fix(core): normalise the plugin session.list limit before the store (#951)

packages/core/src/plugin/host.ts

@@ -41,6 +41,7 @@ import { PluginVcsBranchList } from "./vcs/branch-list.js"
 import {
   decodeSessionListCursor,
   encodeSessionListCursor,
+  sessionListLimit,
   type DecodedSessionListCursor,
   type SessionListFilter,
   type SessionListInput,
@@ -743,7 +744,7 @@ function sessionListInput(
   anchor?: Session.ListAnchor,
 ): Session.ListInput {
   const { directory, project, subpath, ...rest } = filter
-  const bounded = limit
+  const bounded = sessionListLimit(limit)
   // The store applies every present scope condition; keep them all instead of picking one.
   if (directory !== undefined && project !== undefined)
     return { ...rest, directory, project, subpath, limit: bounded, anchor } as Session.ListInput

packages/core/src/plugin/session-list.ts

@@ -21,6 +21,28 @@ export interface DecodedSessionListCursor extends SessionListFilter {
   readonly anchor: Session.ListAnchor
 }
 
+/**
+ * Page the plugin `session.list` surface returns when the plugin supplies no
+ * usable limit. Mirrors the HTTP `session.list` handler
+ * (`packages/server/src/handlers/session.ts`), which applies
+ * `limit ?? DefaultSessionsLimit`.
+ */
+export const DEFAULT_SESSION_LIMIT = 50
+
+/**
+ * `Session.list` reaches the store's `limit` through `PositiveInt`, so a plugin
+ * supplied limit is normalised before it gets there: a missing or non-finite
+ * value becomes the default page, and zero, negative or fractional values are
+ * clamped to a positive integer instead of widening the query to every session
+ * (SQLite treats a negative LIMIT as unlimited) or failing it as an opaque
+ * store defect. Unlike `branchListLimit` there is no upper bound — the HTTP
+ * surface applies none, so a positive integer passes through unchanged.
+ */
+export function sessionListLimit(limit?: number): number {
+  if (limit === undefined || !Number.isFinite(limit)) return DEFAULT_SESSION_LIMIT
+  return Math.max(Math.trunc(limit), 1)
+}
+
 export type SessionListOutput = Effect.Success<ReturnType<Plugin.Context["session"]["list"]>>
 export type SessionListInput = NonNullable<Parameters<Plugin.Context["session"]["list"]>[0]>
 export type SessionListCursor = NonNullable<SessionListOutput["cursor"]["previous"]>

packages/core/test/plugin/session-list.test.ts

@@ -62,3 +62,32 @@ it.live("Promise plugins read serverUrl and list child sessions", () =>
     }
   }),
 )
+
+it.live("Plugin session.list normalises an unusable limit before the store", () =>
+  Effect.gen(function* () {
+    const plugins = yield* Plugin.Service
+    const context = yield* PluginHost.make(plugins)
+    for (const title of ["Plugin limit a", "Plugin limit b", "Plugin limit c"]) {
+      yield* context.session.create({ title })
+    }
+
+    const all = yield* context.session.list({ parentID: null })
+    expect(all.data.length).toBeGreaterThanOrEqual(3)
+
+    // SQLite reads a negative LIMIT as "unlimited": it must clamp to a positive page.
+    const negative = yield* context.session.list({ parentID: null, limit: -5 })
+    expect(negative.data).toHaveLength(1)
+
+    // Zero is not a page size either; it clamps to the same positive minimum.
+    const zero = yield* context.session.list({ parentID: null, limit: 0 })
+    expect(zero.data).toHaveLength(1)
+
+    // A fractional limit used to reach the store as-is and defect; it floors.
+    const fractional = yield* context.session.list({ parentID: null, limit: 2.5 })
+    expect(fractional.data).toHaveLength(2)
+
+    // A non-finite limit falls back to the default page instead of defecting.
+    const nan = yield* context.session.list({ parentID: null, limit: Number.NaN })
+    expect(nan.data).toHaveLength(all.data.length)
+  }),
+)