@sleep2agi/commhub-server 0.8.8-preview.0 → 0.9.0-preview.0

package/src/push.ts

@@ -1,12 +1,89 @@
 // ── SSE Push: 实时推送事件给 Agent ──────────────────
 // Agent 连 GET /events/:session → 保持 SSE 长连接
 // send_task 写 inbox 后 → pushEvent() → 秒达
+//
+// Backpressure & half-open contract (Round-2/4 fix per 通信龙):
+//
+// 0. **CRITICAL**: `desiredSize` units are determined by the stream's
+//    queuing strategy. The web-streams default strategy is COUNT-based
+//    (each chunk = 1 unit), so a 1 MB chunk only nudges desiredSize by
+//    -1. That defeats the byte-cap entirely — pushing a million 1-byte
+//    chunks is what trips the threshold, not 1 MB of real bytes.
+//    Bun probe verified by 通信牛: default stream after 1 MiB chunk →
+//    desiredSize 0, after 2 MiB → -1; byte strategy after 1 MiB → 0,
+//    after 2 MiB → -1048576. We MUST construct the stream with an
+//    explicit byte-counting strategy:
+//       new ReadableStream(src, { highWaterMark: 0, size: c => c.byteLength })
+//    With highWaterMark=0, every enqueued byte counts against the cap
+//    directly. The HARD CEILING below then closes the stream at
+//    -MAX_QUEUE_BACKPRESSURE_BYTES bytes of queued data, which is what
+//    we actually want.
+//
+// 1. `ReadableStreamDefaultController.desiredSize` is the SSE queue
+//    headroom in BYTES (given the strategy above). Positive = room,
+//    0 = at high-water-mark, negative = over by that many bytes.
+//    Without a bound, half-open TCP consumers (network drop, client
+//    crash without FIN) silently accumulate bytes in the queue forever
+//    — a public-hub OOM vector.
+//
+// 2. We bound it two ways:
+//
+//      a. HARD CEILING — `desiredSize < -MAX_QUEUE_BACKPRESSURE_BYTES`
+//         → close the stream immediately. Single huge event can't blow
+//         up a stuck client.
+//
+//      b. STUCK TIMEOUT — `desiredSize < 0` continuously for
+//         `STUCK_CLOSE_MS` → close. Catches slow-trickle leaks where
+//         the consumer accepts a byte every few seconds but can't keep
+//         up.
+//
+// 3. Liveness: every `LIVENESS_SWEEP_MS` we re-check every registered
+//    client even when nobody calls `pushEvent`, so a session that goes
+//    half-open during a quiet period still gets reaped — not waiting
+//    for the next inbox push.
 
 import { eventBus, type RenameCommittedEvent } from "./event_bus";
 
+// ─────────────────────────────────────────────────────────────────────
+// Tunables (env-overridable for tests and ops)
+// ─────────────────────────────────────────────────────────────────────
+function envNum(k: string, fallback: number): number {
+  const v = process.env[k];
+  if (!v) return fallback;
+  const n = Number(v);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
+/** Hard ceiling on per-client SSE queue backpressure before we drop the
+ *  client. 1 MB by default — generous for normal bursts, lethal for the
+ *  half-open consumer that has stopped reading entirely. */
+const MAX_QUEUE_BACKPRESSURE_BYTES = envNum("ANET_SSE_MAX_QUEUE_BYTES", 1_000_000);
+
+/** How long `desiredSize` can stay negative (i.e. consumer behind HWM)
+ *  before we declare the client dead. 60s by default — past 2× the
+ *  keepalive interval, so a live-but-slow consumer wouldn't trip it. */
+const STUCK_CLOSE_MS = envNum("ANET_SSE_STUCK_CLOSE_MS", 60_000);
+
+/** Keepalive cadence. Doubles as half-open liveness probe — if enqueue
+ *  silently piles up bytes here, the stuck-timeout kicks in. */
+const KEEPALIVE_MS = envNum("ANET_SSE_KEEPALIVE_MS", 30_000);
+
+/** Liveness sweep cadence — proactive scan even when no events flow. */
+const LIVENESS_SWEEP_MS = envNum("ANET_SSE_LIVENESS_SWEEP_MS", 15_000);
+
 type SSEClient = {
   controller: ReadableStreamDefaultController;
   encoder: TextEncoder;
+  /** When desiredSize first went negative; cleared on successful drain. */
+  stuckSince: number | null;
+  /** Once true, the stream has been closed and the client should be
+   *  evicted from the map on the next sweep / push. Guards against
+   *  double-close. */
+  closed: boolean;
+  /** keepalive timer handle so it can be cleared on close. */
+  keepaliveTimer?: ReturnType<typeof setInterval>;
+  /** Stable key for log/diagnostic context. */
+  key: string;
 };
 
