@taewooopark/agent-blackbox 0.46.2 → 0.46.4

package/dist/agent-blackbox.plugin.mjs

@@ -184,7 +184,10 @@ var defaultRedactionRules = [
   },
   {
     name: "private-key",
-    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    // Tempered quantifier: the body cannot cross another BEGIN marker. Without it, a
+    // lone BEGIN with no END forces a scan to end-of-string from every BEGIN — O(n²)
+    // backtracking on untrusted tool output peppered with BEGIN markers (slow-path DoS).
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:(?!-----BEGIN )[\s\S])*?-----END [A-Z ]*PRIVATE KEY-----/g,
     replacement: "[REDACTED_PRIVATE_KEY]"
   }
 ];
@@ -1064,7 +1067,10 @@ function createOpenCodeEventFactory(options) {
     const current = typeof output.output === "string" ? output.output : "";
     if (!current)
       return;
-    const key = `${readString2(input, "sessionID") ?? "s"}::${path}`;
+    const args = input.args && typeof input.args === "object" ? input.args : {};
+    const offset = typeof args.offset === "number" ? args.offset : "";
+    const limit = typeof args.limit === "number" ? args.limit : "";
+    const key = `${readString2(input, "sessionID") ?? "s"}::${path}::${offset}:${limit}`;
     const hash = hashContent(current);
     const decision = decideReadServe(readCache.get(key), { hash, content: current }, compactionGen, path);
     readCache.set(key, { hash, content: current, gen: compactionGen });

package/dist/cli.js

@@ -1109,9 +1109,10 @@ function upsertManagedBlock(content, block) {
 ${block}
 `;
 }
+var managedBlockSeamRegExp = () => new RegExp(`\\n*${escapeRegExp(EFFICIENCY_MEMORY_START)}[\\s\\S]*?${escapeRegExp(EFFICIENCY_MEMORY_END)}\\n*`, "g");
 function removeManagedBlock(content) {
   if (!hasManagedBlock(content)) return content;
-  const stripped = content.replace(managedBlockRegExp(), "").replace(/\n{3,}/g, "\n\n").trimEnd();
+  const stripped = content.replace(managedBlockSeamRegExp(), "\n\n").trimEnd();
   return stripped.length === 0 ? "" : `${stripped}
 `;
 }
@@ -1858,7 +1859,7 @@ async function handleRequest(request, response, eventsFile, clients, suggestConf
       sendEmpty(response, 204);
       return;
     }
-    if (request.method === "POST") {
+    if (request.method === "POST" || url.pathname === "/suggest") {
       const origin = request.headers.origin;
       if (typeof origin === "string" && !isLoopbackOrigin(origin)) {
         sendJson(response, 403, { ok: false, error: { message: "cross-site request blocked" } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taewooopark/agent-blackbox",
-  "version": "0.46.2",
+  "version": "0.46.4",
   "description": "Local-first flight recorder + context-efficiency profiler for coding agents (OpenCode). Run with npx.",
   "type": "module",
   "license": "MIT",