talon-agent 5.18.2 → 5.19.1

package/src/storage/daily-log.ts

@@ -11,7 +11,7 @@ import {
   unlinkSync,
 } from "node:fs";
 import { resolve } from "node:path";
-import { log as logInfo, logError } from "../util/log.js";
+import { log as logInfo, logError, logWarn } from "../util/log.js";
 import { dirs } from "../util/paths.js";
 import { toYMD } from "../util/time.js";
 
@@ -115,56 +115,52 @@ export function todayLogDate(): string {
 /** Matches YYYY-MM-DD.md filenames strictly. */
 const DAILY_FILE_RE = /^\d{4}-\d{2}-\d{2}\.md$/;
 
-/** Remove daily logs older than MAX_LOG_DAYS. Called on startup. */
-export function cleanupOldLogs(): void {
+/**
+ * Unlink YYYY-MM-DD.md files in `dir` dated before `cutoff`. Never
+ * throws; a missing dir is the normal first-run case, anything else
+ * (unreadable dir, a file that won't unlink) is logged.
+ */
+function pruneDatedFiles(dir: string, cutoff: string, what: string): void {
+  let deleted = 0;
+  let failed = 0;
+  let firstFailure = "";
   try {
-    if (existsSync(LOGS_DIR)) {
-      const cutoff = new Date();
-      cutoff.setDate(cutoff.getDate() - MAX_LOG_DAYS);
-      const cutoffStr = localDateKey(cutoff);
-
-      let deleted = 0;
-      for (const file of readdirSync(LOGS_DIR)) {
-        if (DAILY_FILE_RE.test(file) && file < cutoffStr) {
-          try {
-            unlinkSync(resolve(LOGS_DIR, file));
-            deleted++;
-          } catch {
-            /* skip */
-          }
-        }
-      }
-      if (deleted > 0) {
-        logInfo("workspace", `Cleaned up ${deleted} old daily log(s)`);
+    if (!existsSync(dir)) return;
+    for (const file of readdirSync(dir)) {
+      if (!DAILY_FILE_RE.test(file) || file >= cutoff) continue;
+      try {
+        unlinkSync(resolve(dir, file));
+        deleted++;
+      } catch (err) {
+        if (failed++ === 0) firstFailure = `${file}: ${errText(err)}`;
       }
     }
-  } catch {
-    /* skip */
+  } catch (err) {
+    logWarn("workspace", `${what} cleanup failed dir=${dir}: ${errText(err)}`);
+  }
+  if (deleted > 0) {
+    logInfo("workspace", `Cleaned up ${deleted} old ${what}(s)`);
+  }
+  if (failed > 0) {
+    logWarn(
+      "workspace",
+      `Could not remove ${failed} old ${what}(s) dir=${dir}; first=${firstFailure}`,
+    );
   }
+}
+
+function errText(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
+
+/** Remove daily logs older than MAX_LOG_DAYS. Called on startup. */
+export function cleanupOldLogs(): void {
+  const cutoff = new Date();
+  cutoff.setDate(cutoff.getDate() - MAX_LOG_DAYS);
+  pruneDatedFiles(LOGS_DIR, localDateKey(cutoff), "daily log");
 
   // Clean up old daily memory files (independent of logs dir)
-  try {
-    const dailyMemDir = dirs.dailyMemory;
-    if (!existsSync(dailyMemDir)) return;
-    const cutoffDate = new Date();
-    cutoffDate.setDate(cutoffDate.getDate() - MAX_LOG_DAYS);
-    const cutoffMem = toYMD(cutoffDate);
-
-    let deletedMem = 0;
-    for (const file of readdirSync(dailyMemDir)) {
-      if (DAILY_FILE_RE.test(file) && file < cutoffMem) {
-        try {
-          unlinkSync(resolve(dailyMemDir, file));
-          deletedMem++;
-        } catch {
-          /* skip */
-        }
-      }
-    }
-    if (deletedMem > 0) {
-      logInfo("workspace", `Cleaned up ${deletedMem} old daily memory file(s)`);
-    }
-  } catch {
-    /* skip */
-  }
+  const cutoffDate = new Date();
+  cutoffDate.setDate(cutoffDate.getDate() - MAX_LOG_DAYS);
+  pruneDatedFiles(dirs.dailyMemory, toYMD(cutoffDate), "daily memory file");
 }

package/src/storage/db.ts

@@ -27,7 +27,7 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { files } from "../util/paths.js";
-import { log, logError } from "../util/log.js";
+import { log, logError, logWarn } from "../util/log.js";
 import { SCHEMA, dbSql } from "./sql/statements.generated.js";
 