 // 一个 session 可能有多个 SSE 连接（重连时短暂并存）
@@ -16,49 +93,189 @@ function ts(): string {
   return new Date().toTimeString().slice(0, 8);
 }
 
+function clientKey(sessionName: string, networkId?: string | null): string {
+  return `${networkId || "global"}:${sessionName}`;
+}
+
+// ─────────────────────────────────────────────────────────────────────
+// Close + dispatch helpers
+// ─────────────────────────────────────────────────────────────────────
+
+/** Close a client's stream (idempotent) and clear its keepalive timer.
+ *  Does NOT remove from the map — leave that to the caller so it can
+ *  prune the right index without re-finding it. */
+function closeClient(client: SSEClient, reason: string): void {
+  if (client.closed) return;
+  client.closed = true;
+  if (client.keepaliveTimer) clearInterval(client.keepaliveTimer);
+  try {
+    client.controller.close();
+  } catch {
+    // Already closed by the runtime, or controller errored. Either way
+    // we're done with it.
+  }
+  console.log(`[${ts()}] SSE ✕ ${client.key} closed (reason=${reason})`);
+}
+
+/** Best-effort enqueue with backpressure guard. Returns:
+ *    - "ok"    → bytes accepted, queue healthy
+ *    - "dead"  → client closed; caller must remove from map */
+function tryEnqueueBytes(client: SSEClient, bytes: Uint8Array): "ok" | "dead" {
+  if (client.closed) return "dead";
+
+  const ctrl = client.controller;
+  // desiredSize may be null on a closed/errored stream — defensive
+  // null-check, then treat null as "no headroom" since we can't enqueue
+  // safely anyway.
+  const desired = ctrl.desiredSize;
+  if (desired === null) {
+    closeClient(client, "controller-null-desired");
+    return "dead";
+  }
+
+  // Hard ceiling: too far behind HWM, single push could OOM us. Close.
+  if (desired < -MAX_QUEUE_BACKPRESSURE_BYTES) {
+    closeClient(client, `queue-overflow-${Math.abs(desired)}b`);
+    return "dead";
+  }
+
+  // Track stuck-since-when for the soft timeout below.
+  if (desired < 0) {
+    if (client.stuckSince === null) {
+      client.stuckSince = Date.now();
+    } else if (Date.now() - client.stuckSince > STUCK_CLOSE_MS) {
+      closeClient(client, `stuck-${Date.now() - client.stuckSince}ms`);
+      return "dead";
+    }
+  } else {
+    client.stuckSince = null;
+  }
+
+  try {
+    ctrl.enqueue(bytes);
+    return "ok";
+  } catch (e: any) {
+    closeClient(client, `enqueue-throw:${e?.message || e}`);
+    return "dead";
+  }
+}
+
+/** Walk every client and close any that are stuck/half-open. Run on a
+ *  timer so half-open detection doesn't depend on event traffic. */
+function sweepLiveness(): void {
+  const now = Date.now();
+  for (const [key, arr] of clients) {
+    const alive: SSEClient[] = [];
+    for (const c of arr) {
+      if (c.closed) continue;
+      const desired = c.controller.desiredSize;
+      if (desired === null) {
+        closeClient(c, "sweep-null-desired");
+        continue;
+      }
+      if (desired < -MAX_QUEUE_BACKPRESSURE_BYTES) {
+        closeClient(c, `sweep-overflow-${Math.abs(desired)}b`);
+        continue;
+      }
+      if (desired < 0) {
+        if (c.stuckSince === null) c.stuckSince = now;
+        else if (now - c.stuckSince > STUCK_CLOSE_MS) {
+          closeClient(c, `sweep-stuck-${now - c.stuckSince}ms`);
+          continue;
+        }
+      } else {
+        c.stuckSince = null;
+      }
+      alive.push(c);
+    }
+    if (alive.length === 0) clients.delete(key);
+    else if (alive.length !== arr.length) clients.set(key, alive);
+  }
+}
+
+// Liveness sweep timer. Started lazily on first stream creation; never
+// stopped in production (one timer for the lifetime of the process).
+let livenessSweepTimer: ReturnType<typeof setInterval> | null = null;
+function ensureLivenessSweep(): void {
+  if (livenessSweepTimer) return;
+  livenessSweepTimer = setInterval(() => {
+    try {
+      sweepLiveness();
+    } catch (e: any) {
+      console.log(`[${ts()}] SSE sweep failed: ${e?.message || e}`);
+    }
+  }, LIVENESS_SWEEP_MS);
+  // Don't keep the event loop alive just for the sweep.
+  (livenessSweepTimer as any)?.unref?.();
+}
+
+// ─────────────────────────────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────────────────────────────
+
 /** 创建 SSE Response 并注册到 clients map */
 export function createSSEStream(sessionName: string, networkId?: string | null): Response {
   const encoder = new TextEncoder();
-  let ctrl: ReadableStreamDefaultController;
   const key = clientKey(sessionName, networkId);
+  let client: SSEClient;
 
