@massu/core 1.12.0 → 1.12.2

package/CHANGELOG.md

@@ -4,6 +4,68 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.12.2] - 2026-05-18
+
+**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**. Closes the 5 MEDIUM findings from the post-1.12.0 `massu-security-reviewer` audit-loop with structural drift-guards for each. M-1 IP_HASH_PEPPER consistency (silent-fallback vs throw class), M-2 webhook POST schema symmetry, M-3 Lemon Squeezy webhook idempotency parity with Stripe, M-4 v1 audit UUID echo redaction, M-5 SSO IdP host allowlist (precondition for SSO re-enable). New CR-51 + VR-PEPPER-GUARD + pattern-scanner Check 27.
+
+### Added
+
+- **M-1 / CR-51 / VR-PEPPER-GUARD** — `website/src/lib/ip/pepper-guard.ts` exporting `requireIpHashPepper()` + `hashIpWithPepper(ip, { length: 16 | 32 })` as the SOLE allowed reader of the IP hash pepper env var. Production fail-closed via `MissingPepperError`; documented test override via `MASSU_TEST_ALLOW_EMPTY_PEPPER=1`. Closes the structural drift class where `evidence/[id]/download/route.ts:21` silent-fallback diverged from `license/activate/route.ts:34-40` throw.
+- **M-2 / VR-SCHEMA-SYMMETRY** — `webhookCreateSchema` in `src/lib/validations.ts`, symmetric to `webhookUpdateSchema`. `description` capped at 500 chars on BOTH schemas (CR-9 bypass-prevention). `route-schema-symmetry.test.ts` drift-guard scans every `app/api/v1/**/route.ts` POST/PATCH/PUT handler for `*Schema.safeParse` invocation.
+- **M-3 / VR-LS-IDEMPOTENCY** — migration `042_lemon_squeezy_webhook_events.sql` + `lemon_squeezy_event_apply(p_event_id, p_event_type, p_payload, ...)` RPC returning TEXT `processing_status` (`processed_ok` | `duplicate_ignored` | `permanent_failure` | `transient_failure`). Route handler maps each status to HTTP 200/200/422/500 — 422 stops LS retries on permanent failures (Stripe's BOOLEAN return can't carry this contract). Down migration shipped alongside (`.down.sql`) per §6.5 Rollback Plan.
+- **M-4 / VR-V1-NO-UUID-LEAK** — `v1-error-response-no-uuid-leak.test.ts` drift-guard scanning every `app/api/v1/**/route.ts` source for caller-controlled UUID interpolation in error/note response surfaces (`apiError`, `note =`, etc.). `${auth.orgId}` self-echo explicitly permitted (caller's auth context already binds them).
+- **M-5 / VR-SSO-IDP-ALLOWLIST** — `website/src/lib/sso/idp-allowlist.ts` with `SSO_IDP_HOSTS_BY_PROVIDER` constant + `validateSsoUrlAgainstProvider(provider, ssoUrl)` + `inferSsoProviderFromUrl(ssoUrl)`. TLD-aware wildcard host match (`*.okta.com` does NOT match `evil-okta.com`); HTTPS-only scheme enforcement. Covers Okta, Auth0, Azure AD (microsoftonline.com + .us), Google Workspace. Generic OIDC deferred to `plan-B.3-followup` SSO re-enable.
+- **`MASSU_SSO_ALLOWLIST_LOG_ONLY` env-flag** for the M-5 staged rollout — `isSsoAllowlistLogOnly()` in `sso-flag.ts`. Operator runs 24h log-only post-deploy to monitor false-positives before flipping to enforcing.
+- **`scripts/massu-pattern-scanner.sh` Check 27** — bash drift-guard for security-sensitive env-var patterns. 27a flags raw `process.env.<NAME>_PEPPER` outside `lib/<purpose>/<purpose>-guard.ts`; 27b flags any `process.env.<NAME>_(PEPPER|SECRET|KEY) ?? <literal>` silent-fallback adjacent to such reads (framework-platform keys exempt).
+- **CR-51** canonical rule in `.claude/CLAUDE.md`: security-sensitive env vars must use a dedicated guard helper. Three-layer enforcement: pattern-scanner Check 27 + vitest drift-guard + the guard helper is the ONLY allowed reader.
+- 5 new vitest drift-guards: `ip-pepper-guard-usage.test.ts`, `route-schema-symmetry.test.ts`, `lemon-squeezy-event-atomic.test.ts`, `v1-error-response-no-uuid-leak.test.ts`, `sso-idp-allowlist.test.ts` (+23 happy/negative/integration cases for M-5 alone).
+
+### Changed
+
+- **Lemon Squeezy webhook route (`src/app/api/lemon-squeezy/webhook/route.ts`)** — 4 handlers (`handleOrderCreated`, `handleLicenseKeyCreated`, `handleOrderRefunded`, `handleSubscriptionCancelled`) refactored to dispatch through `lemon_squeezy_event_apply` RPC. Direct `from('book_purchases').insert` / `from('organizations').update` calls REMOVED from the route. Pre-RPC test-mode mismatch rejection now returns `permanent_failure` (HTTP 422) instead of throwing.
+- **`src/app/api/v1/audit/route.ts:66`** — `${actor}` UUID echo dropped from non-empty-org-no-rows note. New message: "No audit entries for the actor filter in this org. Verify the user is a member of org ${auth.orgId}." Eliminates the UUID-existence-probe side-channel for authenticated API-key holders.
+- **`src/app/api/sso/route.ts`** — invokes `inferSsoProviderFromUrl(ssoConfig.sso_url)` before constructing `redirect_url`. Non-allowlisted host returns 502 with `X-SSO-Validation-Failure: idp-host-not-allowlisted` (or logs-only under `MASSU_SSO_ALLOWLIST_LOG_ONLY=1`).