 /**
@@ -66,18 +66,20 @@ const ReadOnlyDatabase = Database as unknown as new (
 
 let db: SqlDatabase | null = null;
 
+/** How long a write waits on another connection's lock before SQLITE_BUSY. */
+const BUSY_TIMEOUT_MS = 5_000;
+
 /**
  * Apply the complete schema. Every statement is IF NOT EXISTS, so this
  * is a no-op on an up-to-date database and creates exactly what's
  * missing on a fresh or older one.
  *
  * Column reconciliation runs first: `ALTER TABLE … ADD COLUMN` has no
- * IF NOT EXISTS form, so columns added to already-shipped tables
- * (media_index.content_hash, sessions.metrics,
- * history_messages.attachments, sessions.last_turn_ended_at) are ensured by attempting the ALTER and
- * swallowing the two expected failures — "duplicate column name"
- * (column already there) and "no such table" (fresh database; the
- * CREATE TABLE in schema.sql includes the column).
+ * IF NOT EXISTS form, so columns added to already-shipped tables are
+ * ensured by attempting the ALTER and swallowing the two expected
+ * failures — "duplicate column name" (column already there) and "no
+ * such table" (fresh database; the CREATE TABLE in schema.sql includes
+ * the column).
  */
 function ensureSchema(database: SqlDatabase): void {
   const row = database
@@ -85,30 +87,27 @@ function ensureSchema(database: SqlDatabase): void {
       "SELECT COUNT(*) AS tables FROM sqlite_master WHERE type = 'table'",
     )
     .get() as { tables: number };
-  try {
-    database.exec(dbSql.addMediaContentHashColumn);
-  } catch {
-    /* duplicate column or no such table — both mean nothing to do */
-  }
-  try {
-    database.exec(dbSql.addHistorySenderHandleColumn);
-  } catch {
-    /* duplicate column or no such table — both mean nothing to do */
-  }
-  try {
-    database.exec(dbSql.addSessionsMetricsColumn);
-  } catch {
-    /* duplicate column or no such table — both mean nothing to do */
-  }
-  try {
-    database.exec(dbSql.addHistoryAttachmentsColumn);
-  } catch {
-    /* duplicate column or no such table — both mean nothing to do */
-  }
-  try {
-    database.exec(dbSql.addSessionsLastTurnEndedAtColumn);
-  } catch {
-    /* duplicate column or no such table — both mean nothing to do */
+  for (const addColumn of [
+    dbSql.addMediaContentHashColumn,
+    dbSql.addHistorySenderHandleColumn,
+    dbSql.addSessionsMetricsColumn,
+    dbSql.addHistoryAttachmentsColumn,
+    dbSql.addSessionsLastTurnEndedAtColumn,
+  ]) {
+    try {
+      database.exec(addColumn);
+    } catch (err) {
+      // Duplicate column or no such table both mean nothing to do. Any
+      // other failure (read-only file, full disk) is a real fault the
+      // schema step below will likely trip over too — say which ALTER.
+      const msg = err instanceof Error ? err.message : String(err);
+      if (!/duplicate column name|no such table/i.test(msg)) {
+        logWarn(
+          "db",
+          `schema column reconcile failed: ${msg}${dbErrorFields(err)} sql=${JSON.stringify(addColumn.slice(0, 60))}`,
+        );
+      }
+    }
   }
   database.exec("BEGIN");
   try {
@@ -121,6 +120,24 @@ function ensureSchema(database: SqlDatabase): void {
   if (row.tables === 0) log("db", "Initialized database schema");
 }
 
