@lmzhen/dsh-evolution-feedback 0.3.66 → 0.3.67

package/lib/index.js

@@ -86,7 +86,7 @@ var EvolutionFeedback = class EvolutionFeedback {
 			const rawEvents = await io.readText(eventsPath);
 			const archiveNames = await listEventArchives(io, eventsPath);
 			if ((rawEvents === null || rawEvents.trim() === "") && archiveNames.length === 0) {
-				const aggregate = parseAggregate(await io.readText(path));
+				const aggregate = parseAggregate(await io.readText(path), this.warn);
 				if (aggregate) try {
 					await migrateFeedbackEvents(io, eventsPath, aggregate);
 				} catch {}
@@ -293,13 +293,34 @@ async function migrateFeedbackEvents(io, eventsPath, aggregate) {
 		}, null, 2));
 	});
 }
-/** Parse a legacy aggregate (v1) or a v2 cache into a plain aggregate state. */
-function parseAggregate(raw) {
+/** Parse a legacy aggregate (v1) or a v2 cache into a plain aggregate state.
+* V24-05 (v24): every record passes the shared per-record sanitizer (same
+* validation as `parseCache` — S6.4), and migrated counts are clamped so one
+* corrupted field cannot expand into an unbounded event array at boot. */
+const MAX_MIGRATED_EVENTS_PER_RECORD = 1e4;
+function parseAggregate(raw, warn = () => {}) {
 	if (raw === null) return null;
 	try {
 		const parsed = JSON.parse(raw);
-		const skills = isRecord(parsed.skills) ? parsed.skills : void 0;
-		const sessions = isRecord(parsed.sessions) ? parsed.sessions : void 0;
+		const clamp = (count, target, field) => {
+			if (count > MAX_MIGRATED_EVENTS_PER_RECORD) {
+				warn(`evolution-feedback: migration clamps ${field}=${count} for "${target}" to ${MAX_MIGRATED_EVENTS_PER_RECORD} — the on-disk aggregate is not trustworthy at that scale`);
+				return MAX_MIGRATED_EVENTS_PER_RECORD;
+			}
+			return count;
+		};
+		const sanitizeSection = (section, kind) => {
+			if (!isRecord(section)) return void 0;
+			const cleaned = sanitizeCacheRecords(section, kind, warn);
+			for (const [target, record] of Object.entries(cleaned)) if (record.positive > MAX_MIGRATED_EVENTS_PER_RECORD || record.negative > MAX_MIGRATED_EVENTS_PER_RECORD) cleaned[target] = {
+				...record,
+				positive: clamp(record.positive, target, "positive"),
+				negative: clamp(record.negative, target, "negative")
+			};
+			return cleaned;
+		};
+		const skills = sanitizeSection(parsed.skills, "skill");
+		const sessions = sanitizeSection(parsed.sessions, "session");
 		if (!skills && !sessions) return null;
 		return {
 			skills: skills ?? {},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-feedback",
   "description": "Feedback-to-quality scoring for self-evolution (community build)",
-  "version": "0.3.66",
+  "version": "0.3.67",
   "publishConfig": {
     "access": "public"
   },
@@ -31,18 +31,18 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-core": "^0.3.66"
+    "@lmzhen/dsh-evolution-core": "^0.3.67"
   },
   "peerDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@lmzhen/dsh-evolution-io": "^0.3.66",
-    "@lmzhen/dsh-skill-usage": "^0.3.66"
+    "@lmzhen/dsh-evolution-io": "^0.3.67",
+    "@lmzhen/dsh-skill-usage": "^0.3.67"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-io": "^0.3.66",
-    "@lmzhen/dsh-evolution-io-node": "^0.3.66",
-    "@lmzhen/dsh-skill-usage": "^0.3.66"
+    "@lmzhen/dsh-evolution-io": "^0.3.67",
+    "@lmzhen/dsh-evolution-io-node": "^0.3.67",
+    "@lmzhen/dsh-skill-usage": "^0.3.67"
   }
 }