+- **`src/app/api/sso/callback/route.ts:exchangeOidcCode`** — same allowlist guard applied BEFORE any outbound `fetch()` to the IdP token endpoint. Closes the SSRF-to-IdP vector at the callback layer (P5-007).
+- **`scripts/massu-security-scanner.sh` Check 6** — RLS coverage scanner now excludes `*.down.sql` rollback scripts (CR-46 structural fix; the literal "CREATE TABLE" only appears in their explanatory comments).
+- **`website/src/data/stats.ts`** — Database Tables 44 → 45 (new `lemon_squeezy_webhook_events`), Canonical Rules 16 → 17 (new CR-51). Marketing count drift-guard covers both.
+- **`website/src/__tests__/changelog-parse.test.ts:EXPECTED_COUNT`** bumped 40 → 41.
+- **`website/src/__tests__/migration-grant-discipline.test.ts:SERVICE_ROLE_ONLY_TABLES`** adds `lemon_squeezy_webhook_events: '042_lemon_squeezy_webhook_events.sql'`.
+
+### Fixed
+
+- Pre-existing `plan-token-changelog-coverage.test.ts` PTCC-03 failure surfaced during the loop — 3 post-tag chore-commit plan-tokens (`plan-stage-d-medium-sweep`, `plan-stage-e-low-info-sweep`, `plan-2026-05-16-prelaunch-audit`) added to the documented-divergence allowlist with the same rationale pattern as the existing `plan-stage-c-high-batch` entry.
+
+## [1.12.1] - 2026-05-18
+
+**Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**. Closes the structural drift class surfaced 2026-05-18 when SHA `b26fbb1` passed `pre-push-light` locally but failed CI on 4 distinct gates spread across 3 separate workflow YAMLs (`@massu/types/dist` missing → `ci.yml`, `eslint-rules/` missing from `PUBLIC_DIRS` → `sync-check.yml`, `diff-commands-vs-docs.sh` hardcoded path → `sync-check.yml`, Tarball E2E adapter list stale → `ci.yml`). The two operator-pushed fix attempts `8c6b843` + `d3164f7` fixed the specific instances but left the bug class wide open. This release closes the CLASS via three-layer enforcement.
+
+### Added
+
+- **CR-50 / VR-CI-PARITY** — structural pre-push ↔ CI parity drift-guard. Every multi-line shell block (>5 lines) in ANY `.github/workflows/*.yml` (excluding `*.public.yml` mirrors + 6 INFRASTRUCTURE/SECURITY workflows in `WORKFLOW_FILE_EXCLUSIONS`) lives in `scripts/ci-<name>.sh`; every such script is called from `scripts/pre-push-light.sh` OR carries `# CI-ONLY:` opt-out + entry in `CI_ONLY_SCRIPTS` allowlist. Three-layer enforcement: vitest drift-guard `packages/core/src/__tests__/ci-prepush-parity.test.ts` (7 cases, including byte-equivalence mirror-enforcement between TS test sets and bash scanner arrays) + pattern-scanner Check 26 + workspace-build-freshness step `[12/15]`.
+- **`scripts/ci-tarball-e2e.sh`** — extracted Tarball E2E adapter-pack verification. Adapter list filesystem-derived (`find packages/adapter-*`); supports `--quick` mode for pre-push-light.
+- **`scripts/ci-sync-check.sh`** — extracted public-mirror sync verification with `mktemp -d` + `trap cleanup EXIT INT TERM` safety contract; called from both `sync-check.yml` and pre-push-light step `[13/15]`. Secrets scan extended to cover ALL file types (not just `.ts`+`.md`) AND added `rk_test_/rk_live_` restricted-key + `whsec_` webhook-secret regex variants.
+- **`scripts/ci-fresh-install.sh`** (CI-ONLY) — `init --ci` fixture runner with `local` + `published` modes via `$2`. Fixture-name validated against `^[a-z][a-z0-9_-]*$` regex to prevent path traversal.
+- **`scripts/ci-config-drift.sh`** (CI-ONLY) — workspace-shadow-avoiding scratch-dir setup for `massu config check-drift`.
+- **`scripts/lib/mtime-helper.sh`** — cross-platform BSD/GNU `stat` shim with python3 fallback. Sourced by `pre-push-light.sh` step `[12/15]` Workspace Build Freshness.
+- **`scripts/test-ci-parity-regression.sh`** — AC-PARITY-REGRESSION automated test (ephemeral `git clone --no-local` + `git revert 8c6b843 d3164f7` + `npm ci` + pre-push-light exit-code assertion). Cited markers: `PARITY-REGRESSION-TEST: PASS|FAIL|ABORT`.
+- 5 new `pre-push-light.sh` steps: `[0/15]` Clean-state simulation (opt-in via `MASSU_PREPUSH_CLEAN=1`), `[12/15]` Workspace Build Freshness, `[13/15]` Sync Check (auto-gated on `packages/`+`scripts/`+`CHANGELOG.md`+...), `[14/15]` Tarball E2E quick, `[15/15]` Config Drift.
+- 4 bypass env-vars threaded with audit-trail stderr markers mirroring CR-48 precedent: `MASSU_PREPUSH_CLEAN`, `MASSU_SKIP_NEW_STEPS`, `MASSU_PREPUSH_SYNC_CHECK`, `MASSU_SYNC_PUBLIC_CHECK_ONLY`.
