@cjhyy/code-shell-core 0.8.9 → 0.8.11

package/dist/settings/manager.js

@@ -3,14 +3,14 @@
  *
  * Priority: CLI flags > local > project > user > managed
  */
-import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, copyFileSync, } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, } from "node:fs";
 import { join, dirname, extname } from "node:path";
 import { homedir } from "node:os";
 import { parse as parseYaml } from "yaml";
 import { validateSettings } from "./schema.js";
 import { migrateModels } from "../migrate-models.js";
 import { migrateConfig, CONFIG_VERSION_KEY } from "./migrate-config.js";
-import { acquireFileLock } from "../utils/file-mutex.js";
+import { acquireFileLock, writeFileAtomic } from "../utils/file-mutex.js";
 /**
  * Resolve the user's home directory. Prefers `process.env.HOME` so that
  * runtime env overrides (set after process start, e.g. in tests) actually
@@ -52,6 +52,7 @@ export function isProtectedSettingKey(key) {
     return PROTECTED_SETTING_ROOTS.has(root);
 }
 const FORBIDDEN_SETTING_KEY_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+const MAX_SETTINGS_FILE_BYTES = 4 * 1024 * 1024;
 function isForbiddenSettingKeySegment(key) {
     return FORBIDDEN_SETTING_KEY_SEGMENTS.has(key);
 }
@@ -205,9 +206,13 @@ export class SettingsManager {
         }
         if (readProject) {
             // 3. Project
-            this.loadJsonFile(join(this.cwd, ".code-shell", "settings.json"), "project", 2);
+            const projectPath = this.tryProjectSettingsPath(this.cwd, "settings.json");
+            if (projectPath)
+                this.loadJsonFile(projectPath, "project", 2);
             // 4. Local
-            this.loadJsonFile(join(this.cwd, ".code-shell", "settings.local.json"), "local", 3);
+            const localPath = this.tryProjectSettingsPath(this.cwd, "settings.local.json");
+            if (localPath)
+                this.loadJsonFile(localPath, "local", 3);
         }
         // 5. CLI flags (highest priority)
         if (flagOverrides && Object.keys(flagOverrides).length > 0) {
@@ -225,7 +230,9 @@ export class SettingsManager {
             this.applyConfigMigration(join(this.userConfigDir(), "settings.json"), "user");
         }
         if (readProject) {
-            this.applyConfigMigration(join(this.cwd, ".code-shell", "settings.json"), "project");
+            const projectPath = this.tryProjectSettingsPath(this.cwd, "settings.json");
+            if (projectPath)
+                this.applyConfigMigration(projectPath, "project");
         }
         // Workspace-trust gate: an untrusted project must not influence execution
         // through dangerous fields committed into its own .code-shell/settings.*.
@@ -250,15 +257,17 @@ export class SettingsManager {
         // single physical file. Gated on readUser: under non-full scope we must
         // not read — let alone rewrite — the host's ~/.code-shell/settings.json.
         const userPath = join(this.userConfigDir(), "settings.json");
-        if (readUser && existsSync(userPath)) {
+        if (readUser && resolveConfigPath(userPath) === userPath) {
             try {
-                const userRaw = sanitizeSettingsObject(JSON.parse(readFileSync(userPath, "utf-8")));
+                const userRaw = parseConfigFile(userPath);
+                if (!userRaw)
+                    throw new Error("invalid user settings");
                 const result = migrateModels({
                     providers: userRaw.providers ?? [],
                     models: userRaw.models ?? [],
                 });
                 if (result.changed) {
-                    copyFileSync(userPath, `${userPath}.bak`);
+                    this.writeBackup(userPath);
                     const migrated = {
                         ...userRaw,
                         providers: result.providers,
@@ -295,10 +304,10 @@ export class SettingsManager {
      * so this load() already sees the migrated shape.
