shraga 0.1.89 → 0.1.91

package/src/server/boot.ts

@@ -26,7 +26,7 @@ import { mountFeatures, registerFeature, resumeFeatureSession, collectFeatureFla
 import { registerSpaCatchAll } from './spa-catchall.ts';
 import { slackFeature } from './slack/feature.ts';
 import { dataPath } from './paths.ts';
-import { getAllSessions, getSession, getSessionHistory, upsertSession, appendMessage, saveConversation, loadConversation, setSessionDirectives, getAutoApprove, setAutoApprove, getSessionsByScheduleId, getSessionsVisibleTo, isSessionVisibleTo, setRunStatus, incrementRetryCount, getRunningSessions, getActiveLockCount, updateScheduledSessionStatus, setShuttingDown, backfillSessionVisibility, writePartial, readPartial, clearPartial, registerLivePartial, unregisterLivePartial, readLivePartial, acquireSessionLock, releaseSessionLock, replaceSessionLock, isSessionLocked, getSessionAbortController, forkSession, generateSessionTitle, type ConvBlock, type ConvMessage, type SessionMeta } from './sessions.ts';
+import { getAllSessions, getSession, getSessionHistory, upsertSession, appendMessage, saveConversation, loadConversation, setSessionDirectives, getAutoApprove, setAutoApprove, getSessionsByScheduleId, getSessionsVisibleTo, isSessionVisibleTo, setRunStatus, incrementRetryCount, getRunningSessions, getActiveLockCount, updateScheduledSessionStatus, setShuttingDown, backfillSessionVisibility, writePartial, readPartial, clearPartial, registerLivePartial, unregisterLivePartial, readLivePartial, acquireSessionLock, releaseSessionLock, replaceSessionLock, isSessionLocked, getSessionAbortController, forkSession, generateSessionTitle, toListItem, pageSessions, isOwnSession, type ConvBlock, type ConvMessage, type SessionMeta } from './sessions.ts';
 import { setBroadcaster } from './session-bus.ts';
 import * as scheduler from './scheduler/index.ts';
 import { initPolls } from './polls.ts';
@@ -249,10 +249,45 @@ app.get('/api/claude-usage', requireAuth, async (_req, res) => {
   res.json(usage);
 });
 
+/**
+ * Conversation list — PAGED and TRIMMED.
+ *
+ * It used to serialize the entire session index: 6.76 MB and ~226 ms of blocking work per call on
+ * the Circles box, most of it `triggeredSkills` + `seenSlackTs`, which are server bookkeeping the
+ * browser never reads. The full record is still one `/api/sessions/:id/meta` away.
+ *
+ * Two modes, both returning `{ sessions, nextCursor }`:
+ *   ?filter=mine|all&limit=&before=<cursor>  — a page of the list, newest first.
+ *   ?ids=a,b,c                               — exactly these sessions, at any age.
+ *
+ * `ids` is what keeps the client's filters honest instead of "searches the first page only": the
+ * unread map arrives over the socket in full (per-user, `unread_sync`), so the Sidebar knows every
+ * unread id and hydrates the ones outside the loaded window by id. The active session is hydrated
+ * the same way. `mine` cannot be done that way — it is a predicate over the whole 12k index — so
+ * it is a server-side filter applied BEFORE paging.
+ */
+const SESSIONS_PAGE_MAX = 200;
 app.get('/api/sessions', requireAuth, async (req, res) => {
   const user = (req as any).user;
   // Exclude PTY-only sessions — a standalone/terminal-first shell is not a conversation.
-  res.json(getSessionsVisibleTo(user.uid, user.isOwner, user.email).filter((s) => s.kind !== 'terminal'));
+  const all = getSessionsVisibleTo(user.uid, user.isOwner, user.email).filter((s) => s.kind !== 'terminal');
+
+  const email = String(user.email ?? '').toLowerCase();
+  const mine = (s: SessionMeta) => isOwnSession(s, user.uid, email);
+
+  const idsParam = String(req.query.ids ?? '').trim();
+  if (idsParam) {
+    const want = new Set(idsParam.split(',').map((s) => s.trim()).filter(Boolean).slice(0, SESSIONS_PAGE_MAX));
+    // Deliberately NOT narrowed to `mine`: this is how the ACTIVE conversation gets a row, and the
+    // open session must render under either filter. Each row carries `mine` so the client can scope
+    // the parts that should be scoped (the unread view and its dot) without losing the active one.
+    return void res.json({ sessions: all.filter((s) => want.has(s.sessionId)).map((s) => toListItem(s, mine(s))), nextCursor: null });
+  }
+
+  const scoped = String(req.query.filter ?? 'all') === 'mine' ? all.filter(mine) : all;
+
+  const limit = Math.min(Math.max(Number(req.query.limit) || 50, 1), SESSIONS_PAGE_MAX);
+  res.json(pageSessions(scoped, { limit, before: String(req.query.before ?? '') || undefined, mine }));
 });
 