+
+### Changed
+
+- **`scripts/pre-push-light.sh`** renumbered from `N/11` to `N/15` label scheme (16 total labels — Plan-Token Changelog Currency REMOVED per P2-006 iter-5 resolution; absorbed by `changelog-parse.test.ts` EXPECTED_COUNT drift-guard running via `[6/15] Tests`). `[9/15] Deploy Staleness` parser fixed to scan for first `PASS:|SKIP:|WARN:` line rather than first log line (pre-existing minor bug masked by stderr/stdout merging — pre-push-light now correctly shows SKIP under `MASSU_SKIP_DEPLOY_STALENESS_CHECK=1`).
+- **`scripts/sync-public.sh`** adds `check_public_dirs_completeness()` drift-guard catching future `PUBLIC_DIRS` omissions structurally (greps cross-package test imports). New `MASSU_SYNC_PUBLIC_CHECK_ONLY=1` env-var runs drift-guard then exits 0 with no filesystem side-effects (AC-12 contract).
+- **`.github/workflows/{ci,sync-check,fresh-install-matrix,massu-config-drift}.yml`** — 4 in-scope workflows now delegate to `scripts/ci-*.sh` (thin orchestration); 7 excluded workflows remain inline with per-entry justification comments in `WORKFLOW_FILE_EXCLUSIONS`.
+- **`scripts/massu-pattern-scanner.sh`** adds Check 26 (Pre-push ↔ CI parity). Awk regex covers all YAML block-scalar variants (`|`, `|-`, `|+`, `>`, `>-`, `>+`) — prior `|` only would silently bypass.
+- **`.claude/CLAUDE.md`** adds CR-50 row + VR-CI-PARITY row + inline `### CR-50: Pre-Push Must Mirror CI` block.
+- **`website/CHANGELOG.md`** synced to root CHANGELOG.md byte-equal (drift-guard `website-changelog-matches-root.test.ts`).
+- **`website/src/__tests__/changelog-parse.test.ts:EXPECTED_COUNT`** bumped 39 → 40.
+
+### Fixed
+
+- Closes the 2026-05-18 incident class (4 CI-only failure modes on SHAs `b26fbb1`, `8c6b843`, `d3164f7`).
+- `scripts/pre-push-light.sh` step `[9/15]` deploy-staleness status parser pre-existing bug — first log line was the stderr audit-trail marker, not the stdout PASS/SKIP line (CR-9 fix surfaced during multi-perspective review).
+
 ## [1.12.0] - 2026-05-17
 
 **Stage E — LOW + INFO sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-e-low-info-sweep`)**. Closes the 14-agent pre-launch audit by addressing the residual 71 LOW + INFO items not handled in Stages A–D. Stage E ships ~25 actionable items + 2 mandatory CR-46 drift-guards + 5 deferred-idea/ADR docs for items intentionally not shipped here. Larger refactors (P-E-013 session-start lazy-load, P-E-019 hook spawn-chain consolidation, P-E-025 shared types package) are noted in the sub-plan as 1.12.x follow-up. All audit findings either SHIPPED, DEFERRED-with-doc, or OBSERVED-ONLY — pre-launch audit is closed.

package/dist/cli.js

@@ -1173,7 +1173,7 @@ function enqueueSyncPayload(db, payload) {
 }
 function dequeuePendingSync(db, limit = 10) {
   const stale = db.prepare(
-    "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10"
+    "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10 LIMIT 10000"
   ).all();
   if (stale.length > 0) {
     const ids = stale.map((s) => s.id);
@@ -1412,16 +1412,17 @@ function getSessionsByTask(db, taskId) {
     SELECT session_id, status, started_at, ended_at, plan_phase
     FROM sessions WHERE task_id = ?
     ORDER BY started_at_epoch DESC
+    LIMIT 10000
   `).all(taskId);
 }
 function getCrossTaskProgress(db, taskId) {
   const sessions = db.prepare(`
-    SELECT session_id FROM sessions WHERE task_id = ?
+    SELECT session_id FROM sessions WHERE task_id = ? LIMIT 10000
   `).all(taskId);
   const merged = {};
   for (const session of sessions) {
     const summaries = db.prepare(`
-      SELECT plan_progress FROM session_summaries WHERE session_id = ?
+      SELECT plan_progress FROM session_summaries WHERE session_id = ? LIMIT 10000
     `).all(session.session_id);
     for (const summary of summaries) {
       try {
@@ -19667,7 +19668,7 @@ function traceImports(startFile, dataDb, visited, components, hooks, maxDepth =
   if (maxDepth <= 0 || visited.has(startFile)) return;
   visited.add(startFile);
   const imports = dataDb.prepare(
-    `SELECT target_file, imported_names FROM ${t("imports")} WHERE source_file = ?`
+    `SELECT target_file, imported_names FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
   ).all(startFile);
   for (const imp of imports) {
     const target = imp.target_file;
@@ -19704,7 +19705,7 @@ function findTablesFromRouters(routerNames, dataDb) {
   const tables = /* @__PURE__ */ new Set();
   for (const routerName of routerNames) {
     const procs = dataDb.prepare(
-      `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ?`
+      `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve27(getProjectRoot(), proc.router_file), getProjectRoot());
@@ -19727,7 +19728,7 @@ function findTablesFromRouters(routerNames, dataDb) {
 function buildPageDeps(dataDb, codegraphDb) {
   dataDb.exec(`DELETE FROM ${t("page_deps")}`);
   const pages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx'"
+    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
   ).all();
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("page_deps")} (page_file, route, portal, components, hooks, routers, tables_touched) VALUES (?, ?, ?, ?, ?, ?, ?)`
@@ -19776,7 +19777,7 @@ function findAffectedPages(dataDb, file) {
   const directPage = getPageChain(dataDb, file);
   if (directPage) return [directPage];
   const importers = dataDb.prepare(
-    `SELECT source_file FROM ${t("imports")} WHERE target_file = ?`
+    `SELECT source_file FROM ${t("imports")} WHERE target_file = ? LIMIT 5000`
   ).all(file);