      */
     applyConfigMigration(path, sourceName) {
-        if (!existsSync(path))
+        if (resolveConfigPath(path) !== path)
             return;
         try {
-            const parsed = JSON.parse(readFileSync(path, "utf-8"));
+            const parsed = parseConfigFile(path);
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
                 return;
             const raw = sanitizeSettingsObject(parsed);
@@ -313,7 +322,7 @@ export class SettingsManager {
             };
             if (JSON.stringify(stripStamp(raw)) === JSON.stringify(stripStamp(result.config)))
                 return;
-            copyFileSync(path, `${path}.bak`);
+            this.writeBackup(path);
             // Atomic write (tmp+rename) so a concurrent load can't read a half-written
             // migrated file — matches the normal save path (atomicWriteJson). The file
             // exists here (existsSync guard above), so the recursive mkdir is a no-op.
@@ -351,34 +360,20 @@ export class SettingsManager {
      */
     saveUserSetting(key, value) {
         const path = join(this.userConfigDir(), "settings.json");
-        mkdirSync(dirname(path), { recursive: true });
+        assertSafeSettingsWriteTarget(path);
         // Lock spans read → modify → write; see mutateSettingsFile for why the
         // atomic rename alone was not enough. This path keeps its own sanitizing
         // read (readJsonObject does not sanitize) so behaviour is unchanged apart
         // from the added serialization.
         const release = acquireFileLock(path);
         try {
-            let current = {};
-            if (existsSync(path)) {
-                try {
-                    const raw = readFileSync(path, "utf-8");
-                    const parsed = JSON.parse(raw);
-                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                        current = sanitizeSettingsObject(parsed);
-                    }
-                }
-                catch {
-                    // Corrupt file — overwrite rather than crash.
-                }
-            }
+            const current = parseConfigFile(path) ?? {};
             setDottedSetting(current, key, value);
             // Atomic write: stage to .tmp, then rename, so a concurrent read can't
             // catch a half-written file. mode 0o600 — settings.json can hold plaintext
             // API keys, so it must be owner-only like credentials.json (store.ts:56),
             // not world-readable (default umask leaves 0o644 otherwise).
-            const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-            writeFileSync(tmp, JSON.stringify(current, null, 2), { encoding: "utf-8", mode: 0o600 });
-            renameSync(tmp, path);
+            this.atomicWriteJson(path, current);
         }
         finally {
             release();
@@ -392,14 +387,31 @@ export class SettingsManager {
      * cache invalidation mirror saveUserSetting.
      */
     saveProjectSetting(key, value, cwd) {
-        // projectSettingsPath throws on an empty cwd (boundary guard) — keep that.
-        const path = this.projectSettingsPath(cwd);
+        this.validateProjectCwd(cwd, "project");
         // Don't resurrect a deleted project root: atomicWriteJson's recursive mkdir
         // of <cwd>/.code-shell recreates `cwd` itself as an empty shell when cwd is
         // gone. A non-empty cwd that no longer exists means the project was deleted
         // — skip the write rather than recreate it.
         if (!existsSync(cwd))
             return;
+        const path = this.projectSettingsPath(cwd);
+        this.mutateSettingsFile(path, (current) => {
+            setDottedSetting(current, key, value);
+        });
+        this.invalidate();
+    }
+    /**
+     * Persist a machine-private setting for one project. The local layer has
+     * higher precedence than the shared project layer and lives at
+     * `${cwd}/.code-shell/settings.local.json`, matching the file already read
+     * by {@link load}. It is useful for MCP endpoints or policy that should not
+     * be shared with collaborators.