-  const stream = new ReadableStream({
+  const stream = new ReadableStream<Uint8Array>({
     start(controller) {
-      ctrl = controller;
-      const client: SSEClient = { controller, encoder };
+      client = {
+        controller,
+        encoder,
+        stuckSince: null,
+        closed: false,
+        key,
+      };
 
-      if (!clients.has(key)) {
-        clients.set(key, []);
-      }
+      if (!clients.has(key)) clients.set(key, []);
       clients.get(key)!.push(client);
       console.log(`[${ts()}] SSE ← ${key} connected (${clients.get(key)!.length} clients)`);
 
-      // 发送初始心跳
-      controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: "connected", session: sessionName, network_id: networkId ?? null })}\n\n`));
+      // Send initial connected frame through the backpressure guard so
+      // even the first byte respects the contract.
+      tryEnqueueBytes(
+        client,
+        encoder.encode(`data: ${JSON.stringify({ type: "connected", session: sessionName, network_id: networkId ?? null })}\n\n`),
+      );
 
-      // Periodic keepalive every 30s to prevent proxy/LB idle timeout
-      const keepalive = setInterval(() => {
-        try {
-          controller.enqueue(encoder.encode(`: keepalive\n\n`));
-        } catch {
-          clearInterval(keepalive);
+      // Periodic keepalive doubles as a half-open probe — if the
+      // consumer is gone, this enqueue piles bytes in the queue until
+      // tryEnqueueBytes catches the ceiling / stuck timeout.
+      client.keepaliveTimer = setInterval(() => {
+        if (client.closed) {
+          if (client.keepaliveTimer) clearInterval(client.keepaliveTimer);
+          return;
         }
-      }, 30_000);
-      (client as any)._keepalive = keepalive;
+        const result = tryEnqueueBytes(client, encoder.encode(`: keepalive\n\n`));
+        if (result === "dead") {
+          // closeClient already cleared the timer; just make sure we
+          // also prune from the map.
+          pruneClosed(key);
+        }
+      }, KEEPALIVE_MS);
+      (client.keepaliveTimer as any)?.unref?.();
+
+      ensureLivenessSweep();
     },
     cancel() {
-      // 断线清理
-      const arr = clients.get(key);
-      if (arr) {
-        const idx = arr.findIndex(c => c.controller === ctrl);
-        if (idx !== -1) {
-          clearInterval((arr[idx] as any)._keepalive);
-          arr.splice(idx, 1);
-        }
-        if (arr.length === 0) clients.delete(key);
-        console.log(`[${ts()}] SSE ✕ ${key} disconnected (${arr.length} remaining)`);
+      // Consumer side hangup — straightforward path, mark closed and
+      // prune. The half-open path goes through closeClient instead.
+      if (client) {
+        closeClient(client, "cancel");
+        pruneClosed(key);
       }
     },
+  }, {
+    // BYTE-COUNTING strategy. Without this, desiredSize is a chunk
+    // counter and the byte-cap below is meaningless (see file header
+    // comment #0). highWaterMark=0 means: after enqueuing N bytes, the
+    // queue is N bytes over the mark, so `desiredSize === -N`. Pair
+    // this with the hard ceiling in tryEnqueueBytes to actually close
+    // a half-open consumer at MAX_QUEUE_BACKPRESSURE_BYTES.
+    highWaterMark: 0,
+    size: (chunk: Uint8Array) => chunk.byteLength,
   });
 
   return new Response(stream, {
@@ -70,8 +287,17 @@ export function createSSEStream(sessionName: string, networkId?: string | null):
   });
 }
 