   const affectedFiles = /* @__PURE__ */ new Set([file, ...importers.map((i) => i.source_file)]);
   let frontier = [...importers.map((i) => i.source_file)];
@@ -19787,7 +19788,7 @@ function findAffectedPages(dataDb, file) {
     const next = [];
     for (const f2 of frontier) {
       const upstreamImporters = dataDb.prepare(
-        `SELECT source_file FROM ${t("imports")} WHERE target_file = ?`
+        `SELECT source_file FROM ${t("imports")} WHERE target_file = ? LIMIT 5000`
       ).all(f2);
       for (const imp of upstreamImporters) {
         if (!visited.has(imp.source_file)) {
@@ -19838,7 +19839,7 @@ function buildMiddlewareTree(dataDb) {
   while (queue.length > 0) {
     const current = queue.shift();
     const imports = dataDb.prepare(
-      `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+      `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
     ).all(current);
     for (const imp of imports) {
       if (!visited.has(imp.target_file) && imp.target_file.startsWith("src/")) {
@@ -19926,7 +19927,7 @@ function findCrossDomainImports(dataDb) {
   const srcPrefix = config.paths.source;
   const srcPattern = srcPrefix + "/%";
   const imports = dataDb.prepare(
-    `SELECT source_file, target_file FROM ${t("imports")} WHERE source_file LIKE ? AND target_file LIKE ?`
+    `SELECT source_file, target_file FROM ${t("imports")} WHERE source_file LIKE ? AND target_file LIKE ? LIMIT 10000`
   ).all(srcPattern, srcPattern);
   const crossings = [];
   for (const imp of imports) {
@@ -21491,7 +21492,7 @@ function handleDetail(args2, db) {
   if (!ids || ids.length === 0) return text("Error: ids array is required");
   const placeholders = ids.map(() => "?").join(",");
   const observations = db.prepare(
-    `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC`
+    `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC LIMIT 10000`
   ).all(...ids);
   if (observations.length === 0) {
     return text("No observations found for the given IDs.");
@@ -22399,7 +22400,7 @@ function getFeatureImpact(db, filePaths) {
   const affectedFeatureIds = /* @__PURE__ */ new Set();
   for (const filePath of filePaths) {
     const links = db.prepare(
-      `SELECT feature_id FROM ${t("sentinel_components")} WHERE component_file = ?`
+      `SELECT feature_id FROM ${t("sentinel_components")} WHERE component_file = ? LIMIT 10000`
     ).all(filePath);
     for (const link of links) {
       affectedFeatureIds.add(link.feature_id);
@@ -22412,7 +22413,7 @@ function getFeatureImpact(db, filePaths) {
     const feature = getFeatureById(db, featureId);
     if (!feature || feature.status !== "active") continue;
     const allComponents = db.prepare(
-      `SELECT component_file, is_primary FROM ${t("sentinel_components")} WHERE feature_id = ?`
+      `SELECT component_file, is_primary FROM ${t("sentinel_components")} WHERE feature_id = ? LIMIT 10000`
     ).all(featureId);
     const affected = allComponents.filter((c2) => fileSet.has(c2.component_file));
     const remaining = allComponents.filter((c2) => !fileSet.has(c2.component_file));
@@ -23086,6 +23087,7 @@ function scanTrpcProcedures(dataDb) {
     SELECT router_name, procedure_name, procedure_type, router_file
     FROM ${t("trpc_procedures")}
     ORDER BY router_name, procedure_name
+    LIMIT 100000
   `).all();
   for (const proc of procedures) {
     const subdomain = inferSubdomain(proc.router_name, proc.procedure_name);
@@ -23128,6 +23130,7 @@ function scanPageRoutes(dataDb) {
     SELECT page_file, route, portal, components, hooks, routers
     FROM ${t("page_deps")}
     ORDER BY route
+    LIMIT 100000
   `).all();
   for (const page of pages) {
     const domain = inferDomain(page.route);
@@ -23315,7 +23318,7 @@ function calculateQualityScore(db, sessionId) {
   const weights = getWeights();
   const categories = getCategories();
   const observations = db.prepare(
-    "SELECT type, detail FROM observations WHERE session_id = ?"
+    "SELECT type, detail FROM observations WHERE session_id = ? LIMIT 10000"
   ).all(sessionId);
   let score = 50;
   const breakdown = Object.fromEntries(
@@ -23357,6 +23360,7 @@ function backfillQualityScores(db) {
     FROM sessions s
     LEFT JOIN session_quality_scores q ON s.session_id = q.session_id
     WHERE q.session_id IS NULL
+    LIMIT 100000
   `).all();
   let backfilled = 0;
   for (const session of sessions) {
@@ -23455,6 +23459,7 @@ function handleQualityTrend(args2, db, retried = false) {
     FROM session_quality_scores
     WHERE created_at >= datetime('now', ?)
     ORDER BY created_at ASC
+    LIMIT 100000
   `).all(`-${days} days`);
   if (scores.length === 0) {
     if (!retried) {
@@ -23490,6 +23495,7 @@ function handleQualityReport(args2, db, retried = false) {
     SELECT score, security_score, architecture_score, coupling_score, test_score, rule_compliance_score
     FROM session_quality_scores
     WHERE created_at >= datetime('now', ?)
+    LIMIT 10000
   `).all(`-${days} days`);
   if (scores.length === 0) {
     if (!retried) {
@@ -23976,7 +23982,7 @@ function queryAuditLog(db, options) {
 }
 function getFileChain(db, filePath) {
   return db.prepare(
-    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC"
+    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC LIMIT 10000"
   ).all(filePath);
 }
 function getAuditToolDefinitions() {
@@ -24456,6 +24462,7 @@ function handleValidationReport(args2, db) {
     FROM validation_results
     WHERE created_at >= datetime('now', ?)