 app.get('/api/sessions/:id/meta', requireAuth, async (req, res) => {

package/src/server/claude.ts

@@ -23,7 +23,7 @@ import { getUserContextBlock } from './user-context.ts';
 import { collectTurnContext } from './turn-context.ts';
 import { DATA_DIR, dataPath } from './paths.ts';
 import * as contacts from './contacts.ts';
-import { resolveAndGetEngine } from './engine/index.ts';
+import { resolveAndGetEngine, ModelUnavailableError } from './engine/index.ts';
 
 const CONFIG_PATH = dataPath('agent-config.json');
 
@@ -213,7 +213,19 @@ export async function* streamChat(opts: {
   context?: Record<string, string>;
 }): AsyncGenerator<WsEvent> {
   const config = getAgentConfig();
-  const { prompt: cleanPrompt, directives: parsed } = parseDirectives(opts.prompt);
+  const { prompt: cleanPrompt, directives: parsed, unresolvedModel } = parseDirectives(opts.prompt);
+
+  // An explicit model selection that resolves to nothing is a HARD stop, for the same reason an
+  // unregistered engine is: continuing would run the turn on `config.model` — a different model
+  // than the caller picked — with only a console.warn to show for it. Surfaced as a turn `error`
+  // event (not a throw) so WS, Slack, scheduler, MCP and webhook all report it identically and a
+  // scheduled run is marked failed instead of quietly succeeding on the wrong model.
+  if (unresolvedModel) {
+    const message = new ModelUnavailableError(unresolvedModel).message;
+    console.error(`[stream] ${message} (user=${opts.uid} session=${opts.sessionId ?? 'new'})`);
+    yield { type: 'error', message };
+    return;
+  }
 
   const sessionMeta = opts.sessionId ? getSession(opts.sessionId) : undefined;
   const directives: Directives = { ...sessionMeta?.directives, ...parsed };

package/src/server/data-sync.ts

@@ -107,6 +107,9 @@ export class DataSync {
   private pullPending = false;
   private ready = false;
   private warnedDisabled = false;
+  /** key -> fingerprint+timestamp of the last DM sent for that guard, so a STANDING condition
+   *  alerts once instead of on every sync cycle. See alertOnce(). */
+  private alerted = new Map<string, { fingerprint: string; at: number }>();
 
