core: wrap each event handler in catch_unwind so one panicking command can't take the whole single-threaded server down

src/ircd.rs

@@ -112,9 +112,25 @@ impl Ircd {
         }
     }
 
-    /// Run until the event channel closes (i.e. the listener is gone).
+    /// Run until the event channel closes (i.e. the listener is gone). Each event is
+    /// handled inside `catch_unwind`: a panic in one command's handler is logged and
+    /// the loop carries on, instead of the panic taking the whole single-threaded
+    /// server down with it. State touched before the panic may be left inconsistent,
+    /// so this is a last-resort safety net, not a licence to panic — the untrusted
+    /// parsers are still written so they can't panic in the first place.
     pub fn run(mut self, rx: Receiver<Event>) {
         for ev in rx {
+            if std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.handle_event(ev)))
+                .is_err()
+            {
+                // the default panic hook already logged the details to stderr
+                eprintln!("[core] recovered from a panicking event handler; continuing");
+            }
+        }
+    }
+
+    /// Dispatch one event, then drain any hooks it queued.
+    fn handle_event(&mut self, ev: Event) {
         match ev {
             Event::Connect {
                 uid,
@@ -202,7 +218,6 @@ impl Ircd {
         }
         self.drain_hooks();
     }
-    }
 
     fn on_line(&mut self, uid: Uid, line: &str) {
         let Some(msg) = message::parse(line) else {