+/**
+ * The SQLite result code behind a driver error, as ` key=value` log
+ * fields (leading space; empty when there is none). node:sqlite keeps
+ * it out of the message — "database or disk is full" arrives as
+ * `errcode: 13` — so a log line built from `err.message` alone can't
+ * be grepped for SQLITE_FULL (13), SQLITE_BUSY (5) or SQLITE_READONLY (8).
+ */
+export function dbErrorFields(err: unknown): string {
+  if (!err || typeof err !== "object") return "";
+  const e = err as { code?: unknown; errcode?: unknown; errno?: unknown };
+  let out = "";
+  if (typeof e.code === "string") out += ` code=${e.code}`;
+  // node:sqlite names it errcode, bun:sqlite errno.
+  const rc = typeof e.errcode === "number" ? e.errcode : e.errno;
+  if (typeof rc === "number") out += ` errcode=${rc}`;
+  return out;
+}
+
 function defaultPath(): string {
   // Test isolation: the vitest setup file points every worker at a
   // throwaway database so suites never touch ~/.talon/data/talon.db.
@@ -137,6 +154,12 @@ export function getDatabase(path: string = defaultPath()): SqlDatabase {
   mkdirSync(dirname(path), { recursive: true });
   const database = new Database(path);
   try {
+    // Other processes write this file too (CLI commands, a respawned
+    // successor overlapping its predecessor). Both drivers default to a
+    // zero busy timeout, i.e. "database is locked" the instant a write
+    // meets theirs — wait for the lock instead. First, so the pragmas
+    // and schema setup below get it too.
+    database.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
     // WAL: readers don't block the writer, and crash recovery is
     // journal-based instead of "hope the rename was atomic".
     database.exec("PRAGMA journal_mode = WAL");
@@ -216,8 +239,13 @@ export function flushDatabase(): void {
   if (!db) return;
   try {
     db.exec(dbSql.walCheckpoint);
-  } catch {
-    /* shutting down — best effort */
+  } catch (err) {
+    // Shutting down — best effort, but a checkpoint that fails here
+    // (disk full, I/O error) is the last word on why the WAL grew.
+    logWarn(
+      "db",
+      `WAL checkpoint failed: ${err instanceof Error ? err.message : String(err)}${dbErrorFields(err)}`,
+    );
   }
 }
 

package/src/storage/history.ts

@@ -24,6 +24,7 @@ import { recordError } from "../util/watchdog.js";
 import { files } from "../util/paths.js";
 import { formatSmartTimestamp, formatRelativeAge } from "../util/time.js";
 import { importLegacyJson } from "./legacy-import.js";
+import { dbErrorFields } from "./db.js";
 import * as repo from "./repositories/history-repo.js";
 
 export type {
@@ -77,7 +78,11 @@ export function pushMessage(chatId: string, msg: HistoryMessage): void {
   try {
     repo.insert(chatId, msg);
   } catch (err) {
-    logError("history", "Failed to persist message", err);
+    logError(
+      "history",
+      `Failed to persist message chat=${chatId} msg=${msg.msgId}${dbErrorFields(err)}`,
+      err,
+    );
     recordError(
       `History write failed: ${err instanceof Error ? err.message : err}`,
     );

package/src/storage/journal.ts

@@ -15,7 +15,7 @@
  * PRUNE_EVERY appends) rather than on a timer.
  */
 
-import { logError } from "../util/log.js";
+import { logError, logWarn } from "../util/log.js";
 import * as repo from "./repositories/journal-repo.js";
 
 /**
@@ -82,6 +82,7 @@ export function readJournal<E extends JournalRecord = JournalRecord>(
     ? repo.recentByType(options.type, limit)
     : repo.recent(limit);
   const entries: JournalEntry<E>[] = [];
+  const corrupt: number[] = [];
   for (const row of rows) {
     try {
       entries.push({
@@ -90,9 +91,15 @@ export function readJournal<E extends JournalRecord = JournalRecord>(
         event: JSON.parse(row.payload) as E,
       });
     } catch {
-      // skip the corrupt row
+      corrupt.push(row.seq); // skip the corrupt row
     }
   }
+  if (corrupt.length > 0) {
+    logWarn(
+      "journal",
+      `Skipped ${corrupt.length} corrupt journal row(s) seq=${corrupt.slice(0, 5).join(",")}`,
+    );
+  }
   return entries;
 }
 

package/src/storage/kv.ts

@@ -14,6 +14,7 @@
  */
 
 import * as repo from "./repositories/kv-repo.js";
+import { dbErrorFields } from "./db.js";
 import { logError } from "../util/log.js";
 
 export function kvGet<T>(key: string): T | undefined {
@@ -21,7 +22,7 @@ export function kvGet<T>(key: string): T | undefined {
   try {
     raw = repo.get(key);
   } catch (err) {
-    logError("kv", `Failed to read ${key}`, err);
+    logError("kv", `Failed to read ${key}${dbErrorFields(err)}`, err);
     return undefined;
   }
   if (raw === undefined) return undefined;
@@ -33,12 +34,24 @@ export function kvGet<T>(key: string): T | undefined {
   }
 }
 