     ORDER BY created_at DESC
+    LIMIT 100000
   `).all(`-${days} days`);
   if (results.length === 0) {
     return text9(`No validation results found in the last ${days} days. Run ${p10("validation_check")} { file: "src/path/to/file.ts" } on specific files to generate validation data, or try a longer time range with { days: 90 }.`);
@@ -24866,6 +24873,7 @@ function handleSecurityScore(args2, db) {
       SELECT file_path, risk_score, findings FROM security_scores
       WHERE session_id = ?
       ORDER BY risk_score DESC
+      LIMIT 10000
     `).all(sessionId);
     if (scores.length === 0) {
       return text11(`No security scores for session ${sessionId.slice(0, 8)}... Security scores are generated when files are scanned. Try: ${p12("security_score")} { file_path: "src/server/api/routers/example.ts" } to scan a file, or ${p12("security_heatmap")} {} to see all scanned files.`);
@@ -25283,6 +25291,7 @@ function detectConflicts(db, daysBack = 7) {
       AND so1.created_at >= datetime('now', ?)
       AND so2.created_at >= datetime('now', ?)
     GROUP BY so1.file_path, so1.developer_id, so2.developer_id
+    LIMIT 10000
   `).all(`-${daysBack} days`, `-${daysBack} days`);
   return conflicts.map((c2) => ({
     filePath: c2.file_path,
@@ -25432,6 +25441,7 @@ function handleTeamExpertise(args2, db) {
     FROM developer_expertise
     WHERE module = ?
     ORDER BY expertise_score DESC
+    LIMIT 10000
   `).all(targetModule);
   if (experts.length === 0) {
     return text13(`No expertise data for module "${targetModule}". Expertise builds as developers work on files in this module across sessions. Try: ${p14("team_expertise")} {} to see all modules with tracked expertise.`);
@@ -25609,6 +25619,7 @@ function handleRegressionCheck(_args, db) {
     FROM feature_health
     WHERE modifications_since_test > 0
     ORDER BY modifications_since_test DESC
+    LIMIT 10000
   `).all();
   if (recentlyModified.length === 0) {
     return text14(`No features have been modified since their last test run. Low regression risk. Use ${p15("feature_health")} {} to see the full feature health dashboard.`);
@@ -26516,7 +26527,7 @@ function handleRule(db, args2) {
     }
     if (withIncidents) {
       const edges = db.prepare(
-        "SELECT source_id FROM knowledge_edges WHERE target_type = 'cr' AND target_id = ? AND source_type = 'incident'"
+        "SELECT source_id FROM knowledge_edges WHERE target_type = 'cr' AND target_id = ? AND source_type = 'incident' LIMIT 5000"
       ).all(ruleId);
       if (edges.length > 0) {
         lines.push("### Related Incidents");
@@ -26533,7 +26544,7 @@ function handleRule(db, args2) {
     }
   } else if (keyword) {
     const rules = db.prepare(
-      "SELECT * FROM knowledge_rules WHERE rule_text LIKE ? OR rule_id LIKE ? ORDER BY rule_id"
+      "SELECT * FROM knowledge_rules WHERE rule_text LIKE ? OR rule_id LIKE ? ORDER BY rule_id LIMIT 1000"
     ).all(`%${keyword}%`, `%${keyword}%`);
     lines.push(`## Rules matching "${keyword}" (${rules.length} found)`);
     lines.push("");
@@ -26573,7 +26584,7 @@ function handleIncident(db, args2) {
     if (incident.user_quote) lines.push(`| **User Quote** | ${incident.user_quote.replace(/\|/g, "\\|")} |`);
     lines.push("");
     const edges = db.prepare(
-      "SELECT target_id FROM knowledge_edges WHERE source_type = 'incident' AND source_id = ? AND target_type = 'cr'"
+      "SELECT target_id FROM knowledge_edges WHERE source_type = 'incident' AND source_id = ? AND target_type = 'cr' LIMIT 5000"
     ).all(String(incidentNum));
     if (edges.length > 0) {
       lines.push("### Linked Rules");
@@ -26618,7 +26629,7 @@ function handleSchemaCheck(db, args2) {
   const lines = [];
   if (table) {
     const mismatches = db.prepare(
-      "SELECT * FROM knowledge_schema_mismatches WHERE table_name = ?"
+      "SELECT * FROM knowledge_schema_mismatches WHERE table_name = ? LIMIT 1000"
     ).all(table);
     if (mismatches.length > 0) {
       lines.push(`## Schema Mismatches for \`${table}\``);
@@ -26636,7 +26647,7 @@ function handleSchemaCheck(db, args2) {
   }
   if (column) {
     const mismatches = db.prepare(
-      "SELECT * FROM knowledge_schema_mismatches WHERE wrong_column = ?"
