fix(sessions): validate long-poll window

apps/pwa/src/routes/sessions.mjs

@@ -29,7 +29,16 @@ const STALE_MS = 90 * 1000;
 const SCROLLBACK = 400;
 // How long a CLI poll parks waiting for a command. Overridable so tests don't
 // have to sit through a real one.
-const LONG_POLL_MS = Number(process.env.SESSION_POLL_MS || 25 * 1000);
+const DEFAULT_LONG_POLL_MS = 25 * 1000;
+export function readLongPollMs(value = process.env.SESSION_POLL_MS) {
+  const raw = String(value ?? "").trim();
+  if (!/^\d+$/.test(raw)) return DEFAULT_LONG_POLL_MS;
+  const ms = Number(raw);
+  return Number.isSafeInteger(ms) && ms > 0 && ms <= 2_147_483_647
+    ? ms
+    : DEFAULT_LONG_POLL_MS;
+}
+const LONG_POLL_MS = readLongPollMs();
 
 const isLive = (s) => s.status === "live" && Date.now() - Number(s.last_seen_at) < STALE_MS;
 

apps/pwa/test/sessions.test.mjs

@@ -70,6 +70,17 @@ test.after(() => {
 
 const skip = { skip: !deps && "apps/pwa deps not installed" };
 
+test("sessions: malformed poll windows fall back instead of creating a hot loop", skip, async () => {
+  const { readLongPollMs } = await import("../src/routes/sessions.mjs");
+
+  for (const value of [null, "", "abc", "300ms", "-1", "0", "1.5", "1e3", "Infinity", "2147483648"]) {
+    assert.equal(readLongPollMs(value), 25_000, String(value));
+  }
+  assert.equal(readLongPollMs(), 300);
+  assert.equal(readLongPollMs(" 300 "), 300);
+  assert.equal(readLongPollMs("2147483647"), 2_147_483_647);
+});
+
 test("sessions: register, then output lands in the scrollback in order", skip, async () => {
   const { one, all } = await app();