   constructor(opts?: Partial<DataSyncOptions>) {
     this.options = { ...new DataSyncOptions(), ...opts };
@@ -243,7 +246,16 @@ export class DataSync {
    *  shrink (e.g. contacts.json 111→5 lines — a legit-looking normalization that wiped shared
    *  data). Notifies owner and aborts. */
   private async guardMassDeletions(context: string): Promise<boolean> {
-    const fileThreshold = parseInt(process.env.DATA_SYNC_DELETIONS_BLOCK || '10', 10);
+    // An untrackIgnored() pass is NOT a deletion: it runs `git rm --cached` over files that match
+    // the repo's OWN .gitignore (a personal global gitignore is excluded upstream) and that still
+    // exist on disk. Nothing is lost — the files simply stop being shared, which is the entire
+    // point of the call. Judging it by the 10-file deletion threshold made a normal .gitignore
+    // addition (pane-sessions/, 173 files) an unclearable block: every flush retried it, alerted,
+    // and `git reset HEAD` also discarded whatever real work was staged alongside.
+    const untracking = context === 'untrackIgnored';
+    const fileThreshold = untracking
+      ? parseInt(process.env.DATA_SYNC_UNTRACK_BLOCK || '500', 10)
+      : parseInt(process.env.DATA_SYNC_DELETIONS_BLOCK || '10', 10);
     const shrinkThreshold = parseInt(process.env.DATA_SYNC_SHRINK_BLOCK || '50', 10);
     try {
       // (1) Mass FILE deletions.
@@ -252,7 +264,7 @@ export class DataSync {
       if (deleted.length > fileThreshold) {
         console.error(`${TAG} 🚫 BLOCKED mass deletion (${context}): ${deleted.length} file(s) — threshold is ${fileThreshold}`);
         const list = deleted.slice(0, 20).map(f => `• ${f}`).join('\n');
-        await this.notifyOwners(
+        await this.alertOnce(`deletions:${context}`, deleted.join('\n'),
           `🚫 BLOCKED mass deletion in data/ (${context}): ${deleted.length} file(s) staged for deletion (threshold: ${fileThreshold})\n\n${list}` +
           (deleted.length > 20 ? `\n…and ${deleted.length - 20} more` : '') +
           `\n\nCommit was aborted. Manual intervention needed.`,
@@ -273,13 +285,16 @@ export class DataSync {
       }
       if (shrunk.length) {
         console.error(`${TAG} 🚫 BLOCKED large content shrink (${context}): ${shrunk.length} file(s) — net-removal threshold is ${shrinkThreshold}`);
-        await this.notifyOwners(
+        await this.alertOnce(`shrink:${context}`, shrunk.join('\n'),
           `🚫 BLOCKED large content shrink in data/ (${context}): a tracked file lost more than ${shrinkThreshold} net lines (guards against wiping shared data like contacts.json)\n\n${shrunk.slice(0, 20).join('\n')}` +
           `\n\nCommit was aborted. If intended, raise DATA_SYNC_SHRINK_BLOCK or commit manually.`,
         );
         await this.git('reset', 'HEAD').catch(() => {});
         return true;
       }
+      // Condition cleared — a future recurrence is news again, so let it alert.
+      this.clearAlert(`deletions:${context}`);
+      this.clearAlert(`shrink:${context}`);
       return false;
     } catch (err) {
       console.warn(`${TAG} Destructive-change check failed:`, (err as Error).message);
@@ -678,6 +693,31 @@ export class DataSync {
     return violations;
   }
 
+  /**
+   * DM owners about a guard trip, but only when the condition is NEW. A blocked commit is not a
+   * one-off: the same staged change is re-attempted on every flush, so a standing condition used to
+   * DM on every cycle (measured 2026-09-08: 173 files ignored-but-tracked produced an identical
+   * "BLOCKED mass deletion" DM ~15×/hour, indefinitely). Alert fatigue is a correctness bug — it
+   * buries the one alert that matters. Re-alerts only when the fingerprint CHANGES or after
+   * DATA_SYNC_ALERT_REPEAT_MS (default 6h), and every trip is still logged locally.
+   */
+  private async alertOnce(key: string, fingerprint: string, text: string): Promise<void> {
+    const repeatMs = parseInt(process.env.DATA_SYNC_ALERT_REPEAT_MS || '', 10) || 6 * 60 * 60 * 1000;
+    const prev = this.alerted.get(key);
+    const now = Date.now();
+    if (prev && prev.fingerprint === fingerprint && now - prev.at < repeatMs) {
+      console.warn(`${TAG} alert suppressed (unchanged since ${new Date(prev.at).toISOString()}): ${key}`);
+      return;
+    }
+    this.alerted.set(key, { fingerprint, at: now });
+    await this.notifyOwners(text);
+  }
+
+  /** Clear the repeat-suppression for a guard once its condition is gone, so a RECURRENCE alerts. */
+  private clearAlert(key: string): void {
+    this.alerted.delete(key);
+  }
+
   private async notifyOwners(text: string): Promise<void> {
     if (!this.options.notify) {
       // Not the authoritative instance — log it so a dev run still surfaces the problem locally,

package/src/server/directives.ts

@@ -9,6 +9,11 @@ export interface Directives {
 export interface ParsedPrompt {
   prompt: string;
   directives: Directives;
+  /** An EXPLICIT model selection that no alias and no registered engine could resolve. Reported
+   *  instead of applied: dropping it (the old behaviour) ran the turn on `config.model` — a
+   *  DIFFERENT model than the caller asked for, with nothing but a `console.warn` to show for it.
+   *  The caller turns this into a turn error; see `streamChat`. */
+  unresolvedModel?: string;
 }
 
