@wrongstack/tools 0.297.0 → 0.298.0

package/dist/codebase-index/index.js

@@ -2875,6 +2875,7 @@ var REFS_INDEX_SQL = [
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
+var SEARCH_CANDIDATE_SCAN_CAP = 5e3;
 function normalizeSearchLimit(limit) {
   return typeof limit === "number" && Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : void 0;
 }
@@ -2904,8 +2905,8 @@ function buildWriterSearchWhere(query, filter) {
   }
   if (query.trim()) {
     const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
-    conditions.push(`(${tokens.map(() => "text LIKE ?").join(" OR ")})`);
-    for (const token of tokens) values.push(`%${token}%`);
+    conditions.push(`(${tokens.map(() => "text LIKE ? ESCAPE '\\'").join(" OR ")})`);
+    for (const token of tokens) values.push(`%${escapeLike(token)}%`);
   }
   return { where: conditions.length ? `WHERE ${conditions.join(" AND ")}` : "", values };
 }
@@ -3014,6 +3015,7 @@ var StorePool = class {
 
 // src/codebase-index/writer.ts
 var DB_FILE2 = "index.db";
+var MAX_STATEMENT_CACHE = 128;
 var IndexStore = class _IndexStore {
   db;
   /** Absolute path to this project's index directory. */
@@ -3051,12 +3053,31 @@ var IndexStore = class _IndexStore {
   // Dirty on open so the first getOrBuildBm25() rebuilds against current rows;
   // an empty or pre-existing corpus makes a stale IDF table meaningless.
   bm25Dirty = true;
-  /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+  /**
+   * Prepare-once helper: compile `sql` on first use, reuse thereafter.
+   *
+   * Bounded LRU rather than an open Map. The cache is keyed by SQL TEXT, and
+   * the fallback search builder emits one `text LIKE ?` clause per query token
+   * — so the SQL varies with the token count and a stream of differently-sized
+   * queries grew the cache without limit. Sage's store already bounds its
+   * equivalent at 128 (WS-096).
+   *
+   * Re-inserting on a hit keeps the hot fixed-SQL statements (upsertFile,
+   * insertRefs, …) at the young end, so a burst of one-off search SQL evicts
+   * itself rather than the reindex hot path.
+   */
   stmt(sql) {
-    let s = this.stmtCache.get(sql);
-    if (s === void 0) {
-      s = this.db.prepare(sql);
-      this.stmtCache.set(sql, s);
+    const cached = this.stmtCache.get(sql);
+    if (cached !== void 0) {
+      this.stmtCache.delete(sql);
+      this.stmtCache.set(sql, cached);
+      return cached;
+    }
+    const s = this.db.prepare(sql);
+    this.stmtCache.set(sql, s);
+    if (this.stmtCache.size > MAX_STATEMENT_CACHE) {
+      const oldest = this.stmtCache.keys().next();
+      if (!oldest.done) this.stmtCache.delete(oldest.value);
     }
     return s;
   }
@@ -3329,7 +3350,7 @@ var IndexStore = class _IndexStore {
     const { where, values } = built;
     const limit = normalizeSearchLimit(opts?.limit);
     const limitSql = limit !== void 0 ? " LIMIT ?" : "";
-    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}${limitSql}`;
+    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment FROM symbols ${where}${limitSql}`;
     const binds = limit !== void 0 ? [...values, limit] : values;
     const rows = this.stmt(sql).all(
       ...binds
@@ -3458,11 +3479,13 @@ var IndexStore = class _IndexStore {
   /** Legacy ranked path: LIKE candidates + in-process BM25 + JS snippets. */
   searchRankedFallback(query, filter, limit) {
     if (!query.trim()) {
-      const total = this.countSearch(query, filter);
-      if (total === 0) return { results: [], total: 0 };
-      return { results: this.search(query, filter, { limit }), total };
+      const total2 = this.countSearch(query, filter);
+      if (total2 === 0) return { results: [], total: 0 };