+     */
+    saveLocalSetting(key, value, cwd) {
+        this.validateProjectCwd(cwd, "local");
+        if (!existsSync(cwd))
+            return;
+        const path = this.localSettingsPath(cwd);
         this.mutateSettingsFile(path, (current) => {
             setDottedSetting(current, key, value);
         });
@@ -412,6 +424,19 @@ export class SettingsManager {
      */
     deleteProjectSetting(key, cwd) {
         const path = this.projectSettingsPath(cwd);
+        this.deleteSettingFromFile(path, key);
+    }
+    /** Delete one dotted key from the machine-private project settings layer. */
+    deleteLocalSetting(key, cwd) {
+        const path = this.localSettingsPath(cwd);
+        this.deleteSettingFromFile(path, key);
+    }
+    /** Delete one dotted key from the user settings layer. */
+    deleteUserSetting(key) {
+        const path = join(this.userConfigDir(), "settings.json");
+        this.deleteSettingFromFile(path, key);
+    }
+    deleteSettingFromFile(path, key) {
         // Must be YAML-aware, symmetric with saveProjectSetting: a project with only
         // settings.yaml has no .json, so the old `existsSync(path)` guard returned
         // here and the override survived (read/merge ARE yaml-aware → UI shows
@@ -442,13 +467,18 @@ export class SettingsManager {
      * overlay math needs the project overlay and the user/global baseline
      * separately — the merged get() collapses provenance and can't express
      * tri-state inheritance. user → ~/.code-shell/settings.json, project →
-     * ${cwd}/.code-shell/settings.json. Only keys actually present in the file
-     * are returned (defaults are not synthesized), so an absent file → {}.
+     * ${cwd}/.code-shell/settings.json, local →
+     * ${cwd}/.code-shell/settings.local.json. Only keys actually present in the
+     * file are returned (defaults are not synthesized), so an absent file → {}.
      */
     getForScope(scope, cwd) {
         const path = scope === "user"
             ? join(this.userConfigDir(), "settings.json")
-            : this.projectSettingsPath(cwd ?? this.cwd);
+            : scope === "local"
+                ? this.tryProjectSettingsPath(cwd ?? this.cwd, "settings.local.json")
+                : this.tryProjectSettingsPath(cwd ?? this.cwd, "settings.json");
+        if (!path)
+            return {};
         const raw = this.readJsonObject(path);
         // validateSettings applies defaults; for a scope view we want only the
         // file's own keys, so validate then project back the present keys.
@@ -456,21 +486,55 @@ export class SettingsManager {
         const out = {};
         for (const k of Object.keys(raw))
             out[k] = validated[k];
-        // Same workspace-trust gate as load(): getForScope("project") is a direct
-        // file read that bypasses the merge, so an untrusted project's dangerous
-        // fields (e.g. localEnvironment.setupScripts — shell run at worktree setup)
-        // must be stripped here too. See DANGEROUS_PROJECT_FIELDS.
-        if (scope === "project" && !this.projectTrusted) {
+        // Same workspace-trust gate as load(): project/local scope reads bypass the
+        // merge, so an untrusted project's dangerous fields (for example an MCP
+        // server or setup script) must be stripped here too.
+        if ((scope === "project" || scope === "local") && !this.projectTrusted) {
             for (const field of DANGEROUS_PROJECT_FIELDS)
                 delete out[field];
         }
         return out;
     }
     projectSettingsPath(cwd) {
+        const path = this.tryProjectSettingsPath(cwd, "settings.json", true);
+        if (!path)
+            throw new Error("unsafe project settings directory");
+        return path;
+    }
+    localSettingsPath(cwd) {
+        const path = this.tryProjectSettingsPath(cwd, "settings.local.json", true);
+        if (!path)
+            throw new Error("unsafe local settings directory");
+        return path;
+    }
+    validateProjectCwd(cwd, layer) {
         if (!cwd || cwd.trim().length === 0) {
-            throw new Error("project setting write requires a non-empty cwd");
+            throw new Error(`${layer} setting write requires a non-empty cwd`);
+        }
+    }
+    /** Resolve the project root once and refuse a linked/non-directory state root. */