-/** Persist a JSON-serialisable value. Storage failure logs, never throws. */
-export function kvSet(key: string, value: unknown): void {
+/**
+ * Persist a JSON-serialisable value. Storage failure logs (with the
+ * SQLite result code, so a full disk reads as errcode=13) and never
+ * throws; the return says whether the write landed.
+ */
+export function kvSet(key: string, value: unknown): boolean {
+  let json: string | undefined;
   try {
-    repo.set(key, JSON.stringify(value), Date.now());
+    json = JSON.stringify(value);
+    repo.set(key, json, Date.now());
+    return true;
   } catch (err) {
-    logError("kv", `Failed to write ${key}`, err);
+    logError(
+      "kv",
+      `Failed to write ${key} bytes=${json?.length ?? "?"}${dbErrorFields(err)}`,
+      err,
+    );
+    return false;
   }
 }
 
@@ -46,7 +59,7 @@ export function kvDelete(key: string): boolean {
   try {
     return repo.remove(key);
   } catch (err) {
-    logError("kv", `Failed to delete ${key}`, err);
+    logError("kv", `Failed to delete ${key}${dbErrorFields(err)}`, err);
     return false;
   }
 }

package/src/storage/media-index.ts

@@ -17,11 +17,12 @@
 
 import { existsSync, unlinkSync } from "node:fs";
 import { blake3HexFile } from "../native/blake3.js";
-import { log, logError } from "../util/log.js";
+import { log, logError, logWarn } from "../util/log.js";
 import { recordError } from "../util/watchdog.js";
 import { files } from "../util/paths.js";
 import { importLegacyJson } from "./legacy-import.js";
 import { setMessageFilePath } from "./history.js";
+import { dbErrorFields } from "./db.js";
 import * as repo from "./repositories/media-index-repo.js";
 
 export type { MediaEntry } from "./repositories/media-index-repo.js";
@@ -75,7 +76,11 @@ export function addMedia(entry: Omit<MediaEntry, "id">): void {
   try {
     repo.upsert(entry);
   } catch (err) {
-    logError("media", "Media index save failed", err);
+    logError(
+      "media",
+      `Media index save failed chat=${entry.chatId} msg=${entry.msgId} path=${entry.filePath}${dbErrorFields(err)}`,
+      err,
+    );
     recordError(
       `Media index write failed: ${err instanceof Error ? err.message : err}`,
     );
@@ -116,8 +121,13 @@ async function hashAndDedupe(entry: Omit<MediaEntry, "id">): Promise<void> {
         "media",
         `Deduped ${entry.filePath} -> ${canonical.filePath} (blake3 ${hash.slice(0, 12)}…)`,
       );
-    } catch {
-      /* dedupe is best-effort; the entry already points at the canonical copy */
+    } catch (err) {
+      // Dedupe is best-effort — the entry already points at the canonical
+      // copy — but the duplicate now sits on disk unreferenced.
+      logWarn(
+        "media",
+        `Dedupe unlink failed path=${entry.filePath}: ${err instanceof Error ? err.message : String(err)}`,
+      );
     }
   }
 }
@@ -161,17 +171,29 @@ function purgeExpired(): void {
     const removed = repo.deleteOlderThan(cutoff);
     // Rows first, files second: content dedupe means several entries can
     // share one file, so only unlink paths no surviving row references.
+    let unlinkFailures = 0;
+    let firstFailure = "";
     for (const path of new Set(expired.map((e) => e.filePath))) {
       if (repo.countByFilePath(path) > 0) continue;
       try {
         if (existsSync(path)) unlinkSync(path);
-      } catch {
-        /* skip */
+      } catch (err) {
+        // Skip it, but count: files left behind are disk that the purge
+        // thinks it reclaimed.
+        if (unlinkFailures++ === 0) {
+          firstFailure = `${path}: ${err instanceof Error ? err.message : String(err)}`;
+        }
       }
     }
     if (removed > 0) {
       log("media", `Purged ${removed} expired media entries`);
     }
+    if (unlinkFailures > 0) {
+      logWarn(
+        "media",
+        `Media purge left ${unlinkFailures} expired file(s) on disk; first=${firstFailure}`,
+      );
+    }
   } catch (err) {
     logError("media", "Media index purge failed", err);
   }