+      "SELECT * FROM knowledge_schema_mismatches WHERE wrong_column = ? LIMIT 1000"
     ).all(column);
     if (mismatches.length > 0) {
       if (lines.length > 0) lines.push("");
@@ -26675,7 +26686,7 @@ function handlePattern(db, args2) {
     `patterns-quickref`
   ];
   const docs = db.prepare(
-    "SELECT id, file_path, title FROM knowledge_documents WHERE category = 'patterns' OR category = 'reference' OR category = 'root'"
+    "SELECT id, file_path, title FROM knowledge_documents WHERE category = 'patterns' OR category = 'reference' OR category = 'root' LIMIT 1000"
   ).all();
   const relevantDocs = docs.filter(
     (d2) => domainPatterns.some((pat) => d2.file_path.toLowerCase().includes(pat.toLowerCase()))
@@ -26720,7 +26731,7 @@ function handlePattern(db, args2) {
   if (!topic && relevantDocs.length > 0) {
     for (const doc of relevantDocs.slice(0, 2)) {
       const chunks = db.prepare(
-        "SELECT heading, content, chunk_type FROM knowledge_chunks WHERE document_id = ? AND chunk_type = 'section' ORDER BY line_start"
+        "SELECT heading, content, chunk_type FROM knowledge_chunks WHERE document_id = ? AND chunk_type = 'section' ORDER BY line_start LIMIT 5000"
       ).all(doc.id);
       lines.push(`### From: ${claudeDir}/${doc.file_path}`);
       lines.push("");
@@ -26776,7 +26787,7 @@ function handleVerification(db, args2) {
     if (vr.category) lines.push(`| **Category** | ${vr.category} |`);
   } else if (situation) {
     const results = db.prepare(
-      "SELECT * FROM knowledge_verifications WHERE use_when LIKE ? OR vr_type LIKE ? OR catches LIKE ? ORDER BY vr_type"
+      "SELECT * FROM knowledge_verifications WHERE use_when LIKE ? OR vr_type LIKE ? OR catches LIKE ? ORDER BY vr_type LIMIT 1000"
     ).all(`%${situation}%`, `%${situation}%`, `%${situation}%`);
     lines.push(`## Verifications for "${situation}" (${results.length} found)`);
     lines.push("");
@@ -26814,10 +26825,10 @@ function handleGraph(db, args2) {
     lines.push("");
     for (const entity of currentLevel) {
       const outgoing = db.prepare(
-        "SELECT target_type, target_id, edge_type FROM knowledge_edges WHERE source_type = ? AND source_id = ?"
+        "SELECT target_type, target_id, edge_type FROM knowledge_edges WHERE source_type = ? AND source_id = ? LIMIT 5000"
       ).all(entity.type, entity.id);
       const incoming = db.prepare(
-        "SELECT source_type, source_id, edge_type FROM knowledge_edges WHERE target_type = ? AND target_id = ?"
+        "SELECT source_type, source_id, edge_type FROM knowledge_edges WHERE target_type = ? AND target_id = ? LIMIT 5000"
       ).all(entity.type, entity.id);
       for (const edge of outgoing) {
         const key = `${edge.target_type}:${edge.target_id}`;
@@ -26892,6 +26903,7 @@ function handleCommand(db, args2) {
       JOIN knowledge_documents kd ON kd.id = kc.document_id
       WHERE kc.chunk_type = 'command' AND (kc.content LIKE ? OR kc.heading LIKE ?)
       ORDER BY kc.heading
+      LIMIT 1000
     `).all(`%${keyword}%`, `%${keyword}%`);
     lines.push(`## Commands matching "${keyword}" (${results.length} found)`);
     lines.push("");
@@ -26906,6 +26918,7 @@ function handleCommand(db, args2) {
       JOIN knowledge_documents kd ON kd.id = kc.document_id
       WHERE kc.chunk_type = 'command'
       ORDER BY kc.heading
+      LIMIT 1000
     `).all();
     lines.push(`## All Commands (${commands.length} total)`);
     lines.push("");
@@ -27022,7 +27035,7 @@ function handlePlan(db, args2) {
     if (doc.description) lines.push(`**Description**: ${doc.description}`);
     lines.push("");
     const items = db.prepare(
-      "SELECT heading, content FROM knowledge_chunks WHERE document_id = ? AND metadata LIKE '%plan_item_id%' ORDER BY heading"
+      "SELECT heading, content FROM knowledge_chunks WHERE document_id = ? AND metadata LIKE '%plan_item_id%' ORDER BY heading LIMIT 5000"
     ).all(doc.id);
     if (items.length > 0) {
       lines.push(`### Plan Items (${items.length})`);
@@ -27048,7 +27061,7 @@ function handlePlan(db, args2) {
     }
   } else if (status) {
     const docs = db.prepare(
-      "SELECT kd.file_path, kd.title, kc.content FROM knowledge_chunks kc JOIN knowledge_documents kd ON kd.id = kc.document_id WHERE kd.category = 'plan' AND kc.heading = 'IMPLEMENTATION STATUS' AND kc.content LIKE ? ORDER BY kd.file_path DESC"
+      "SELECT kd.file_path, kd.title, kc.content FROM knowledge_chunks kc JOIN knowledge_documents kd ON kd.id = kc.document_id WHERE kd.category = 'plan' AND kc.heading = 'IMPLEMENTATION STATUS' AND kc.content LIKE ? ORDER BY kd.file_path DESC LIMIT 1000"
     ).all(`%${status}%`);
     lines.push(`## Plans with status "${status}" (${docs.length} found)`);
     lines.push("");
@@ -27134,7 +27147,7 @@ function handleGaps(db, args2) {
     }
   } else if (checkType === "patterns") {
     const patternDocs = db.prepare(
-      "SELECT file_path, title FROM knowledge_documents WHERE category = 'patterns'"
+      "SELECT file_path, title FROM knowledge_documents WHERE category = 'patterns' LIMIT 10000"
     ).all();
     const documentedDomains = new Set(patternDocs.map((d2) => d2.title.replace("-patterns", "").replace(" Patterns", "").toLowerCase()));
     lines.push("### Pattern Coverage");
@@ -27144,7 +27157,7 @@ function handleGaps(db, args2) {
     try {
       dataDb = getDataDb();
       const domains = dataDb.prepare(
-        `SELECT DISTINCT domain FROM ${t("sentinel")} WHERE status = 'active' ORDER BY domain`
