gray(
+            "No PDH server would be connected. Try `cc pdh doctor` for why.",
+          ),
+        );
+        return;
+      }
+      console.log(
+        `Would connect: ${chalk.cyan(lock.device)} on port ${lock.port} ` +
+          `(${lock.transport}) as MCP server ${chalk.bold("pdh")}`,
+      );
+      console.log(chalk.gray("MCP config:"));
+      console.log(chalk.gray("  " + JSON.stringify(safeCfg)));
+    });
+
+  pdh
+    .command("doctor")
+    .description("Explain why PDH discovery did / didn't pick a server")
+    .option("--json", "Machine-readable output")
+    .action((options) => {
+      const diag = diagnosePdh({ env: process.env });
+      if (options.json) {
+        emit(diag);
+        return;
+      }
+      console.log(chalk.bold("PDH bridge discovery"));
+      console.log(`  lock dir       : ${diag.lockDir}`);
+      console.log(
+        `  in PDH terminal: ${diag.inPdhTerminal ? chalk.green("yes") : chalk.gray("no")}`,
+      );
+      console.log(`  live locks     : ${diag.locks.length}`);
+      for (const l of diag.locks) {
+        console.log(
+          `    - ${chalk.cyan(l.device)} port ${l.port} ${l.transport} ` +
+            `${l.hasToken ? "token" : chalk.yellow("no-token")}` +
+            `${l.appUid != null ? ` uid ${l.appUid}` : ""}`,
+        );
+      }
+      console.log(
+        `  result         : ${
+          diag.chosen
+            ? chalk.green(`connect ${diag.chosen.device}:${diag.chosen.port}`)
+            : chalk.yellow("nothing to connect")
+        }`,
+      );
+      console.log(`  reason         : ${diag.reason}`);
+    });
+
+  return pdh;
+}

package/src/gateways/discord/discord-formatter.js

@@ -20,7 +20,11 @@ export function formatForDiscord(response, options = {}) {
   if (!response) return "";
   const maxLength = options.maxLength || DISCORD_MAX_LENGTH;
 
-  let text = response;
+  // Defang mass-mention pings (@everyone / @here) that can appear in agent
+  // output — a zero-width space after the `@` renders identically but stops
+  // Discord parsing it as a mention. There is no allowed_mentions safety net at
+  // the send layer, so the formatter must be safe by default.
+  let text = neutralizeMassMentions(response);
 
   if (text.length > maxLength) {
     text = text.substring(0, maxLength - 3) + "...";
@@ -29,6 +33,19 @@ export function formatForDiscord(response, options = {}) {
   return text;
 }
 
+/**
+ * Insert a zero-width space into @everyone / @here so they don't ping. Exported
+ * so callers composing messages by other means can reuse it.
+ * @param {string} text
+ * @returns {string}
+ */
+export function neutralizeMassMentions(text) {
+  return String(text == null ? "" : text).replace(
+    /@(everyone|here)/g,
+    "@​$1",
+  );
+}
+
 /**
  * Split a response into Discord-sized chunks.
  * Tries to split at code block or newline boundaries.

package/src/gateways/telegram/telegram-formatter.js

@@ -47,17 +47,20 @@ export function toTelegramMarkdown(markdown) {
   // Escape special characters in text
   result = escapeMarkdownV2(result);
 
-  // Restore code blocks and inline code (unescaped)
+  // Restore code blocks and inline code (unescaped). Use a replacement FUNCTION
+  // so `$`-sequences inside the code (e.g. `$&`, `$1`, `$$` in sed/regex/shell)
+  // are inserted literally — a string replacement would interpret them as
+  // String.replace patterns and corrupt the code.
   for (let i = codeBlocks.length - 1; i >= 0; i--) {
     result = result.replace(
       `__CODE_BLOCK_${i}__`.replace(ESCAPE_CHARS, "\\$1"),
-      codeBlocks[i],
+      () => codeBlocks[i],
     );
   }
   for (let i = inlineCode.length - 1; i >= 0; i--) {
     result = result.replace(
       `__INLINE_CODE_${i}__`.replace(ESCAPE_CHARS, "\\$1"),
-      inlineCode[i],
+      () => inlineCode[i],
     );
   }
 

package/src/gateways/ws/ws-server.js

@@ -12,6 +12,7 @@
 
 import { EventEmitter } from "node:events";
 import { spawn } from "node:child_process";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { WebSocketServer } from "ws";
@@ -525,10 +526,27 @@ export class ChainlessChainWSServer extends EventEmitter {
     return handleLlmChat(this, id, ws, message);
   }
 