+      return { results: this.search(query, filter, { limit }), total: total2 };
     }
-    const candidates = this.search(query, filter);
+    const total = this.countSearch(query, filter);
+    if (total === 0) return { results: [], total: 0 };
+    const candidates = this.search(query, filter, { limit: SEARCH_CANDIDATE_SCAN_CAP });
     if (candidates.length === 0) return { results: [], total: 0 };
     const candidateById = new Map(candidates.map((c) => [c.id, c]));
     const bm25 = this.getOrBuildBm25();
@@ -3488,7 +3511,7 @@ var IndexStore = class _IndexStore {
       const c = expectDefined(candidateById.get(id));
       return { ...c, score, snippet: bm25.extractSnippet(id, qTokens) };
     });
-    return { results, total: candidates.length };
+    return { results, total };
   }
   getAllIndexable() {
     return getAllIndexableWithStatement((sql) => this.stmt(sql));
@@ -4082,6 +4105,8 @@ var ProjectServerConnection = class {
   connectResolve = null;
   connectReject = null;
   nextId = 1;
+  /** WS-027: read from the owner-only metadata file — see currentAuthToken. */
+  authToken;
   pending = /* @__PURE__ */ new Map();
   transition(status, options = {}) {
     const previous = connectionStates.get(this.endpoint);
@@ -4218,6 +4243,31 @@ var ProjectServerConnection = class {
     this.transition("offline");
     maybeStopHeartbeatLoop();
   }
+  /**
+   * WS-027: the per-process token, read from the daemon's owner-only metadata
+   * file — never from the `hello` frame, which the daemon sends to every
+   * socket that connects (the mistake WS-028 found in the SAGE daemon).
+   *
+   * Read lazily and re-read while unknown: the daemon starts listening before
+   * it writes metadata (endpoint ownership has to be won first), and a
+   * respawned daemon mints a new token, so a cached wrong one would be sticky.
+   */
+  currentAuthToken() {
+    if (this.authToken === void 0) {
+      try {
+        const raw = fs4.readFileSync(
+          projectIndexServerMetadataPath(this.projectRoot, this.indexDir),
+          "utf8"
+        );
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.authToken === "string" && parsed.authToken.length > 0) {
+          this.authToken = parsed.authToken;
+        }
+      } catch {
+      }
+    }
+    return this.authToken;
+  }
   request(message, options) {
     const socket = this.socket;
     if (!socket || socket.destroyed) {
@@ -4261,7 +4311,7 @@ var ProjectServerConnection = class {
           return;
         }
       }
-      this.write({ ...message, id });
+      this.write({ ...message, id, authToken: this.currentAuthToken() });
     });
   }
   async ensureConnected(spawnIfMissing) {
@@ -4308,6 +4358,7 @@ var ProjectServerConnection = class {
   connectOnce() {
     this.socket?.destroy();
     this.socket = null;
+    this.authToken = void 0;
     this.info = null;
     this.activity = null;
     this.health = null;
@@ -6270,8 +6321,9 @@ function runDeadCodeScan(projectRoot, opts = {}) {
         const content = fs12.readFileSync(epFile, "utf8");
         const strippedContent = content.replace(/\/\*[\s\S]*?\*\//g, (m) => " ".repeat(m.length)).replace(/\/\/[^\n]*/g, (m) => " ".repeat(m.length));
         const reExportRe = /export\s+(?:(?:type\s+)?\{[\s\S]*?\}\s+from|\*\s+as\s+\w+\s+from|\*\s+from)\s+['"]([^'"]+)['"]/g;
-        let match;
-        while ((match = reExportRe.exec(strippedContent)) !== null) {
+        for (; ; ) {
+          const match = reExportRe.exec(strippedContent);
+          if (match === null) break;
           const moduleSpec = match[1];
           const resolvedFiles = resolveModulePath(epFile, moduleSpec, indexedFiles);
           for (const rf of resolvedFiles) {