-function clientKey(sessionName: string, networkId?: string | null): string {
-  return `${networkId || "global"}:${sessionName}`;
+/** Remove closed entries for one key, drop the map slot if empty. */
+function pruneClosed(key: string): void {
+  const arr = clients.get(key);
+  if (!arr) return;
+  const alive = arr.filter((c) => !c.closed);
+  if (alive.length === 0) {
+    clients.delete(key);
+    console.log(`[${ts()}] SSE ✕ ${key} disconnected (0 remaining)`);
+  } else if (alive.length !== arr.length) {
+    clients.set(key, alive);
+  }
 }
 
 function rekeyClient(oldSessionName: string, newSessionName: string, networkId?: string | null): number {
@@ -81,6 +307,10 @@ function rekeyClient(oldSessionName: string, newSessionName: string, networkId?:
   const oldClients = clients.get(oldKey);
   if (!oldClients || oldClients.length === 0) return 0;
 
+  // Update the cached key on each moved client so later closeClient
+  // logs report the right session.
+  for (const c of oldClients) c.key = newKey;
+
   const existing = clients.get(newKey) || [];
   clients.set(newKey, existing.concat(oldClients));
   clients.delete(oldKey);
@@ -98,29 +328,34 @@ eventBus.on("rename-committed", (event: RenameCommittedEvent) => {
 
 /** 推送事件给指定 session 的所有 SSE 连接 */
 export function pushEvent(sessionName: string, event: Record<string, unknown>, networkId?: string | null): void {
-  const arr = clients.get(clientKey(sessionName, networkId ?? (event.network_id as string | null | undefined)));
+  const key = clientKey(sessionName, networkId ?? (event.network_id as string | null | undefined));
+  const arr = clients.get(key);
   if (!arr || arr.length === 0) return;
 
   const data = `data: ${JSON.stringify(event)}\n\n`;
-  const dead: number[] = [];
+  let needPrune = false;
 
-  for (let i = 0; i < arr.length; i++) {
-    try {
-      arr[i].controller.enqueue(arr[i].encoder.encode(data));
-    } catch {
-      dead.push(i);
+  for (const c of arr) {
+    if (c.closed) {
+      needPrune = true;
+      continue;
     }
+    const result = tryEnqueueBytes(c, c.encoder.encode(data));
+    if (result === "dead") needPrune = true;
   }
 
-  // 清理死连接
-  for (let i = dead.length - 1; i >= 0; i--) {
-    arr.splice(dead[i], 1);
-  }
-  if (arr.length === 0) clients.delete(clientKey(sessionName, networkId ?? (event.network_id as string | null | undefined)));
+  if (needPrune) pruneClosed(key);
 }
 
 export function __resetSSEClientsForTest(): void {
+  for (const arr of clients.values()) {
+    for (const c of arr) closeClient(c, "reset-for-test");
+  }
   clients.clear();
+  if (livenessSweepTimer) {
+    clearInterval(livenessSweepTimer);
+    livenessSweepTimer = null;
+  }
 }
 
 /** 获取当前 SSE 连接统计 */
@@ -128,8 +363,23 @@ export function getSSEStats(): { total: number; sessions: Record<string, number>
   let total = 0;
   const sessions: Record<string, number> = {};
   for (const [name, arr] of clients) {
-    sessions[name] = arr.length;
-    total += arr.length;
+    const alive = arr.filter((c) => !c.closed);
+    if (alive.length === 0) continue;
+    sessions[name] = alive.length;
+    total += alive.length;
   }
   return { total, sessions };
 }
+
+// Test hooks — exported so the test file can simulate half-open / stuck
+// consumers without spinning up a real TCP socket.
+export const __SSE_INTERNALS_FOR_TEST = {
+  tryEnqueueBytes,
+  sweepLiveness,
+  closeClient,
+  MAX_QUEUE_BACKPRESSURE_BYTES,
+  STUCK_CLOSE_MS,
+  KEEPALIVE_MS,
+  LIVENESS_SWEEP_MS,
+  clientsMap: clients,
+};

package/src/send_dedup.test.ts

@@ -117,6 +117,24 @@ describe("SendDedup", () => {
     expect(d.size).toBeGreaterThan(0);
   });
 