package/src/storage/repositories/chat-settings-repo.ts

@@ -11,6 +11,7 @@
  * queried independently in SQL.
  */
 
+import { logWarn } from "../../util/log.js";
 import { getDatabase, inTransaction } from "../db.js";
 import { chatSettingsSql } from "../sql/statements.generated.js";
 import type { ReasoningEffortLevel } from "../../types/effort.js";
@@ -102,8 +103,13 @@ export function all(): Array<{ chatId: string; settings: ChatSettings }> {
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         result.push({ chatId: row.chat_id, settings: parsed });
       }
-    } catch {
-      /* skip unparseable row */
+    } catch (err) {
+      // Skip the unparseable row; the chat silently falls back to
+      // defaults otherwise.
+      logWarn(
+        "settings",
+        `Skipped corrupt chat settings chat=${row.chat_id}: ${err instanceof Error ? err.message : String(err)}`,
+      );
     }
   }
   return result;

package/src/storage/repositories/sessions-repo.ts

@@ -12,6 +12,7 @@
  * column default can hold.
  */
 
+import { logWarn } from "../../util/log.js";
 import { getDatabase, inTransaction } from "../db.js";
 import { sessionsSql } from "../sql/statements.generated.js";
 import {
@@ -46,13 +47,19 @@ type Row = {
   metrics: string | null;
 };
 
-function parseMetrics(raw: string | null): SessionMetrics {
+function parseMetrics(raw: string | null, chatId: string): SessionMetrics {
   if (!raw) return emptyMetrics();
   try {
     // Normalise at the load boundary: backfills partial blobs and restores
     // the Infinity minMs sentinel that JSON round-trips as null.
     return normaliseMetrics(JSON.parse(raw));
-  } catch {
+  } catch (err) {
+    // Degrade to empty — and say so, since the next upsert overwrites
+    // the corrupt blob and the chat's lifetime counters restart at zero.
+    logWarn(
+      "sessions",
+      `Corrupt session metrics chat=${chatId} bytes=${raw.length} — resetting: ${err instanceof Error ? err.message : String(err)}`,
+    );
     return emptyMetrics();
   }
 }
@@ -78,7 +85,7 @@ function rowToSession(row: Row): SessionState {
       // NULL = no timed turn yet — the domain sentinel is Infinity.
       fastestResponseMs: row.fastest_response_ms ?? Infinity,
     },
-    metrics: parseMetrics(row.metrics),
+    metrics: parseMetrics(row.metrics, row.chat_id),
     lastBotMessageId: row.last_bot_message_id ?? undefined,
     sessionName: row.session_name ?? undefined,
     lastModel: row.last_model ?? undefined,

package/src/storage/scripts.ts

@@ -17,8 +17,10 @@
  */
 
 import { randomUUID } from "node:crypto";
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
 import { dirname, resolve } from "node:path";
+import writeFileAtomic from "write-file-atomic";
+import { logWarn } from "../util/log.js";
 import { dirs } from "../util/paths.js";
 import * as repo from "./repositories/scripts-repo.js";
 
@@ -93,8 +95,9 @@ function writeScriptFile(
 ): string {
   const path = scriptFilePath(name, lang);
   mkdirSync(dirname(path), { recursive: true });
-  // 0o700: only the user running Talon should be able to read/exec scripts
-  writeFileSync(path, body, { encoding: "utf-8", mode: 0o700 });
+  // 0o700: only the user running Talon should be able to read/exec scripts.
+  // Atomic: a failed replace (ENOSPC) must keep the previous body.
+  writeFileAtomic.sync(path, body, { encoding: "utf-8", mode: 0o700 });
   return path;
 }
 
@@ -117,11 +120,7 @@ export function saveScript(input: {
 }): Script {
   const existing = repo.getByName(input.name);
   if (existing && existing.language !== input.language) {
-    try {
-      rmSync(existing.scriptPath, { force: true });
-    } catch {
-      /* best effort */
-    }
+    removeScriptFile(existing.scriptPath, input.name);
   }
   const scriptPath = writeScriptFile(input.name, input.language, input.script);
   const now = Date.now();
@@ -153,15 +152,27 @@ export function recordScriptUse(name: string): void {
 }
 