 /** Model used when neither directives nor config specify one. Always passed
@@ -91,8 +96,19 @@ export function parseDirectives(text: string): ParsedPrompt {
 
   const directives: Directives = {};
   let positionalIndex = 0;
+  let unresolvedModel: string | undefined;
+
+  const tokens = raw.split(',');
+  // Is this group PROVABLY a directive group (some token is a known `key:value`)? A bare positional
+  // that resolves to nothing is otherwise indistinguishable from prose — `[some bracketed text] hi`
+  // is a legitimate prompt and must never fail a turn. With a keyed sibling present the group is
+  // unambiguously directives, so an unresolvable leading model token there IS a dropped selection.
+  const provenDirectiveGroup = tokens.some((t) => {
+    const i = t.indexOf(':');
+    return i !== -1 && DIRECTIVE_KEYS.includes(t.slice(0, i).trim().toLowerCase());
+  });
 
-  for (const token of raw.split(',')) {
+  for (const token of tokens) {
     const t = token.trim();
     if (!t) continue;
 
@@ -100,7 +116,7 @@ export function parseDirectives(text: string): ParsedPrompt {
     if (colonIdx !== -1) {
       const key = t.slice(0, colonIdx).trim().toLowerCase();
       const val = t.slice(colonIdx + 1).trim().toLowerCase();
-      applyDirective(directives, key, val);
+      unresolvedModel = applyDirective(directives, key, val) ?? unresolvedModel;
     } else {
       const val = t.toLowerCase();
       if (positionalIndex === 0 && resolveModelToken(directives, val)) {
@@ -112,6 +128,7 @@ export function parseDirectives(text: string): ParsedPrompt {
       } else if (['nothink', 'nothinking'].includes(val)) {
         directives.thinking = 'disabled';
       } else if (positionalIndex === 0) {
+        if (provenDirectiveGroup && !isQualifiedModel(val)) unresolvedModel ??= t;
         console.warn(isQualifiedModel(val)
           ? `[directives] Provider-qualified model needs key form: "[model:${t}]"`
           : `[directives] Unknown model alias: "${t}"`);
@@ -120,16 +137,19 @@ export function parseDirectives(text: string): ParsedPrompt {
     }
   }
 
-  return { prompt, directives };
+  return { prompt, directives, unresolvedModel };
 }
 
-function applyDirective(d: Directives, key: string, val: string) {
+/** Returns the token of an EXPLICIT model selection it could not resolve, else undefined. */
+function applyDirective(d: Directives, key: string, val: string): string | undefined {
   switch (key) {
     case 'model':
       if (resolveModelToken(d, val)) break;
-      if (isQualifiedModel(val)) d.model = val;
-      else console.warn(`[directives] Unknown model alias: "${val}"`);
-      break;
+      // A `provider/model` id is already concrete — hand it to the engine, which owns the verdict.
+      if (isQualifiedModel(val)) { d.model = val; break; }
+      // Nothing knows this token. `[model:x]` is unambiguously a selection (never prose), so the
+      // turn must not quietly continue on the instance default model.
+      return val;
     case 'turns':
       if (/^\d+$/.test(val)) d.turns = parseInt(val, 10);
       else console.warn(`[directives] Invalid turns value: "${val}"`);
@@ -149,4 +169,5 @@ function applyDirective(d: Directives, key: string, val: string) {
     default:
       console.warn(`[directives] Unknown directive key: "${key}"`);
   }
+  return undefined;
 }