+  it("evictOldest drops to exactly floor(maxKeys * 0.9) on the first trigger", () => {
+    // Regression guard for the size-during-loop bug fixed in the
+    // robustness pass. Insert exactly maxKeys+1 records to fire exactly
+    // ONE evictOldest call, then snapshot size before any further inserts
+    // can re-grow it. With the bug, the loop bound
+    // `i < this.last.size - target` shrunk each iteration and only
+    // ~half the intended deletions ran (e.g. 14 of 27 for maxKeys=256,
+    // landing size at ~243 instead of 230). After the fix size lands at
+    // the documented target = floor(maxKeys * 0.9).
+    const maxKeys = 256;
+    const target = Math.floor(maxKeys * 0.9); // 230
+    const d = new SendDedup({ windowMs: 600_000, maxKeys });
+    for (let i = 0; i <= maxKeys; i++) {
+      d.record(`from-${i}`, "bob", `content-${i}`, 1_000 + i);
+    }
+    expect(d.size).toBe(target);
+  });
+
   it("hashes content rather than holding the raw bytes", () => {
     // The key function is the public surface that proves we don't keep
     // raw content in memory between sends — the map keys themselves are

package/src/send_dedup.ts

@@ -44,13 +44,20 @@ export type DedupConfig = {
 };
 
 export function readDedupConfig(env: NodeJS.ProcessEnv = process.env): DedupConfig {
-  const rawWindow = env.COMMHUB_SEND_DEDUP_WINDOW_MS;
-  const windowMs = rawWindow !== undefined ? Math.max(0, Number(rawWindow)) : 300_000;
-  const rawMax = env.COMMHUB_SEND_DEDUP_MAX_KEYS;
-  const maxKeys = rawMax !== undefined ? Math.max(64, Number(rawMax)) : 4096;
+  // Parse-then-validate-then-clamp: `Number("abc")` is NaN and `Math.max(0, NaN)`
+  // is ALSO NaN per spec, so the old inline `Math.max(0, Number(rawWindow))`
+  // relied on the later `Number.isFinite` fallback to repair the result.
+  // Hoisting the validity check first makes the intent explicit and removes
+  // the risk that a future refactor drops the `isFinite` rescue.
+  const parseClamped = (raw: string | undefined, min: number, fallback: number): number => {
+    if (raw === undefined) return fallback;
+    const n = Number(raw);
+    if (!Number.isFinite(n)) return fallback;
+    return Math.max(min, n);
+  };
   return {
-    windowMs: Number.isFinite(windowMs) ? windowMs : 300_000,
-    maxKeys: Number.isFinite(maxKeys) ? maxKeys : 4096,
+    windowMs: parseClamped(env.COMMHUB_SEND_DEDUP_WINDOW_MS, 0, 300_000),
+    maxKeys: parseClamped(env.COMMHUB_SEND_DEDUP_MAX_KEYS, 64, 4096),
   };
 }
 
@@ -133,8 +140,16 @@ export class SendDedup {
   private evictOldest(): void {
     const target = Math.max(64, Math.floor(this.cfg.maxKeys * 0.9));
     if (this.last.size <= target) return;
+    // CACHE toDelete BEFORE the deletion loop. Previously the loop bound
+    // was `i < this.last.size - target`, which is re-evaluated every
+    // iteration — and `this.last.size` shrinks by 1 per delete. The result
+    // was that we only evicted ~half of the intended count (size landed
+    // around 95 % of maxKeys instead of the documented ~90 %). The map
+    // stayed bounded so this was efficiency-only, not a leak, but the
+    // documented contract was being violated.
+    const toDelete = this.last.size - target;
     const entries = Array.from(this.last.entries()).sort((a, b) => a[1] - b[1]);
-    for (let i = 0; i < this.last.size - target; i++) this.last.delete(entries[i][0]);
+    for (let i = 0; i < toDelete; i++) this.last.delete(entries[i][0]);
   }
 }
 

package/src/tools.ts

@@ -498,9 +498,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (updatedTaskId) logTaskEvent(updatedTaskId, null, "replied", alias, "report_completion");
 
