From 04d3d53b383bcaa742c7a435bf8d9e7695287872 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caner=20=C3=87=C4=B1dam?= <canercidam01@gmail.com>
Date: Mon, 20 Apr 2026 23:45:38 +0200
Subject: [PATCH 1/3] remove leftover session dirs

---
 main.go | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/main.go b/main.go
index 7f2c684..8e0d94d 100644
--- a/main.go
+++ b/main.go
@@ -192,11 +192,12 @@ func shutDownCmdFunc(cmdName string) func(cmd *cobra.Command, args []string) err
 		panic("setting up shut down func for unknown cmd: " + cmdName)
 	}
 	return func(cmd *cobra.Command, args []string) error {
-		sessions := args
-		if len(sessions) == 0 {
+		if len(args) == 0 {
 			return fmt.Errorf("please specify at least one session name or 'all' to %s all sessions", cmdName)
 		}
-		if len(sessions) == 1 && sessions[0] == "all" {
+		isAll := len(args) == 1 && args[0] == "all"
+		sessions := args
+		if isAll {
 			var err error
 			sessions, err = playground.GetLocalSessions()
 			if err != nil {
@@ -209,6 +210,19 @@ func shutDownCmdFunc(cmdName string) func(cmd *cobra.Command, args []string) err
 				return err
 			}
 		}
+		if cmdName == "clean" {
+			sessionsDir, err := utils.GetSessionsDir()
+			if err != nil {
+				return err
+			}
+			if isAll {
+				_ = os.RemoveAll(sessionsDir)
+			} else {
+				for _, session := range sessions {
+					_ = os.RemoveAll(filepath.Join(sessionsDir, session))
+				}
+			}
+		}
 		return nil
 	}
 }

From c3cb3a1f046bb126da216662c4103df3915c3699 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caner=20=C3=87=C4=B1dam?= <canercidam01@gmail.com>
Date: Tue, 21 Apr 2026 15:12:09 +0200
Subject: [PATCH 2/3] simplify logic and handle errors

---
 main.go | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/main.go b/main.go
index 8e0d94d..9d84067 100644
--- a/main.go
+++ b/main.go
@@ -210,17 +210,25 @@ func shutDownCmdFunc(cmdName string) func(cmd *cobra.Command, args []string) err
 				return err
 			}
 		}
-		if cmdName == "clean" {
-			sessionsDir, err := utils.GetSessionsDir()
+		if cmdName != "clean" {
+			return nil
+		}
+		sessionsDir, err := utils.GetSessionsDir()
+		if err != nil {
+			return err
+		}
+		if isAll {
+			err = os.RemoveAll(sessionsDir)
 			if err != nil {
-				return err
+				slog.Warn("failed to remove sessions directory", "error", err)
 			}
-			if isAll {
-				_ = os.RemoveAll(sessionsDir)
-			} else {
-				for _, session := range sessions {
-					_ = os.RemoveAll(filepath.Join(sessionsDir, session))
-				}
+			return nil
+		}
+		for _, session := range sessions {
+			fullSessionDir := filepath.Join(sessionsDir, session)
+			err = os.RemoveAll(fullSessionDir)
+			if err != nil {
+				slog.Warn("failed to remove session directory", "session", fullSessionDir, "error", err)
 			}
 		}
 		return nil

From e466b632955159a2aebe0c40da5401cd70ebd6e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caner=20=C3=87=C4=B1dam?= <canercidam01@gmail.com>
Date: Tue, 21 Apr 2026 18:04:41 +0200
Subject: [PATCH 3/3] avoid accidental dir removal

---
 main.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/main.go b/main.go
index 9d84067..3a7de0c 100644
--- a/main.go
+++ b/main.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -180,6 +181,8 @@ func runValidation(recipe playground.Recipe) error {
 	return nil
 }
 
+var sessionNameRegex = regexp.MustCompile(`^[a-z0-9]+(-[a-z0-9]+)*$`)
+
 func shutDownCmdFunc(cmdName string) func(cmd *cobra.Command, args []string) error {
 	var keepResources bool
 	switch cmdName {
@@ -195,6 +198,17 @@ func shutDownCmdFunc(cmdName string) func(cmd *cobra.Command, args []string) err
 		if len(args) == 0 {
 			return fmt.Errorf("please specify at least one session name or 'all' to %s all sessions", cmdName)
 		}
+		for _, arg := range args {
+			if arg == "all" {
+				if len(args) != 1 {
+					return fmt.Errorf("'all' cannot be combined with session names")
+				}
+				continue
+			}
+			if !sessionNameRegex.MatchString(arg) {
+				return fmt.Errorf("invalid session name %q: must be lowercase letters/digits separated by hyphens (e.g., happy-dolphin)", arg)
+			}
+		}
 		isAll := len(args) == 1 && args[0] == "all"
 		sessions := args
 		if isAll {