package/src/server/engine/index.ts

@@ -64,6 +64,23 @@ export class EngineUnavailableError extends Error {
   }
 }
 
+/** An explicitly selected model that neither the alias table nor any REGISTERED engine could
+ *  resolve. Same contract as EngineUnavailableError: the run stops instead of silently continuing
+ *  on the instance default, which is a different model than the caller chose. */
+export class ModelUnavailableError extends Error {
+  constructor(public readonly model: string) {
+    super(
+      `Model "${model}" could not be resolved on this server. It is not a known alias, not a ` +
+        `provider-qualified id (\`provider/model\`), and no registered engine advertises it. ` +
+        `Registered engines: ${getAvailableEngines().join(', ') || 'none'} — an engine registers only when enabled ` +
+        `at boot (AGENT_ENGINES must list it; the native cursor engine also needs CURSOR_API_KEY), ` +
+        `so a model owned by an absent engine cannot resolve. Check the server env and startup log. ` +
+        `The run was stopped rather than silently re-routed to the instance's default model.`,
+    );
+    this.name = 'ModelUnavailableError';
+  }
+}
+
 export function resolveAndGetEngine(directives?: { engine?: string }, agentConfig?: { engine?: string }) {
   const name = resolveEngine(directives, agentConfig);
   // An optional engine may be unregistered on a given boot (add-on not loaded, missing API key or

package/src/server/sessions.ts

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, readdirSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, statSync, renameSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { homedir } from 'node:os';
@@ -44,18 +44,146 @@ export interface SessionMeta {
   forkedFrom?: string;
 }
 
+// ── Index cache ──────────────────────────────────────────────────────────────
+// The index is ~9 MB / 12.8k records on the Circles box. Every mutation used to readFileSync +
+// JSON.parse the whole file and then stringify + write it back, SYNCHRONOUSLY (~260 ms per
+// mutation on a 2-vCPU host, and a turn does several), so the event loop stalled on bookkeeping.
+//
+// Single-writer, deliberately: the HTTP server, its scheduler and the MCP surface all run in ONE
+// bun process (`src/server/index.ts` → boot.ts, which mounts the MCP in-process; the only spawned
+// children are vendor MCP sidecars and background-job shells, none of which import this module).
+// data-sync cannot touch it either — `sessions.json` is in the data repo's canonical .gitignore,
+// so its pull/reset/stash never sees the file. The one out-of-band writer is the manual
+// `defaults/scripts/backfill-slack-usernames.ts`, and this cache does NOT make that safe:
+//
+//   The mtime guard below only runs when the cache is CLEAN. `loadIndex()` short-circuits on
+//   `if (dirty) return cache` first, so while a flush is pending the server neither sees an
+//   external edit nor survives it — the next flushIndex() writes the whole in-memory cache over
+//   the file, and the backfill's work is gone. The guard buys exactly one thing over the old
+//   read-every-time behaviour: an external edit made while nothing is pending IS picked up.
+//   Fixing the pending-flush case needs a merge or a lock, i.e. a multi-process protocol, which
+//   this file deliberately does not have. flushIndex() detects the clobber and logs it loudly
+//   instead of losing it silently — run the backfill with the server stopped.
+let cache: SessionMeta[] | null = null;
+let cacheMtimeMs = -1;
+let dirty = false;
+let flushTimer: ReturnType<typeof setTimeout> | null = null;
+
+/**
+ * Coalescing window for the 9 MB write.
+ *
+ * Durability trade, stated explicitly: a crash can lose at most this much session BOOKKEEPING —
+ * runStatus, lastModified, seenSlackTs, triggeredSkills. Conversation content is not in this file
+ * (it lives in `data/conversations/`), so no user-visible message can be lost here. Every exit
+ * path we control flushes synchronously (`process.on('exit')` — reached by the SIGTERM/SIGINT
+ * graceful shutdown, which ends in process.exit — plus setShuttingDown() at the top of the drain),
+ * so the exposure is a SIGKILL or power loss inside a 250 ms window. Taken over the alternative:
+ * a ~260 ms sync stall on every single mutation.
+ */
+const FLUSH_DEBOUNCE_MS = 250;
+
 function loadIndex(): SessionMeta[] {
-  if (!existsSync(SESSIONS_PATH)) return [];
+  if (cache) {
+    if (dirty) return cache; // memory is ahead of disk — we are the authority
+    try {
+      if (statSync(SESSIONS_PATH).mtimeMs === cacheMtimeMs) return cache;
+    } catch {
+      return cache; // file vanished mid-run; keep serving what we have
+    }
+  }
+  if (!existsSync(SESSIONS_PATH)) return (cache = []);
   try {
-    return JSON.parse(readFileSync(SESSIONS_PATH, 'utf-8'));
-  } catch {
-    return [];
+    cache = JSON.parse(readFileSync(SESSIONS_PATH, 'utf-8'));
+    cacheMtimeMs = statSync(SESSIONS_PATH).mtimeMs;
+  } catch (err) {
+    console.error('[sessions] index unreadable, serving an empty list:', (err as Error).message);
+    cache = [];
   }
+  return cache!;
 }
 