+  /**
+   * Constant-time check of a client-supplied token against the configured one.
+   * A plain `===` leaks timing that a network client could use to recover the
+   * token byte-by-byte; hash both to a fixed length and compare in constant
+   * time. Preserves the original semantics: no configured token matches only an
+   * absent token (the auto-authenticated path).
+   * @private
+   */
+  _tokenMatches(provided) {
+    const expected = this.token;
+    if (expected == null) return provided == null;
+    if (typeof provided !== "string") return false;
+    const a = createHash("sha256").update(provided).digest();
+    const b = createHash("sha256").update(String(expected)).digest();
+    return timingSafeEqual(a, b);
+  }
+
   /** @private */
   _handleAuth(clientId, ws, message) {
     const { id, token } = message;
-    const success = token === this.token;
+    const success = this._tokenMatches(token);
     const client = this.clients.get(clientId);
 
     if (success && client) {

package/src/harness/mcp-client.js

@@ -188,6 +188,12 @@ export class MCPClient extends EventEmitter {
       prompts: [],
       _pending: new Map(),
       _buffer: "",
+      // Per-connection streaming decoders so a multi-byte UTF-8 character (e.g.
+      // a 3-byte Chinese char) split across two stdout/stderr chunks is
+      // reassembled instead of corrupted into U+FFFD. Decoding each chunk
+      // independently (data.toString("utf8")) would mangle a split character.
+      _decoder: new TextDecoder("utf-8"),
+      _stderrDecoder: new TextDecoder("utf-8"),
     };
 
     this.servers.set(name, entry);
@@ -219,11 +225,22 @@ export class MCPClient extends EventEmitter {
         entry.process = proc;
 
         proc.stdout.on("data", (data) => {
-          this._handleData(name, data.toString("utf8"));
+          this._handleData(
+            name,
+            typeof data === "string"
+              ? data
+              : entry._decoder.decode(data, { stream: true }),
+          );
         });
 
         proc.stderr.on("data", (data) => {
-          this.emit("server-error", { name, error: data.toString("utf8") });
+          this.emit("server-error", {
+            name,
+            error:
+              typeof data === "string"
+                ? data
+                : entry._stderrDecoder.decode(data, { stream: true }),
+          });
         });
 
         // If the server process dies with requests in flight, reject them

package/src/harness/plugin-manager.js

@@ -352,10 +352,20 @@ export function installPluginSkills(db, pluginName, pluginPath, skills) {
   const installed = [];
 
   for (const skill of skills) {
+    if (!skill || typeof skill.name !== "string" || typeof skill.path !== "string") {
+      continue;
+    }
     const srcDir = path.resolve(pluginPath, skill.path);
+    // Reject manifest entries that escape the plugin (read) or the marketplace
+    // (arbitrary file WRITE) via `../` — a malicious plugin could otherwise drop
+    // files anywhere (e.g. overwrite ~/.bashrc) during install.
+    if (!_isWithin(pluginPath, srcDir)) continue;
     if (!fs.existsSync(srcDir)) continue;
 
     const destDir = path.join(marketplaceDir, skill.name);
+    if (!_isWithin(marketplaceDir, destDir) || path.resolve(destDir) === path.resolve(marketplaceDir)) {
+      continue;
+    }
     fs.mkdirSync(destDir, { recursive: true });
 
     // Copy skill files
@@ -419,6 +429,16 @@ export function getPluginSkills(db, pluginName) {
 /**
  * Recursively copy a directory
  */
+/**
+ * True when `child` resolves to `parent` or a path inside it. Used to keep a
+ * (semi-trusted) plugin manifest from escaping its sandbox via `../` in
+ * skill.path / skill.name.
+ */
+function _isWithin(parent, child) {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
 function _copyDirSync(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   const entries = fs.readdirSync(src, { withFileTypes: true });

package/src/harness/worktree-isolator.js

@@ -10,11 +10,17 @@
 import { execSync } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
-import { isGitRepo, gitExec } from "../lib/git-integration.js";
+import {
+  isGitRepo,
+  gitExec,
+  assertSafeGitRef,
+} from "../lib/git-integration.js";
 
 const WORKTREE_DIR = ".worktrees";
 
 export function createWorktree(repoDir, branchName, baseBranch) {
+  assertSafeGitRef(branchName, "branch name");
+  if (baseBranch) assertSafeGitRef(baseBranch, "base branch");
   if (!isGitRepo(repoDir)) {
     throw new Error("Not a git repository");
   }
@@ -157,6 +163,8 @@ export function cleanupAgentWorktrees(repoDir) {
 }
 
 export function diffWorktree(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const base = options.baseBranch || "HEAD";
   const filePath = options.filePath || null;
   const fileArg = filePath ? ` -- "${filePath}"` : "";
@@ -204,6 +212,8 @@ export function diffWorktree(repoDir, branchName, options = {}) {
 }
 
 export function mergeWorktree(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const strategy = options.strategy || "merge";
   const deleteBranch = options.deleteBranch !== false;
 