+    tryProjectSettingsPath(cwd, filename, strict = false) {
+        this.validateProjectCwd(cwd, filename === "settings.json" ? "project" : "local");
+        if (!existsSync(cwd))
+            return join(cwd, ".code-shell", filename);
+        try {
+            const root = realpathSync(cwd);
+            if (!lstatSync(root).isDirectory())
+                throw new Error("project root is not a directory");
+            const stateDir = join(root, ".code-shell");
+            if (existsSync(stateDir)) {
+                const info = lstatSync(stateDir);
+                if (info.isSymbolicLink() || !info.isDirectory()) {
+                    throw new Error("project .code-shell must be a real directory");
+                }
+            }
+            return join(stateDir, filename);
+        }
+        catch (error) {
+            if (strict)
+                throw error;
+            return null;
         }
-        return join(cwd, ".code-shell", "settings.json");
     }
     readJsonObject(path) {
         // Resolve to a sibling .yaml/.yml when the .json layer is absent so
@@ -481,12 +545,22 @@ export class SettingsManager {
         return parseConfigFile(resolved) ?? {};
     }
     atomicWriteJson(path, data) {
-        mkdirSync(dirname(path), { recursive: true });
+        assertSafeSettingsWriteTarget(path);
+        const serialized = JSON.stringify(data, null, 2);
+        if (Buffer.byteLength(serialized, "utf8") > MAX_SETTINGS_FILE_BYTES) {
+            throw new Error(`settings file exceeds ${MAX_SETTINGS_FILE_BYTES} bytes`);
+        }
         // mode 0o600: settings.json may hold plaintext API keys — owner-only, see
         // saveUserSetting above and credentials/store.ts.
-        const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-        writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
-        renameSync(tmp, path);
+        writeFileAtomic(path, serialized, 0o600);
+    }
+    writeBackup(path) {
+        const content = readBoundedRegularFile(path);
+        if (content === null)
+            throw new Error("settings backup source is unsafe");
+        const backupPath = `${path}.bak`;
+        assertSafeSettingsWriteTarget(backupPath);
+        writeFileAtomic(backupPath, content, 0o600);
     }
     /**
      * Read-modify-write a settings file under a cross-process lock.
@@ -506,9 +580,10 @@ export class SettingsManager {
      * mutates it in place; returning false skips the write.
      */
     mutateSettingsFile(path, mutate) {
-        mkdirSync(dirname(path), { recursive: true });
+        assertSafeSettingsWriteTarget(path);
         const release = acquireFileLock(path);
         try {
+            assertSafeSettingsWriteTarget(path);
             // Re-read INSIDE the lock: a snapshot taken before acquiring it would be
             // exactly the stale value that drops the other writer's key.
             const current = this.readJsonObject(path);
@@ -577,10 +652,10 @@ export class SettingsManager {
  * what an absent/empty layer means.
  */
 function parseConfigFile(path) {
-    if (!existsSync(path))
-        return null;
     try {
-        const content = readFileSync(path, "utf-8");
+        const content = readBoundedRegularFile(path);
+        if (content === null)
+            return null;
         const ext = extname(path).toLowerCase();
         const parsed = ext === ".yaml" || ext === ".yml" ? parseYaml(content) : JSON.parse(content);
         if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
@@ -592,6 +667,49 @@ function parseConfigFile(path) {
     }
     return null;
 }
+/** Read through a no-follow descriptor so a settings-file symlink cannot escape its layer. */
+function readBoundedRegularFile(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const info = fstatSync(fd);
+        if (!info.isFile() || info.size > MAX_SETTINGS_FILE_BYTES)
+            return null;
+        return readFileSync(fd, "utf8");
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Writers must never follow a linked settings directory or replace an unusual
+ * filesystem object. Atomic rename protects the file contents, but without
+ * this boundary check a project-controlled `.code-shell` directory symlink
+ * redirects the entire write outside the workspace.