package/dist/codebase-index/project-server-protocol.d.ts

@@ -1,6 +1,10 @@
 import type { OpName, OpShapes } from './worker-protocol.js';
 /** Hard ceiling for one newline-delimited IPC message (measured as JS characters). */
 export declare const PROJECT_INDEX_SERVER_MAX_FRAME_CHARS: number;
+/**
+ * What the daemon tells a connecting client about itself. Carries NO secret —
+ * see {@link ProjectIndexServerMetadata}.
+ */
 export interface ProjectIndexServerInfo {
     protocolVersion: number;
     buildId: string;
@@ -41,11 +45,30 @@ export interface ProjectIndexServerHealth {
     oldestClientIdleMs?: number | undefined;
     activity: ProjectIndexServerActivity;
 }
+/**
+ * The daemon's on-disk metadata file, written 0600. The auth token exists here
+ * and nowhere else — never in the `hello` frame, which the daemon sends to
+ * every socket that connects (the mistake WS-028 found in the SAGE daemon).
+ */
+export interface ProjectIndexServerMetadata extends ProjectIndexServerInfo {
+    authToken: string;
+}
+/**
+ * WS-027: this daemon owns the project's code index — it reads every file in
+ * the repository and answers content queries over it — and it had no handshake
+ * credential at all. Any process that could open the socket could search the
+ * whole codebase through it or drive a reindex. `authToken` comes from the
+ * daemon's owner-only metadata file, so a caller must prove same-user access.
+ *
+ * `cancel` is ungated: it reaches only the sending connection's own in-flight
+ * request, so there is nothing to escalate.
+ */
 export type ProjectServerClientMessage = {
     type: 'request';
     id: number;
     op: OpName;
     args: OpShapes[OpName]['args'];
+    authToken?: string | undefined;
 } | {
     type: 'cancel';
     id: number;
@@ -54,13 +77,16 @@ export type ProjectServerClientMessage = {
     id: number;
     watchExternal: boolean;
     debounceMs: number;
+    authToken?: string | undefined;
 } | {
     type: 'ping';
     id: number;
+    authToken?: string | undefined;
 } | {
     type: 'shutdown';
     id: number;
     reason?: string | undefined;
+    authToken?: string | undefined;
 };
 export type ProjectServerMessage = ({
     type: 'hello';

package/dist/codebase-index/project-server.js

@@ -1972,6 +1972,7 @@ var init_yaml_parser = __esm({
 });
 
 // src/codebase-index/project-server.ts
+import { randomBytes } from "node:crypto";
 import * as fs10 from "node:fs";
 import * as net from "node:net";
 import * as path13 from "node:path";
@@ -2939,6 +2940,7 @@ var REFS_INDEX_SQL = [
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
+var SEARCH_CANDIDATE_SCAN_CAP = 5e3;
 function normalizeSearchLimit(limit) {
   return typeof limit === "number" && Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : void 0;
 }
@@ -2968,8 +2970,8 @@ function buildWriterSearchWhere(query, filter) {
   }
   if (query.trim()) {
     const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
-    conditions.push(`(${tokens.map(() => "text LIKE ?").join(" OR ")})`);
-    for (const token of tokens) values.push(`%${token}%`);
+    conditions.push(`(${tokens.map(() => "text LIKE ? ESCAPE '\\'").join(" OR ")})`);
+    for (const token of tokens) values.push(`%${escapeLike(token)}%`);
   }
   return { where: conditions.length ? `WHERE ${conditions.join(" AND ")}` : "", values };
 }
@@ -3078,6 +3080,7 @@ var StorePool = class {
 