@@ -285,6 +295,8 @@ export function mergeWorktree(repoDir, branchName, options = {}) {
 }
 
 export function previewWorktreeMerge(repoDir, branchName, options = {}) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const strategy = options.strategy || "merge";
   const baseBranch = _resolveBaseBranchForMerge(repoDir, options.baseBranch);
   const worktree = _findWorktreeByBranch(repoDir, branchName);
@@ -374,6 +386,8 @@ export function applyWorktreeAutomationCandidate(
   branchName,
   options = {},
 ) {
+  assertSafeGitRef(branchName, "branch name");
+  if (options.baseBranch) assertSafeGitRef(options.baseBranch, "base branch");
   const filePath = options.filePath || null;
   const candidateId = options.candidateId || null;
   const conflictType = options.conflictType || null;
@@ -473,6 +487,8 @@ export function applyWorktreeAutomationCandidate(
 }
 
 export function worktreeLog(repoDir, branchName, baseBranch = "HEAD") {
+  assertSafeGitRef(branchName, "branch name");
+  assertSafeGitRef(baseBranch, "base branch");
   try {
     const output = gitExec(
       `log ${baseBranch}..${branchName} --pretty=format:"%h|%s|%ci"`,

package/src/index.js

@@ -71,6 +71,7 @@ import { registerOutputStyleCommand } from "./commands/output-style.js";
 import { registerStatuslineCommand } from "./commands/statusline.js";
 import { registerTerminalSetupCommand } from "./commands/terminal-setup.js";
 import { registerIdeCommand } from "./commands/ide.js";
+import { registerPdhCommand } from "./commands/pdh.js";
 import { registerConsolCommand } from "./commands/consol.js";
 import { registerImportCommand } from "./commands/import.js";
 import { registerExportCommand } from "./commands/export.js";
@@ -486,6 +487,7 @@ export function createProgram(opts = {}) {
   registerStatuslineCommand(program);
   registerTerminalSetupCommand(program);
   registerIdeCommand(program);
+  registerPdhCommand(program);
   registerConsolCommand(program);
 