+        `SELECT DISTINCT domain FROM ${t("sentinel")} WHERE status = 'active' ORDER BY domain LIMIT 10000`
       ).all();
       for (const d2 of domains) {
         const hasPattern = documentedDomains.has(d2.domain.toLowerCase());
@@ -27469,7 +27482,7 @@ function handlePyImports(args2, dataDb) {
         if (depth > maxDepth || visited.has(f2)) return;
         visited.add(f2);
         const imports = dataDb.prepare(
-          `SELECT target_file, imported_names FROM ${t("py_imports")} WHERE source_file = ?`
+          `SELECT target_file, imported_names FROM ${t("py_imports")} WHERE source_file = ? LIMIT 10000`
         ).all(f2);
         for (const imp of imports) {
           const indent = "  ".repeat(depth);
@@ -27484,7 +27497,7 @@ function handlePyImports(args2, dataDb) {
       traverse2(file, 0);
     } else {
       const imports = dataDb.prepare(
-        `SELECT target_file, import_type, imported_names, line FROM ${t("py_imports")} WHERE source_file = ? ORDER BY line`
+        `SELECT target_file, import_type, imported_names, line FROM ${t("py_imports")} WHERE source_file = ? ORDER BY line LIMIT 10000`
       ).all(file);
       lines.push(`## Imports from ${file} (${imports.length} edges)`);
       for (const imp of imports) {
@@ -27494,7 +27507,7 @@ function handlePyImports(args2, dataDb) {
     }
   } else if (importedBy) {
     const importers = dataDb.prepare(
-      `SELECT source_file, imported_names, line FROM ${t("py_imports")} WHERE target_file = ? ORDER BY source_file`
+      `SELECT source_file, imported_names, line FROM ${t("py_imports")} WHERE target_file = ? ORDER BY source_file LIMIT 10000`
     ).all(importedBy);
     lines.push(`## Files importing ${importedBy} (${importers.length} edges)`);
     for (const imp of importers) {
@@ -27741,14 +27754,14 @@ function handlePyImpact(args2, dataDb) {
   const file = args2.file;
   const lines = [`## Impact Analysis: ${file}`, ""];
   const importedBy = dataDb.prepare(
-    `SELECT source_file FROM ${t("py_imports")} WHERE target_file = ?`
+    `SELECT source_file FROM ${t("py_imports")} WHERE target_file = ? LIMIT 10000`
   ).all(file);
   lines.push(`### Imported By (${importedBy.length} files)`);
   for (const imp of importedBy.slice(0, 20)) {
     lines.push(`- ${imp.source_file}`);
   }
   const routes = dataDb.prepare(
-    `SELECT method, path, function_name FROM ${t("py_routes")} WHERE file = ?`
+    `SELECT method, path, function_name FROM ${t("py_routes")} WHERE file = ? LIMIT 10000`
   ).all(file);
   if (routes.length > 0) {
     lines.push(`
@@ -27758,7 +27771,7 @@ function handlePyImpact(args2, dataDb) {
     }
   }
   const models = dataDb.prepare(
-    `SELECT class_name, table_name FROM ${t("py_models")} WHERE file = ?`
+    `SELECT class_name, table_name FROM ${t("py_models")} WHERE file = ? LIMIT 10000`
   ).all(file);
   if (models.length > 0) {
     lines.push(`
@@ -27771,7 +27784,7 @@ function handlePyImpact(args2, dataDb) {
   if (routeIds.length > 0) {
     const placeholders = routeIds.map(() => "?").join(",");
     const callers = dataDb.prepare(
-      `SELECT DISTINCT frontend_file FROM ${t("py_route_callers")} WHERE route_id IN (${placeholders})`
+      `SELECT DISTINCT frontend_file FROM ${t("py_route_callers")} WHERE route_id IN (${placeholders}) LIMIT 100000`
     ).all(...routeIds.map((r2) => r2.id));
     if (callers.length > 0) {
       lines.push(`
@@ -27812,14 +27825,14 @@ function handlePyContext(args2, dataDb) {
       lines.push(`- ${imp.source_file}`);
     }
   }
-  const routes = dataDb.prepare(`SELECT method, path, function_name, line FROM ${t("py_routes")} WHERE file = ?`).all(file);
+  const routes = dataDb.prepare(`SELECT method, path, function_name, line FROM ${t("py_routes")} WHERE file = ? LIMIT 10000`).all(file);
   if (routes.length > 0) {
     lines.push("\n### Routes");
     for (const r2 of routes) {
       lines.push(`- ${r2.method} ${r2.path} \u2192 ${r2.function_name} (L${r2.line})`);
     }
   }
-  const models = dataDb.prepare(`SELECT class_name, table_name, line FROM ${t("py_models")} WHERE file = ?`).all(file);
+  const models = dataDb.prepare(`SELECT class_name, table_name, line FROM ${t("py_models")} WHERE file = ? LIMIT 10000`).all(file);
   if (models.length > 0) {
     lines.push("\n### Models");
     for (const m3 of models) {
@@ -28226,7 +28239,7 @@ Feature scan failed: ${error instanceof Error ? error.message : String(error)}`)
 function handleContext(file, dataDb, codegraphDb) {
   const lines = [];
   const nodes = codegraphDb.prepare(
-    "SELECT name, kind, start_line, end_line FROM nodes WHERE file_path = ? ORDER BY start_line"
+    "SELECT name, kind, start_line, end_line FROM nodes WHERE file_path = ? ORDER BY start_line LIMIT 10000"
   ).all(file);
   if (nodes.length > 0) {
     lines.push("## CodeGraph Nodes");
@@ -28343,7 +28356,7 @@ function handleContext(file, dataDb, codegraphDb) {
         if (relevantCRs.length > 0) {
           const placeholders = relevantCRs.map(() => "?").join(",");
           const crRules = knowledgeDb.prepare(
-            `SELECT rule_id, rule_text, vr_type FROM knowledge_rules WHERE rule_id IN (${placeholders})`
+            `SELECT rule_id, rule_text, vr_type FROM knowledge_rules WHERE rule_id IN (${placeholders}) LIMIT 10000`
           ).all(...relevantCRs);
           if (crRules.length > 0) {
             lines.push("## Relevant Canonical Rules");
@@ -28440,7 +28453,7 @@ function handleTrpcMap(args2, dataDb) {
   const lines = [];
   if (args2.uncoupled) {