 // src/codebase-index/writer.ts
 var DB_FILE2 = "index.db";
+var MAX_STATEMENT_CACHE = 128;
 var IndexStore = class _IndexStore {
   db;
   /** Absolute path to this project's index directory. */
@@ -3115,12 +3118,31 @@ var IndexStore = class _IndexStore {
   // Dirty on open so the first getOrBuildBm25() rebuilds against current rows;
   // an empty or pre-existing corpus makes a stale IDF table meaningless.
   bm25Dirty = true;
-  /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+  /**
+   * Prepare-once helper: compile `sql` on first use, reuse thereafter.
+   *
+   * Bounded LRU rather than an open Map. The cache is keyed by SQL TEXT, and
+   * the fallback search builder emits one `text LIKE ?` clause per query token
+   * — so the SQL varies with the token count and a stream of differently-sized
+   * queries grew the cache without limit. Sage's store already bounds its
+   * equivalent at 128 (WS-096).
+   *
+   * Re-inserting on a hit keeps the hot fixed-SQL statements (upsertFile,
+   * insertRefs, …) at the young end, so a burst of one-off search SQL evicts
+   * itself rather than the reindex hot path.
+   */
   stmt(sql) {
-    let s = this.stmtCache.get(sql);
-    if (s === void 0) {
-      s = this.db.prepare(sql);
-      this.stmtCache.set(sql, s);
+    const cached = this.stmtCache.get(sql);
+    if (cached !== void 0) {
+      this.stmtCache.delete(sql);
+      this.stmtCache.set(sql, cached);
+      return cached;
+    }
+    const s = this.db.prepare(sql);
+    this.stmtCache.set(sql, s);
+    if (this.stmtCache.size > MAX_STATEMENT_CACHE) {
+      const oldest = this.stmtCache.keys().next();
+      if (!oldest.done) this.stmtCache.delete(oldest.value);
     }
     return s;
   }
@@ -3393,7 +3415,7 @@ var IndexStore = class _IndexStore {
     const { where, values } = built;
     const limit = normalizeSearchLimit(opts?.limit);
     const limitSql = limit !== void 0 ? " LIMIT ?" : "";
-    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}${limitSql}`;
+    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment FROM symbols ${where}${limitSql}`;
     const binds = limit !== void 0 ? [...values, limit] : values;
     const rows = this.stmt(sql).all(
       ...binds
@@ -3522,11 +3544,13 @@ var IndexStore = class _IndexStore {
   /** Legacy ranked path: LIKE candidates + in-process BM25 + JS snippets. */
   searchRankedFallback(query, filter, limit) {
     if (!query.trim()) {
-      const total = this.countSearch(query, filter);
-      if (total === 0) return { results: [], total: 0 };
-      return { results: this.search(query, filter, { limit }), total };
+      const total2 = this.countSearch(query, filter);
+      if (total2 === 0) return { results: [], total: 0 };
+      return { results: this.search(query, filter, { limit }), total: total2 };
     }
-    const candidates = this.search(query, filter);
+    const total = this.countSearch(query, filter);
+    if (total === 0) return { results: [], total: 0 };
+    const candidates = this.search(query, filter, { limit: SEARCH_CANDIDATE_SCAN_CAP });
     if (candidates.length === 0) return { results: [], total: 0 };
     const candidateById = new Map(candidates.map((c) => [c.id, c]));
     const bm25 = this.getOrBuildBm25();
@@ -3552,7 +3576,7 @@ var IndexStore = class _IndexStore {
       const c = expectDefined4(candidateById.get(id));
       return { ...c, score, snippet: bm25.extractSnippet(id, qTokens) };
     });
-    return { results, total: candidates.length };
+    return { results, total };
   }
   getAllIndexable() {
     return getAllIndexableWithStatement((sql) => this.stmt(sql));
@@ -4587,6 +4611,11 @@ var clientLeaseMsRaw = Number(process.env["WRONGSTACK_INDEX_SERVER_CLIENT_LEASE_
 var clientLeaseMs = Number.isFinite(clientLeaseMsRaw) && clientLeaseMsRaw >= 100 ? clientLeaseMsRaw : DEFAULT_CLIENT_LEASE_MS;
 var clientLeaseSweepMs = Math.min(1e4, Math.max(100, Math.floor(clientLeaseMs / 3)));
 var startedAt = (/* @__PURE__ */ new Date()).toISOString();
+var authToken = randomBytes(16).toString("hex");
+var markMetadataWritten;
+var metadataWritten = new Promise((resolve4) => {
+  markMetadataWritten = resolve4;
+});
 var serverInfo = {
   protocolVersion: PROJECT_INDEX_SERVER_PROTOCOL_VERSION,
   buildId: projectIndexServerBuildId(import.meta.url),
@@ -4861,6 +4890,16 @@ async function handleMessage(state, message) {
     state.cancel.get(message.id)?.();
     return;
   }
+  if (message.authToken !== authToken) {
+    send(state, {
+      type: "response",
+      id: message.id,
+      ok: false,
+      error: "Codebase-index IPC request rejected: missing or invalid authToken. Reconnect to refresh metadata (server.json#authToken).",
+      errorName: "UnauthorizedIndexRequest"
+    });
+    return;
+  }
   if (message.type === "ping") {
     send(state, { type: "response", id: message.id, ok: true, result: serverHealth() });
     return;
@@ -5047,7 +5086,8 @@ function removeMetadataIfOwned() {
 function writeMetadata() {
   fs10.mkdirSync(path13.dirname(metadataPath), { recursive: true });
   const temporary = `${metadataPath}.${process.pid}.tmp`;
-  fs10.writeFileSync(temporary, `${JSON.stringify(serverInfo, null, 2)}
+  const metadata = { ...serverInfo, authToken };
+  fs10.writeFileSync(temporary, `${JSON.stringify(metadata, null, 2)}
 `, { mode: 384 });
   try {
     fs10.renameSync(temporary, metadataPath);
@@ -5071,8 +5111,11 @@ var server = net.createServer((socket) => {
     lastSeenAt: Date.now()
   };
   clients.add(state);
-  send(state, { type: "hello", ...serverInfo });
-  send(state, { type: "index-state", state: indexActivity });
+  void metadataWritten.then(() => {
+    if (socket.destroyed) return;
+    send(state, { type: "hello", ...serverInfo });
+    send(state, { type: "index-state", state: indexActivity });
+  });
   socket.on("data", (chunk) => consume(state, chunk));
   socket.on("close", () => {
     for (const cancel of state.cancel.values()) cancel();
@@ -5144,6 +5187,7 @@ server.listen(endpoint, () => {
     }
   }
   writeMetadata();
+  markMetadataWritten?.();
   scheduleIdleStop();
 });
 process.once("SIGINT", () => void stop("SIGINT"));