 function saveIndex(sessions: SessionMeta[]): void {
-  mkdirSync(DATA_DIR, { recursive: true });
-  writeFileSync(SESSIONS_PATH, JSON.stringify(sessions, null, 2));
+  cache = sessions;
+  dirty = true;
+  if (!flushTimer) scheduleFlush();
+}
+
+function scheduleFlush(): void {
+  const t = setTimeout(flushIndex, FLUSH_DEBOUNCE_MS);
+  (t as { unref?: () => void }).unref?.(); // never hold the process open for bookkeeping
+  flushTimer = t;
+}
+
+/**
+ * Write the index to disk now. Atomic (tmp + rename): the old truncate-in-place write left a
+ * half-written 9 MB file if it was interrupted, and loadIndex's catch turned that into an EMPTY
+ * session list — a silent total loss of the index.
+ */
+export function flushIndex(): void {
+  if (flushTimer) { clearTimeout(flushTimer); flushTimer = null; }
+  if (!dirty || !cache) return;
+  dirty = false;
+  const tmp = `${SESSIONS_PATH}.tmp`;
+  try {
+    // Someone wrote the file behind us while this flush was pending (see the cache note above).
+    // We cannot merge without a multi-process protocol, so at least never lose it silently.
+    try {
+      const onDisk = statSync(SESSIONS_PATH).mtimeMs;
+      if (cacheMtimeMs >= 0 && onDisk !== cacheMtimeMs) {
+        console.error(`[sessions] index changed on disk (mtime ${onDisk} != ${cacheMtimeMs}) while a flush was pending — overwriting that external edit`);
+      }
+    } catch { /* file absent: nothing to clobber */ }
+    mkdirSync(DATA_DIR, { recursive: true });
+    writeFileSync(tmp, JSON.stringify(cache)); // no pretty-print: 9 MB nobody reads by hand
+    renameSync(tmp, SESSIONS_PATH);
+    cacheMtimeMs = statSync(SESSIONS_PATH).mtimeMs;
+  } catch (err) {
+    console.error('[sessions] index flush failed, retrying on the next tick:', (err as Error).message);
+    dirty = true;
+    scheduleFlush();
+  }
+}
+
+// Covers the graceful-shutdown paths (SIGTERM/SIGINT end in process.exit) and any normal exit,
+// without adding signal listeners that would change the process's default signal semantics.
+process.on('exit', () => flushIndex());
+
+/**
+ * The subset of SessionMeta the conversation list actually renders. `triggeredSkills` (381 KB) and
+ * `seenSlackTs` (174 KB) are server bookkeeping and must never be shipped to a browser; the full
+ * record is still available per-session from /api/sessions/:id/meta.
+ */
+export interface SessionListItem {
+  sessionId: string;
+  title: string;
+  userName: string;
+  lastModified: number;
+  slackContext?: SessionMeta['slackContext'];
+  runStatus?: SessionMeta['runStatus'];
+  lastStopReason?: SessionMeta['lastStopReason'];
+  scheduleRunStatus?: SessionMeta['scheduleRunStatus'];
+  /** Owned by (or explicitly shared with) the caller. Stamped per-request: the trimmed row drops
+   *  `uid`/`visibleTo`, so without it the client cannot scope anything by "mine". */
+  mine?: boolean;
+}
+
+/** The `mine` predicate, shared by the list filter and the per-row stamp so they cannot drift. */
+export function isOwnSession(s: SessionMeta, uid: string, email: string): boolean {
+  return s.uid === uid || !!s.visibleTo?.includes(email);
+}
+
+export function toListItem(s: SessionMeta, mine?: boolean): SessionListItem {
+  return {
+    sessionId: s.sessionId,
+    title: s.title,
+    userName: s.userName,
+    lastModified: s.lastModified,
+    ...(s.slackContext ? { slackContext: s.slackContext } : {}),
+    ...(s.runStatus ? { runStatus: s.runStatus } : {}),
+    ...(s.lastStopReason ? { lastStopReason: s.lastStopReason } : {}),
+    ...(s.scheduleRunStatus ? { scheduleRunStatus: s.scheduleRunStatus } : {}),
+    ...(mine === undefined ? {} : { mine }),
+  };
 }
 