+ */
+function assertSafeSettingsWriteTarget(path) {
+    const parent = dirname(path);
+    if (!existsSync(parent))
+        mkdirSync(parent, { recursive: true });
+    const parentInfo = lstatSync(parent);
+    if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+        throw new Error("settings directory must be a real directory");
+    }
+    try {
+        const targetInfo = lstatSync(path);
+        if (targetInfo.isSymbolicLink() || !targetInfo.isFile()) {
+            throw new Error("settings target must be a regular file");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
 /**
  * Given the JSON path for a settings layer (e.g. .../settings.json or
  * .../settings.local.json), return the path that should actually be read:
@@ -600,16 +718,33 @@ function parseConfigFile(path) {
  * hand-written read-only alternative. Returns null when no layer file exists.
  */
 function resolveConfigPath(jsonPath) {
-    if (existsSync(jsonPath))
+    const jsonStatus = configCandidateStatus(jsonPath);
+    if (jsonStatus === "safe")
         return jsonPath;
+    if (jsonStatus === "unsafe")
+        return null;
     const base = jsonPath.replace(/\.json$/, "");
     for (const ext of [".yaml", ".yml"]) {
         const candidate = `${base}${ext}`;
-        if (existsSync(candidate))
+        const status = configCandidateStatus(candidate);
+        if (status === "safe")
             return candidate;
+        if (status === "unsafe")
+            return null;
     }
     return null;
 }
+function configCandidateStatus(path) {
+    try {
+        const info = lstatSync(path);
+        return !info.isSymbolicLink() && info.isFile() && info.size <= MAX_SETTINGS_FILE_BYTES
+            ? "safe"
+            : "unsafe";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "missing" : "unsafe";
+    }
+}
 function merge(base, override) {
     const result = {};
     for (const [key, value] of Object.entries(base)) {

package/dist/settings/schema.d.ts

@@ -681,7 +681,7 @@ export declare const SettingsSchema: z.ZodObject<{
      */
     sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sourceId: z.ZodString;
-        scopes: z.ZodArray<z.ZodString, "many">;
+        scopes: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
         readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
         sourceId: string;
@@ -1705,7 +1705,7 @@ export declare const SettingsSchema: z.ZodObject<{
      */
     sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sourceId: z.ZodString;
-        scopes: z.ZodArray<z.ZodString, "many">;
+        scopes: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
         readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
         sourceId: string;
@@ -2729,7 +2729,7 @@ export declare const SettingsSchema: z.ZodObject<{
      */
     sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sourceId: z.ZodString;
-        scopes: z.ZodArray<z.ZodString, "many">;
+        scopes: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
         readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
     }, "strip", z.ZodTypeAny, {
         sourceId: string;

package/dist/sources/adapters/local-files.js

@@ -3,7 +3,7 @@
  * 文件在 ${cwd}/.code-shell/uploads/ 内；读取前规范化 resourceId，
  * 并校验消解 symlink 后的真实路径仍在 uploads 目录内。
  */
-import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { truncateUtf8Bytes } from "../truncate-utf8.js";
 export const LOCAL_FILES_SOURCE_ID = "project-uploads";
@@ -76,9 +76,32 @@ function canonicalResourceId(resourceId) {
     return canonical.split(sep).join("/");
 }
 function resolveInsideUploads(cwd, resourceId) {
-    const root = realpathSync(uploadsDir(cwd));
+    const workspace = realpathSync(resolve(cwd));
+    const stateDir = join(workspace, ".code-shell");
+    const stateInfo = lstatSync(stateDir);
+    if (stateInfo.isSymbolicLink() || !stateInfo.isDirectory()) {
+        throw new Error("project state directory must be a regular directory");
+    }
+    const stateReal = realpathSync(stateDir);