   // Phase 2: Knowledge & content management

package/src/lib/__tests__/model-deprecation.test.js

@@ -0,0 +1,194 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  DEPRECATED_MODELS,
+  checkModelDeprecation,
+  formatModelDeprecationWarning,
+  maybeWarnDeprecatedModel,
+  _warned,
+} from "../model-deprecation.js";
+
+describe("checkModelDeprecation", () => {
+  it("flags an exact retired snapshot", () => {
+    const info = checkModelDeprecation("claude-3-opus-20240229");
+    expect(info).toBeTruthy();
+    expect(info.id).toBe("claude-3-opus-20240229");
+    expect(info.state).toBe("retired");
+    expect(info.replacement).toMatch(/claude-opus-4-8/);
+  });
+
+  it("flags retired Claude 3.5 / 3.7 families by prefix (the common ones)", () => {
+    expect(checkModelDeprecation("claude-3-5-sonnet-20240620")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-5-sonnet-20241022")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-5-haiku-20241022")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-7-sonnet-20250219")).toBeTruthy();
+    expect(checkModelDeprecation("claude-3-haiku-20240307")).toBeTruthy();
+  });
+
+  it("flags the retired ORIGINAL Claude 4 snapshots (exact dated id)", () => {
+    expect(checkModelDeprecation("claude-opus-4-20250514").state).toBe(
+      "retired",
+    );
+    expect(checkModelDeprecation("claude-sonnet-4-20250514").state).toBe(
+      "retired",
+    );
+  });
+
+  it("flags deprecated-but-live Claude Opus 4.1 with state=deprecated", () => {
+    const info = checkModelDeprecation("claude-opus-4-1-20250805");
+    expect(info).toBeTruthy();
+    expect(info.state).toBe("deprecated");
+  });
+
+  it("prefix-matches a retired family (claude-2 → claude-2.1)", () => {
+    expect(checkModelDeprecation("claude-2.1")).toBeTruthy();
+    expect(checkModelDeprecation("claude-2.0")).toBeTruthy();
+    expect(checkModelDeprecation("claude-instant-1.2")).toBeTruthy();
+  });
+
+  it("flags retired OpenAI snapshots", () => {
+    expect(checkModelDeprecation("gpt-4-0314")).toBeTruthy();
+    expect(checkModelDeprecation("gpt-4-32k-0613")).toBeTruthy();
+    expect(checkModelDeprecation("gpt-3.5-turbo-0301")).toBeTruthy();
+    expect(checkModelDeprecation("text-davinci-003")).toBeTruthy();
+  });
+
+  it("is case-insensitive and trims", () => {
+    expect(checkModelDeprecation("  GPT-4-0314  ")).toBeTruthy();
+    expect(checkModelDeprecation("Claude-2.1")).toBeTruthy();
+  });
+
+  it("CRITICAL: does NOT flag ACTIVE Claude 4 models (prefix-collision guard)", () => {
+    // These share a prefix with the retired 4.x snapshots — the entries use
+    // exact dated ids precisely so these stay silent.
+    expect(checkModelDeprecation("claude-opus-4-8")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-7")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-6")).toBeNull();
+    expect(checkModelDeprecation("claude-opus-4-5-20251101")).toBeNull();
+    expect(checkModelDeprecation("claude-sonnet-4-6")).toBeNull();
+    expect(checkModelDeprecation("claude-sonnet-4-5-20250929")).toBeNull();
+    expect(checkModelDeprecation("claude-haiku-4-5-20251001")).toBeNull();
+    expect(checkModelDeprecation("claude-haiku-4-5")).toBeNull();
+  });
+
+  it("does NOT flag other current GA / provider models", () => {
+    expect(checkModelDeprecation("gpt-4o")).toBeNull();
+    expect(checkModelDeprecation("gpt-4o-mini")).toBeNull();
+    expect(checkModelDeprecation("gpt-5")).toBeNull();
+    expect(checkModelDeprecation("gpt-4-turbo")).toBeNull();
+    // provider-specific ids (volcengine/doubao/ollama) never match
+    expect(checkModelDeprecation("doubao-seed-2-0-lite-260215")).toBeNull();
+    expect(checkModelDeprecation("qwen2.5-coder:7b")).toBeNull();
+  });
+
+  it("handles empty / non-string input", () => {
+    expect(checkModelDeprecation("")).toBeNull();
+    expect(checkModelDeprecation(null)).toBeNull();
+    expect(checkModelDeprecation(undefined)).toBeNull();
+    expect(checkModelDeprecation(42)).toBeNull();
+  });
+
+  it("every list entry is internally consistent and self-matches", () => {
+    for (const e of DEPRECATED_MODELS) {
+      expect(typeof e.id).toBe("string");
+      expect(e.id.length).toBeGreaterThan(0);
+      expect(["retired", "deprecated"]).toContain(e.state);
+      expect(typeof e.reason).toBe("string");
+      expect(typeof e.replacement).toBe("string");
+      expect(checkModelDeprecation(e.id)).toBeTruthy();
+      // the recommended replacement must itself never be flagged as retired
+      const firstReplacement = e.replacement.split(/\s+or\s+|\s+/)[0];
+      expect(checkModelDeprecation(firstReplacement)).toBeNull();
+    }
+  });
+});
+
+describe("formatModelDeprecationWarning", () => {
+  it("uses 'has been retired' for retired models", () => {
+    const info = checkModelDeprecation("claude-3-5-sonnet-20241022");
+    const line = formatModelDeprecationWarning(info);
+    expect(line).toMatch(/claude-3-5-sonnet-20241022/);
+    expect(line).toMatch(/has been retired/);
+    expect(line).toMatch(/claude-sonnet-4-6/);
+    expect(line).toMatch(/CC_MODEL_NOTICE=0/);
+  });
+
+  it("uses 'is deprecated' for deprecated-but-live models", () => {
+    const info = checkModelDeprecation("claude-opus-4-1-20250805");
+    const line = formatModelDeprecationWarning(info);
+    expect(line).toMatch(/is deprecated/);
+    expect(line).not.toMatch(/has been retired/);
+  });
+});
+
+describe("maybeWarnDeprecatedModel", () => {
+  let lines;
+  let print;
+  beforeEach(() => {
+    _warned.clear();
+    lines = [];
+    print = (l) => lines.push(l);
+  });
+
+  it("warns once for a deprecated model", () => {
+    const r = maybeWarnDeprecatedModel({ model: "claude-2.1", env: {}, print });
+    expect(r.warned).toBe(true);
+    expect(r.info.id).toBe("claude-2.1");
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toMatch(/claude-2\.1/);
+  });
+
+  it("warns for a retired Claude 3.5 Sonnet (the common stale id)", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-3-5-sonnet-20241022",
+      env: {},
+      print,
+    });
+    expect(r.warned).toBe(true);
+    expect(lines[0]).toMatch(/has been retired/);
+  });
+
+  it("does not repeat the same model within a process", () => {
+    maybeWarnDeprecatedModel({ model: "gpt-4-0314", env: {}, print });
+    const r = maybeWarnDeprecatedModel({ model: "gpt-4-0314", env: {}, print });
+    expect(r.warned).toBe(false);
+    expect(r.info).toBeTruthy(); // still reports the match, just doesn't re-print
+    expect(lines).toHaveLength(1);
+  });
+
+  it("stays silent for a current model", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-opus-4-8",
+      env: {},
+      print,
+    });
+    expect(r.warned).toBe(false);
+    expect(r.info).toBeNull();
+    expect(lines).toHaveLength(0);
+  });
+
+  it("honors CC_MODEL_NOTICE=0", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-2.1",
+      env: { CC_MODEL_NOTICE: "0" },
+      print,
+    });
+    expect(r.warned).toBe(false);
+    expect(lines).toHaveLength(0);
+  });
+
+  it("fail-open on a throwing print", () => {
+    const r = maybeWarnDeprecatedModel({
+      model: "claude-2.1",
+      env: {},
+      print: () => {
+        throw new Error("boom");
+      },
+    });
+    expect(r.warned).toBe(false); // swallowed, no throw
+  });
+
+  it("no-ops on missing model", () => {
+    expect(maybeWarnDeprecatedModel({ env: {}, print }).warned).toBe(false);
+    expect(lines).toHaveLength(0);
+  });
+});

