From f2e0ac1867d3cdb49f69f6620f25b614d9a30035 Mon Sep 17 00:00:00 2001
From: Prateek <karnalprateek@gmail.com>
Date: Sat, 14 Feb 2026 06:30:13 +0530
Subject: [PATCH] fix: filter invalid session IDs in listMetadata to prevent
 downstream crashes

listMetadata() now validates filenames against VALID_SESSION_ID regex
before returning them, preventing readMetadataRaw() from throwing on
unexpected files in the sessions directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 packages/core/src/metadata.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/core/src/metadata.ts b/packages/core/src/metadata.ts
index da804fe39..f423497c5 100644
--- a/packages/core/src/metadata.ts
+++ b/packages/core/src/metadata.ts
@@ -192,6 +192,7 @@ export function listMetadata(dataDir: string): SessionId[] {
 
   return readdirSync(dir).filter((name) => {
     if (name === "archive" || name.startsWith(".")) return false;
+    if (!VALID_SESSION_ID.test(name)) return false;
     try {
       return statSync(join(dir, name)).isFile();
     } catch {