       // Auto-chain to parent lineage (mirror of send_reply path).
+      // round5 F2: pass caller's effectiveNetId so the chain refuses
+      // to write across tenants if some upstream parent links to a
+      // foreign network.
       if (updatedTaskId) {
         try {
-          chainReplyToParent(updatedTaskId, result, "replied");
+          chainReplyToParent(updatedTaskId, result, "replied", 5, effectiveNetId);
           const parentChain = db.get<{ parent_task_id: string | null }>(
             "SELECT parent_task_id FROM tasks WHERE task_id = ?1",
             [updatedTaskId]
@@ -698,17 +701,48 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Resolve parent_task_id: explicit > inferred (caller's most recent
       // delivered/started inbox task that's still open). Inference is the
       // safety net for when the LLM forgets to pass parent_task_id.
+      //
+      // round5 F1 fix: the inference SELECT MUST be network-scoped. Without
+      // it, a caller in network B can pick up the parent_task_id of a
+      // network A dispatch and chain-reply into the wrong tenant. The
+      // explicit-parent path is verified below in F2.
       let parentTaskId: string | null = parentIn ?? null;
       if (!parentTaskId && from_session && from_session !== "hub" && from_session !== "api") {
         try {
-          const recent = db.get<{ task_id: string }>(
-            "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered','started') ORDER BY created_at DESC LIMIT 1",
-            [from_session]
-          );
+          const recentParams: any[] = [from_session];
+          let recentSql = "SELECT task_id FROM tasks WHERE to_name = ?1 AND status IN ('delivered','started')";
+          recentSql = addScope(recentSql, recentParams, effectiveNetId);
+          recentSql += " ORDER BY created_at DESC LIMIT 1";
+          const recent = db.get<{ task_id: string }>(recentSql, ...recentParams);
           if (recent?.task_id) parentTaskId = recent.task_id;
         } catch {}
       }
 
+      // round5 F2 fix: an explicit parent_task_id must belong to the
+      // caller's network. Otherwise a malicious caller in network B can
+      // hand us a parent id from network A and have chainReplyToParent
+      // (db.ts) write back into A's task result + inbox — cross-tenant
+      // write. Verify ownership, reject on mismatch.
+      if (parentIn) {
+        const parentRow = db.get<{ network_id: string | null }>(
+          "SELECT network_id FROM tasks WHERE task_id = ?1",
+          [parentIn]
+        );
+        if (!parentRow) {
+          // Parent doesn't exist (LLM hallucination, race with retention
+          // sweep, etc.). Drop the link silently so the dispatch can
+          // still proceed; the LLM may have meant to dispatch fresh.
+          console.log(`[${ts()}] ⚠ send_task: parent_task_id=${parentIn.slice(0, 8)} not found, dropping parent link`);
+          parentTaskId = null;
+        } else if ((parentRow.network_id ?? null) !== (effectiveNetId ?? null)) {
+          console.log(`[${ts()}] 🚫 send_task: cross-network parent rejected, parent=${parentIn.slice(0, 8)} parent-net=${parentRow.network_id ?? "null"} caller-net=${effectiveNetId ?? "null"}`);
+          return { content: [{ type: "text" as const, text: JSON.stringify({
+            ok: false, error: "cross_network_parent",
+            message: "parent_task_id belongs to a different network",
+          }) }] };
+        }
+      }
+
       // Role check: viewer cannot send tasks
       if (!canWrite(effectiveNetId)) {
         return writeDeniedReply(effectiveNetId, "send_task");
@@ -980,9 +1014,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
       // Auto-chain reply up to parent task lineage so admin sees the final
       // answer even if the intermediate session has died.
+      // round5 F2: pass caller's effectiveNetId so the chain refuses
+      // to write across tenants if some upstream parent links to a
+      // foreign network.
       if (replyLogged && in_reply_to) {
         try {
-          chainReplyToParent(in_reply_to, text, replyStatus);
+          chainReplyToParent(in_reply_to, text, replyStatus, 5, effectiveNetId);
           // Push SSE event for parent originator if there is a chain.
           const parentChain = db.get<{ parent_task_id: string | null; from_name: string }>(
             "SELECT parent_task_id, from_name FROM tasks WHERE task_id = ?1",