package/src/lib/a2a-protocol.js

@@ -5,6 +5,20 @@
  * capability negotiation, and peer discovery.
  */
 
+// Safe JSON-array parse for values read back from the DB (capabilities / skills /
+// history / artifacts are stored as JSON strings). Written via JSON.stringify so
+// normally valid, but a corrupted or externally-edited DB must not crash agent
+// discovery / task lifecycle with an uncaught SyntaxError — fall back to [].
+function parseJsonArray(value) {
+  if (value == null || value === "") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
 // ─── Task statuses ───────────────────────────────────────────────
 export const TASK_STATUS = {
   SUBMITTED: "submitted",
@@ -165,8 +179,8 @@ export function discoverAgents(db, filter = {}) {
   // Parse JSON fields
   rows = rows.map((r) => ({
     ...r,
-    capabilities: JSON.parse(r.capabilities || "[]"),
-    skills: JSON.parse(r.skills || "[]"),
+    capabilities: parseJsonArray(r.capabilities),
+    skills: parseJsonArray(r.skills),
   }));
 
   if (filter.capability) {
@@ -220,7 +234,7 @@ export function completeTask(db, taskId, output, artifacts = []) {
 
   const now = nowISO();
   const task = _getTask(db, taskId);
-  const history = JSON.parse(task.history || "[]");
+  const history = parseJsonArray(task.history);
   history.push({ status: TASK_STATUS.COMPLETED, timestamp: now });
 
   db.prepare(
@@ -249,7 +263,7 @@ export function failTask(db, taskId, error) {
 
   const now = nowISO();
   const task = _getTask(db, taskId);
-  const history = JSON.parse(task.history || "[]");
+  const history = parseJsonArray(task.history);
   history.push({ status: TASK_STATUS.FAILED, timestamp: now });
 
   db.prepare(
@@ -276,8 +290,8 @@ export function getTaskStatus(db, taskId) {
   const task = _getTask(db, taskId);
   return {
     ...task,
-    history: JSON.parse(task.history || "[]"),
-    artifacts: JSON.parse(task.artifacts || "[]"),
+    history: parseJsonArray(task.history),
+    artifacts: parseJsonArray(task.artifacts),
   };
 }
 
@@ -305,7 +319,7 @@ export function negotiateCapability(db, agentId, requiredCapabilities) {
     .get(agentId);
   if (!card) throw new Error(`Agent not found: ${agentId}`);
 
-  const agentCaps = JSON.parse(card.capabilities || "[]");
+  const agentCaps = parseJsonArray(card.capabilities);
   const supported = requiredCapabilities.filter((c) => agentCaps.includes(c));
   const missing = requiredCapabilities.filter((c) => !agentCaps.includes(c));
 
@@ -329,8 +343,8 @@ export function listPeers(db) {
     .all();
   return rows.map((r) => ({
     ...r,
-    capabilities: JSON.parse(r.capabilities || "[]"),
-    skills: JSON.parse(r.skills || "[]"),
+    capabilities: parseJsonArray(r.capabilities),
+    skills: parseJsonArray(r.skills),
   }));
 }