@lmzhen/dsh-evolution-threat 0.3.21 → 0.3.23

package/lib/index.js

@@ -1,5 +1,5 @@
 import z from "@deepseek-ai/schemastery";
-import { EVOLUTION_WRITE_TOOLS, scanContentThreats, scanMemoryThreats } from "@lmzhen/dsh-evolution-core";
+import { EVOLUTION_WRITE_TOOLS, clampedNumber, scanContentThreats, scanMemoryThreats } from "@lmzhen/dsh-evolution-core";
 //#region lib/types/index.js
 /**
 * Write-time threat guard for evolution tools.
@@ -9,7 +9,7 @@ const name = "evolution-threat";
 const inject = ["tools"];
 const Config = z.object({
 	enabled: z.boolean().default(true),
-	maxScanChars: z.number().default(65536)
+	maxScanChars: z.number().min(1).default(65536)
 });
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -43,9 +43,16 @@ function scanToolArgs(toolName, args, maxScanChars) {
 	}
 	return null;
 }
+/** Resolve the effective `maxScanChars`, clamping invalid values to the
+* default (G3.1: 0/negative/NaN/±Infinity → 65_536). Exported so the clamp is
+* directly testable; `apply` warns when a user-supplied value was corrected. */
+function resolveMaxScanChars(config) {
+	return clampedNumber(config.maxScanChars ?? 65536, 65536, { min: 1 });
+}
 function apply(ctx, rawConfig = {}) {
 	if (!(rawConfig.enabled ?? true)) return;
-	const maxScanChars = rawConfig.maxScanChars ?? 65536;
+	const maxScanChars = resolveMaxScanChars(rawConfig);
+	if (maxScanChars !== (rawConfig.maxScanChars ?? 65536)) ctx.logger.warn(`evolution-threat: maxScanChars=${String(rawConfig.maxScanChars)} is invalid; falling back to the default 65_536`);
 	ctx.on("tools/pre-execute", async (exec, next) => {
 		const hit = scanToolArgs(exec.name, exec.arguments, maxScanChars);
 		if (hit) return {
@@ -56,4 +63,4 @@ function apply(ctx, rawConfig = {}) {
 	});
 }
 //#endregion
-export { Config, apply, inject, name, scanToolArgs };
+export { Config, apply, inject, name, resolveMaxScanChars, scanToolArgs };

package/lib/types/index.d.ts

@@ -15,5 +15,9 @@ export declare const Config: z<Config>;
 /** Scan one tool invocation for threat-shaped payload text. Exported so the
  * guard contract is testable directly (0.3.17). */
 export declare function scanToolArgs(toolName: string, args: unknown, maxScanChars: number): string | null;
+/** Resolve the effective `maxScanChars`, clamping invalid values to the
+ * default (G3.1: 0/negative/NaN/±Infinity → 65_536). Exported so the clamp is
+ * directly testable; `apply` warns when a user-supplied value was corrected. */
+export declare function resolveMaxScanChars(config: Config): number;
 export declare function apply(ctx: Context, rawConfig?: Config): void;
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-threat",
   "description": "Write-time threat guard for evolution tools (community build)",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "publishConfig": {
     "access": "public"
   },
@@ -31,7 +31,7 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-core": "^0.3.21"
+    "@lmzhen/dsh-evolution-core": "^0.3.23"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -42,6 +42,6 @@
     "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-core": "^0.3.21"
+    "@lmzhen/dsh-evolution-core": "^0.3.23"
   }
 }