+    if (relative(workspace, stateReal).startsWith(`..${sep}`) || relative(workspace, stateReal) === "..") {
+        throw new Error("project state directory escapes cwd");
+    }
+    const uploadPath = join(stateReal, "uploads");
+    const uploadInfo = lstatSync(uploadPath);
+    if (uploadInfo.isSymbolicLink() || !uploadInfo.isDirectory()) {
+        throw new Error("uploads directory must be a regular directory");
+    }
+    const root = realpathSync(uploadPath);
+    const uploadRel = relative(stateReal, root);
+    if (uploadRel === ".." || uploadRel.startsWith(`..${sep}`) || isAbsolute(uploadRel)) {
+        throw new Error("uploads directory escapes cwd");
+    }
     const canonicalId = canonicalResourceId(resourceId);
     const candidate = resolve(root, ...canonicalId.split("/"));
+    const candidateInfo = lstatSync(candidate);
+    if (candidateInfo.isSymbolicLink() || !candidateInfo.isFile()) {
+        throw new Error(`resource escapes uploads or is not a regular file: ${resourceId}`);
+    }
     const real = realpathSync(candidate);
     if (real !== root && !real.startsWith(`${root}${sep}`)) {
         throw new Error(`resource escapes uploads dir: ${resourceId}`);
@@ -115,13 +138,35 @@ export function listLocalFiles(cwd) {
     const directory = uploadsDir(cwd);
     if (!existsSync(directory))
         return [];
-    return readdirSync(directory, { withFileTypes: true })
+    let workspace;
+    let directoryReal;
+    try {
+        workspace = realpathSync(resolve(cwd));
+        const stateDir = join(workspace, ".code-shell");
+        const stateInfo = lstatSync(stateDir);
+        const directoryInfo = lstatSync(directory);
+        if (stateInfo.isSymbolicLink() ||
+            !stateInfo.isDirectory() ||
+            directoryInfo.isSymbolicLink() ||
+            !directoryInfo.isDirectory()) {
+            return [];
+        }
+        directoryReal = realpathSync(directory);
+        const rel = relative(workspace, directoryReal);
+        if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            return [];
+    }
+    catch {
+        return [];
+    }
+    return readdirSync(directoryReal, { withFileTypes: true })
         .filter((entry) => entry.isFile())
+        .slice(0, 10_000)
         .sort((left, right) => left.name.localeCompare(right.name))
         .map((entry) => ({
         id: entry.name,
         scopeId: "uploads",
         name: entry.name,
-        sizeBytes: statSync(join(directory, entry.name)).size,
+        sizeBytes: statSync(join(directoryReal, entry.name)).size,
     }));
 }

package/dist/sources/catalog.js

@@ -1,25 +1,39 @@
 /** 全局数据源目录：codeShellHome()/sources.json。损坏条目隔离，原子写。 */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { logger } from "../logging/logger.js";
 import { codeShellHome } from "../session/session-manager.js";
+import { mutateJsonFile } from "../utils/file-mutex.js";
 import { SourceDefinitionSchema } from "./types.js";
+const MAX_CATALOG_BYTES = 4 * 1024 * 1024;
+const MAX_CATALOG_SOURCES = 1_000;
+const MAX_SOURCE_DEFINITION_BYTES = 1024 * 1024;
 export function sourceCatalogPath() {
     return join(codeShellHome(), "sources.json");
 }
-function load() {
-    const path = sourceCatalogPath();
-    if (!existsSync(path))
+function parseCatalog(rawText) {
+    if (rawText === undefined)
+        return [];
+    if (Buffer.byteLength(rawText, "utf8") > MAX_CATALOG_BYTES)
         return [];
     try {
-        const raw = JSON.parse(readFileSync(path, "utf-8"));
+        const raw = JSON.parse(rawText);
         if (raw.version !== 1 || !Array.isArray(raw.sources))
             return [];
-        const sources = [];
-        for (const entry of raw.sources) {
+        const sources = new Map();
+        for (const entry of raw.sources.slice(0, MAX_CATALOG_SOURCES)) {
             const parsed = SourceDefinitionSchema.safeParse(entry);
             if (parsed.success) {
-                sources.push(parsed.data);
+                let encoded;
+                try {