 function summarize(prompt: string): string {
@@ -126,8 +254,33 @@ export function addTriggeredSkills(sessionId: string, names: string[]): void {
   saveIndex(sessions);
 }
 
+/**
+ * Stable pagination cursor: lastModified alone is not unique across 12k sessions, and a paging
+ * cursor that only carries the timestamp drops or repeats every record in a tie.
+ */
+export function sessionCursor(s: SessionMeta | SessionListItem): string {
+  return `${String(s.lastModified).padStart(16, '0')}.${s.sessionId}`;
+}
+
+/**
+ * One page of an already-sorted (getAllSessions order) list, newest first. `before` is the cursor
+ * from the previous page's `nextCursor`; it is composite (lastModified + sessionId) because
+ * lastModified alone is not unique and a timestamp-only cursor drops or repeats records on a tie.
+ */
+export function pageSessions(list: SessionMeta[], opts: { limit: number; before?: string; mine?: (s: SessionMeta) => boolean }): { sessions: SessionListItem[]; nextCursor: string | null } {
+  const rest = opts.before ? list.filter((s) => sessionCursor(s) < opts.before!) : list;
+  const page = rest.slice(0, opts.limit);
+  return {
+    sessions: page.map((s) => toListItem(s, opts.mine?.(s))),
+    nextCursor: rest.length > page.length ? sessionCursor(page[page.length - 1]) : null,
+  };
+}
+
 export function getAllSessions(): SessionMeta[] {
-  return loadIndex().sort((a, b) => b.lastModified - a.lastModified);
+  // Copy before sorting: loadIndex() now returns the live cache array, and an in-place sort here
+  // would silently reorder the store for every other caller. Sorted by the same composite key the
+  // pagination cursor uses, so `cursor < before` is exactly consistent with this order.
+  return [...loadIndex()].sort((a, b) => b.lastModified - a.lastModified || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0));
 }
 
 export function isSessionVisibleTo(s: SessionMeta, uid: string, isOwner = false, email?: string): boolean {
@@ -184,7 +337,11 @@ export function setSessionDirectives(sessionId: string, directives: NonNullable<
   const sessions = loadIndex();
   const s = sessions.find((s) => s.sessionId === sessionId);
   if (s) {
-    s.directives = directives;
+    // COPY, don't alias. streamChat() stores its working `directives` object here and then keeps
+    // mutating it for the rest of the turn (the per-skill turn budget is gap-filled afterwards).
+    // While the index was re-parsed from disk on every read that leak was invisible; against an
+    // in-memory store it would silently PIN a skill's 250-turn budget onto the session forever.
+    s.directives = { ...directives };
     saveIndex(sessions);
   }
 }
@@ -269,7 +426,7 @@ export function setAutoApprove(uid: string, value: boolean): void {
 }
 
 let _shuttingDown = false;
-export function setShuttingDown(): void { _shuttingDown = true; }
+export function setShuttingDown(): void { _shuttingDown = true; flushIndex(); }
 
 export function setRunStatus(sessionId: string, status: 'running' | 'idle', origin?: 'web' | 'slack' | 'scheduler' | 'gmail', stopReason?: SessionMeta['lastStopReason']): void {
   if (_shuttingDown && status === 'idle') return;