 /** Delete a script and best-effort clean up its on-disk file. */
+/**
+ * Best-effort unlink. `force` already absorbs a missing file, so any
+ * throw here is a real fault (permissions, a directory in the way) that
+ * leaves an orphan script on disk.
+ */
+function removeScriptFile(path: string, name: string): void {
+  try {
+    rmSync(path, { force: true });
+  } catch (err) {
+    logWarn(
+      "scripts",
+      `Could not remove script file name=${name} path=${path}: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
 export function deleteScript(name: string): boolean {
   const script = repo.getByName(name);
   if (!script) return false;
   repo.removeByName(name);
-  try {
-    rmSync(script.scriptPath, { force: true });
-  } catch {
-    /* best effort */
-  }
+  removeScriptFile(script.scriptPath, name);
   return true;
 }
 

package/src/storage/sessions.ts

@@ -22,6 +22,7 @@ import { log, logError } from "../util/log.js";
 import { recordError } from "../util/watchdog.js";
 import { files } from "../util/paths.js";
 import { importLegacyJson } from "./legacy-import.js";
+import { dbErrorFields } from "./db.js";
 import * as repo from "./repositories/sessions-repo.js";
 
 export type {
@@ -204,7 +205,11 @@ function persist(chatId: string, session: SessionState): void {
   try {
     repo.upsert(chatId, session);
   } catch (err) {
-    logError("sessions", "Failed to persist sessions", err);
+    logError(
+      "sessions",
+      `Failed to persist sessions chat=${chatId}${dbErrorFields(err)}`,
+      err,
+    );
     recordError(
       `Session save failed: ${err instanceof Error ? err.message : err}`,
     );
@@ -518,7 +523,11 @@ function removeSessionRow(chatId: string): void {
   try {
     repo.remove(chatId);
   } catch (err) {
-    logError("sessions", "Failed to delete session row", err);
+    logError(
+      "sessions",
+      `Failed to delete session row chat=${chatId}${dbErrorFields(err)}`,
+      err,
+    );
     recordError(
       `Session delete failed: ${err instanceof Error ? err.message : err}`,
     );

package/src/storage/skills.ts

@@ -26,7 +26,9 @@ import {
   writeFileSync,
 } from "node:fs";
 import { basename, resolve } from "node:path";
+import writeFileAtomic from "write-file-atomic";
 import { parseDocument, stringify } from "yaml";
+import { logWarn } from "../util/log.js";
 import { dirs } from "../util/paths.js";
 
 export type Skill = {
@@ -123,6 +125,13 @@ function serializeSkill(input: {
   return ["---", yaml, "---", "", input.body.trimEnd(), ""].join("\n");
 }
 
+/**
+ * Frontmatter errors already reported, keyed by path + message: skills
+ * are re-read for every prompt, so a broken SKILL.md warns once, not
+ * once per turn.
+ */
+const reportedFrontmatterErrors = new Set<string>();
+
 function parseSkill(
   path: string,
   raw: string,
@@ -161,7 +170,15 @@ function parseSkill(
     if (value && typeof value === "object") {
       parsed = value as Record<string, unknown>;
     }
-  } catch {
+  } catch (err) {
+    // The skill still loads (name falls back to its directory, no
+    // description) — which is exactly why the reason must be visible.
+    const msg = err instanceof Error ? err.message : String(err);
+    const key = `${path}\0${msg}`;
+    if (!reportedFrontmatterErrors.has(key)) {
+      reportedFrontmatterErrors.add(key);
+      logWarn("skills", `Unparseable frontmatter in ${path}: ${msg}`);
+    }
     parsed = {};
   }
 
@@ -216,7 +233,9 @@ export function saveSkill(input: {
   mkdirSync(dir, { recursive: true });
   const path = skillFilePath(input.name);
   const content = serializeSkill(input);
-  writeFileSync(path, content, { encoding: "utf-8", mode: 0o600 });
+  // Atomic: a failed replace (ENOSPC) must keep the previous SKILL.md,
+  // not leave a truncated one.
+  writeFileAtomic.sync(path, content, { encoding: "utf-8", mode: 0o600 });
   return readSkill(input.name)!;
 }