+                    encoded = JSON.stringify(parsed.data);
+                }
+                catch {
+                    continue;
+                }
+                if (Buffer.byteLength(encoded, "utf8") <= MAX_SOURCE_DEFINITION_BYTES) {
+                    sources.set(parsed.data.id, parsed.data);
+                }
             }
             else {
                 logger.warn("sources.catalog_entry_invalid", {
@@ -28,7 +42,7 @@ function load() {
                 });
             }
         }
-        return sources;
+        return [...sources.values()];
     }
     catch (error) {
         logger.warn("sources.catalog_unreadable", {
@@ -38,15 +52,32 @@ function load() {
         return [];
     }
 }
-function persist(sources) {
+function load() {
     const path = sourceCatalogPath();
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify({ version: 1, sources }, null, 2)}\n`, {
-        encoding: "utf-8",
+    if (!existsSync(path))
+        return [];
+    try {
+        const info = lstatSync(path);
+        if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_CATALOG_BYTES)
+            return [];
+        return parseCatalog(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return [];
+    }
+}
+function mutateCatalog(mutation) {
+    const path = sourceCatalogPath();
+    const directory = dirname(path);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        chmodSync(directory, 0o700);
+    mutateJsonFile(path, {
+        parse: parseCatalog,
+        serialize: (sources) => `${JSON.stringify({ version: 1, sources }, null, 2)}\n`,
+        mutation: (current) => ({ value: mutation(current) }),
         mode: 0o600,
     });
-    renameSync(tmp, path);
 }
 export function listSourceDefinitions() {
     return load().sort((a, b) => a.id.localeCompare(b.id));
@@ -56,9 +87,24 @@ export function readSourceDefinition(id) {
 }
 export function saveSourceDefinition(definition) {
     const parsed = SourceDefinitionSchema.parse(definition);
-    const rest = load().filter((source) => source.id !== parsed.id);
-    persist([...rest, parsed]);
+    let encoded;
+    try {
+        encoded = JSON.stringify(parsed);
+    }
+    catch {
+        throw new Error("source definition must be JSON-serializable");
+    }
+    if (Buffer.byteLength(encoded, "utf8") > MAX_SOURCE_DEFINITION_BYTES) {
+        throw new Error("source definition exceeds the size limit");
+    }
+    mutateCatalog((current) => {
+        const rest = current.filter((source) => source.id !== parsed.id);
+        if (rest.length >= MAX_CATALOG_SOURCES)
+            throw new Error("source catalog is full");
+        return [...rest, parsed];
+    });
 }
 export function deleteSourceDefinition(id) {
-    persist(load().filter((source) => source.id !== id));
+    SourceDefinitionSchema.shape.id.parse(id);
+    mutateCatalog((current) => current.filter((source) => source.id !== id));
 }

package/dist/sources/types.d.ts

@@ -10,8 +10,8 @@ export type SourceKind = (typeof SOURCE_KINDS)[number];
 export declare const SourceDefinitionSchema: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodEnum<["mock", "mcp-resource", "local-files"]>;
-    label: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
+    label: z.ZodEffects<z.ZodString, string, string>;
+    description: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /** 按 kind 的 adapter 配置（如 mcp-resource: { server }）。 */
     adapterConfig: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     /** 指向全局 CredentialStore 的 id；local-files/mock 不需要。 */
@@ -38,7 +38,7 @@ export type SourceDefinition = z.infer<typeof SourceDefinitionSchema>;
 export declare const WorkspaceSourceBindingSchema: z.ZodObject<{
     sourceId: z.ZodString;
     /** 显式勾选的 scope id；空数组 = 什么都不可见（不是"全部"）。 */
-    scopes: z.ZodArray<z.ZodString, "many">;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
     /** ask（默认，ReadSource 每次审批）| deny（只许 list metadata，禁读内容）。无 allow 档（ADR §1.2）。 */
     readPolicy: z.ZodDefault<z.ZodEnum<["ask", "deny"]>>;
 }, "strip", z.ZodTypeAny, {