package/src/uploads.test.ts

@@ -187,6 +187,26 @@ describe("UploadRateLimiter", () => {
     }
     expect(lim.check("token-y", 1000).allowed).toBe(false);
   });
+
+  test("caps in-memory state by evicting oldest entries past maxEntries", () => {
+    // A small maxEntries lets us drive the eviction path deterministically.
+    // Without this cap the limiter would grow unbounded under an IP-flood
+    // (public-facing hub, IPv6 rotation makes each request a "new" key).
+    const lim = new UploadRateLimiter(60_000, 5, 4);
+    const t0 = 1_700_000_000_000;
+    // Fill to cap with non-expired entries — eviction should fire on insert 5.
+    for (let i = 0; i < 4; i++) {
+      lim.check(`key-${i}`, t0);
+    }
+    expect(lim.size()).toBe(4);
+    lim.check("key-new", t0 + 100);
+    expect(lim.size()).toBeLessThanOrEqual(4);
+    // Hitting an EXISTING key while at cap must NOT trigger an eviction
+    // (an attacker hitting the same key shouldn't push out other callers).
+    const beforeSize = lim.size();
+    lim.check("key-new", t0 + 200);
+    expect(lim.size()).toBe(beforeSize);
+  });
 });
 
 describe("validateAttachments", () => {

package/src/uploads.ts

@@ -37,6 +37,12 @@ export const MAX_REQUEST_CONTENT_LENGTH = MAX_UPLOAD_BYTES + 1024 * 1024;
 // the source of truth; resets on restart).
 export const UPLOAD_RATE_WINDOW_MS = 60 * 60 * 1000;
 export const UPLOAD_RATE_MAX_PER_WINDOW = 60;
+// Cap the in-memory rate-limit map so a public-facing hub can't be
+// pushed to OOM by a flood of unique IPs / token ids (the call site
+// uses IP-as-key for legacy auth, which is rotatable cheaply over IPv6).
+// Matches LOGIN_GUARD_MAX_ENTRIES in auth_login_guard.ts for symmetric
+// behaviour across the two in-memory limiters this hub maintains.
+export const UPLOAD_RATE_MAX_ENTRIES = 50_000;
 
 // Strict file_id regex. Generated server-side via crypto.randomUUID()
 // with hyphens stripped, so the natural output is 32 hex chars. The
@@ -159,6 +165,7 @@ export class UploadRateLimiter {
   constructor(
     private readonly windowMs: number = UPLOAD_RATE_WINDOW_MS,
     private readonly maxPerWindow: number = UPLOAD_RATE_MAX_PER_WINDOW,
+    private readonly maxEntries: number = UPLOAD_RATE_MAX_ENTRIES,
   ) {}
 
   /**
@@ -169,6 +176,14 @@ export class UploadRateLimiter {
    * Window is rolling on first touch (not aligned to wall-clock hours).
    */
   check(key: string, nowMs: number = Date.now()): { allowed: boolean; remaining: number; resetAt: number; retryAfterMs?: number } {
+    // Before inserting a brand-new key into a full map, sweep expired
+    // entries and (if still over cap) evict the oldest by insertion order.
+    // Existing-key updates skip the eviction path so an attacker who
+    // keeps hitting the same key can't push out other callers.
+    if (this.state.size >= this.maxEntries && !this.state.has(key)) {
+      this.pruneExpired(nowMs);
+      this.evictOldestUntilBelowCap();
+    }
     const entry = this.state.get(key);
     if (!entry || nowMs >= entry.resetAt) {
       const resetAt = nowMs + this.windowMs;
@@ -191,6 +206,20 @@ export class UploadRateLimiter {
   size(): number {
     return this.state.size;
   }
+
+  private pruneExpired(nowMs: number): void {
+    for (const [key, entry] of this.state) {
+      if (nowMs >= entry.resetAt) this.state.delete(key);
+    }
+  }
+
+  private evictOldestUntilBelowCap(): void {
+    while (this.state.size >= this.maxEntries) {
+      const oldest = this.state.keys().next().value as string | undefined;
+      if (!oldest) return;
+      this.state.delete(oldest);
+    }
+  }
 }
 
 /** Module-level singleton shared by the HTTP /api/upload handler. */