     const uncoupled = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 ORDER BY router_name, procedure_name`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 ORDER BY router_name, procedure_name LIMIT 10000`
     ).all();
     lines.push(`## Uncoupled Procedures (${uncoupled.length} total)`);
     lines.push("These procedures have ZERO UI callers.");
@@ -28455,7 +28468,7 @@ function handleTrpcMap(args2, dataDb) {
     }
   } else if (args2.router) {
     const procs = dataDb.prepare(
-      `SELECT id, procedure_name, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE router_name = ? ORDER BY procedure_name`
+      `SELECT id, procedure_name, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE router_name = ? ORDER BY procedure_name LIMIT 10000`
     ).all(args2.router);
     lines.push(`## Router: ${args2.router} (${procs.length} procedures)`);
     lines.push("");
@@ -28463,7 +28476,7 @@ function handleTrpcMap(args2, dataDb) {
       const status = proc.has_ui_caller ? "" : " [NO UI CALLERS]";
       lines.push(`### ${args2.router}.${proc.procedure_name} (${proc.procedure_type})${status}`);
       const callSites = dataDb.prepare(
-        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ?`
+        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ? LIMIT 10000`
       ).all(proc.id);
       if (callSites.length > 0) {
         lines.push("UI Call Sites:");
@@ -28477,7 +28490,7 @@ function handleTrpcMap(args2, dataDb) {
     }
   } else if (args2.procedure) {
     const procs = dataDb.prepare(
-      `SELECT id, router_name, router_file, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE procedure_name = ? ORDER BY router_name`
+      `SELECT id, router_name, router_file, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE procedure_name = ? ORDER BY router_name LIMIT 10000`
     ).all(args2.procedure);
     lines.push(`## Procedure "${args2.procedure}" found in ${procs.length} routers`);
     lines.push("");
@@ -28485,7 +28498,7 @@ function handleTrpcMap(args2, dataDb) {
       lines.push(`### ${proc.router_name}.${args2.procedure} (${proc.procedure_type})`);
       lines.push(`File: ${proc.router_file}`);
       const callSites = dataDb.prepare(
-        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ?`
+        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ? LIMIT 10000`
       ).all(proc.id);
       if (callSites.length > 0) {
         lines.push("UI Call Sites:");
@@ -28530,11 +28543,11 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
   let uncoupledProcs;
   if (stagedFiles) {
     uncoupledProcs = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 AND router_file IN (${stagedFiles.map(() => "?").join(",")})`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 AND router_file IN (${stagedFiles.map(() => "?").join(",")}) LIMIT 10000`
     ).all(...stagedFiles);
   } else {
     uncoupledProcs = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 LIMIT 10000`
     ).all();
   }
   lines.push("## Coupling Check Results");
@@ -28550,12 +28563,12 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
     lines.push("");
   }
   const allPages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx'"
+    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
   ).all();
   const pageImports = /* @__PURE__ */ new Set();
   for (const page of allPages) {
     const imports = dataDb.prepare(
-      `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+      `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
     ).all(page.path);
     for (const imp of imports) {
       pageImports.add(imp.target_file);
@@ -28565,7 +28578,7 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
   if (stagedFiles) {
     const placeholders = stagedFiles.map(() => "?").join(",");
     componentFiles = codegraphDb.prepare(
-      `SELECT path FROM files WHERE path LIKE 'src/components/%' AND path IN (${placeholders})`
+      `SELECT path FROM files WHERE path LIKE 'src/components/%' AND path IN (${placeholders}) LIMIT 10000`
     ).all(...stagedFiles);
   } else {
     componentFiles = [];
@@ -28627,7 +28640,7 @@ function handleImpact2(file, dataDb, codegraphDb) {
   const fileDomain = classifyFile(file);
   lines.push(`### Domain: ${fileDomain}`);
   const imports = dataDb.prepare(
-    `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+    `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
   ).all(file);
   const crossings = [];
   for (const imp of imports) {

package/dist/hooks/post-tool-use.js

@@ -2028,7 +2028,7 @@ async function main() {
             const counts = parseTestRunOutput(tool_response ?? "");
             if (counts) {
               const modifiedFeatures = db.prepare(
-                "SELECT feature_key FROM feature_health WHERE modifications_since_test > 0"
+                "SELECT feature_key FROM feature_health WHERE modifications_since_test > 0 LIMIT 10000"
               ).all();
               for (const row of modifiedFeatures) {
                 recordTestResult(db, row.feature_key, counts.passing, counts.failing);

package/dist/hooks/pre-compact.js

@@ -1177,7 +1177,7 @@ async function main() {
       ).all(session_id);
       const observations = observationsDesc.reverse();
       const prompts = db.prepare(
-        "SELECT prompt_text FROM user_prompts WHERE session_id = ? ORDER BY prompt_number ASC"
+        "SELECT prompt_text FROM user_prompts WHERE session_id = ? ORDER BY prompt_number ASC LIMIT 10000"
       ).all(session_id);
       const summary = buildSnapshotSummary(observations, prompts);
       addSummary(db, session_id, summary);