package/dist/codebase-index/worker.js

@@ -2927,6 +2927,7 @@ var REFS_INDEX_SQL = [
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
+var SEARCH_CANDIDATE_SCAN_CAP = 5e3;
 function normalizeSearchLimit(limit) {
   return typeof limit === "number" && Number.isFinite(limit) ? Math.max(0, Math.trunc(limit)) : void 0;
 }
@@ -2956,8 +2957,8 @@ function buildWriterSearchWhere(query, filter) {
   }
   if (query.trim()) {
     const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
-    conditions.push(`(${tokens.map(() => "text LIKE ?").join(" OR ")})`);
-    for (const token of tokens) values.push(`%${token}%`);
+    conditions.push(`(${tokens.map(() => "text LIKE ? ESCAPE '\\'").join(" OR ")})`);
+    for (const token of tokens) values.push(`%${escapeLike(token)}%`);
   }
   return { where: conditions.length ? `WHERE ${conditions.join(" AND ")}` : "", values };
 }
@@ -3066,6 +3067,7 @@ var StorePool = class {
 
 // src/codebase-index/writer.ts
 var DB_FILE2 = "index.db";
+var MAX_STATEMENT_CACHE = 128;
 var IndexStore = class _IndexStore {
   db;
   /** Absolute path to this project's index directory. */
@@ -3103,12 +3105,31 @@ var IndexStore = class _IndexStore {
   // Dirty on open so the first getOrBuildBm25() rebuilds against current rows;
   // an empty or pre-existing corpus makes a stale IDF table meaningless.
   bm25Dirty = true;
-  /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+  /**
+   * Prepare-once helper: compile `sql` on first use, reuse thereafter.
+   *
+   * Bounded LRU rather than an open Map. The cache is keyed by SQL TEXT, and
+   * the fallback search builder emits one `text LIKE ?` clause per query token
+   * — so the SQL varies with the token count and a stream of differently-sized
+   * queries grew the cache without limit. Sage's store already bounds its
+   * equivalent at 128 (WS-096).
+   *
+   * Re-inserting on a hit keeps the hot fixed-SQL statements (upsertFile,
+   * insertRefs, …) at the young end, so a burst of one-off search SQL evicts
+   * itself rather than the reindex hot path.
+   */
   stmt(sql) {
-    let s = this.stmtCache.get(sql);
-    if (s === void 0) {
-      s = this.db.prepare(sql);
-      this.stmtCache.set(sql, s);
+    const cached = this.stmtCache.get(sql);
+    if (cached !== void 0) {
+      this.stmtCache.delete(sql);
+      this.stmtCache.set(sql, cached);
+      return cached;
+    }
+    const s = this.db.prepare(sql);
+    this.stmtCache.set(sql, s);
+    if (this.stmtCache.size > MAX_STATEMENT_CACHE) {
+      const oldest = this.stmtCache.keys().next();
+      if (!oldest.done) this.stmtCache.delete(oldest.value);
     }
     return s;
   }
@@ -3381,7 +3402,7 @@ var IndexStore = class _IndexStore {
     const { where, values } = built;
     const limit = normalizeSearchLimit(opts?.limit);
     const limitSql = limit !== void 0 ? " LIMIT ?" : "";
-    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment, text FROM symbols ${where}${limitSql}`;
+    const sql = `SELECT id, lang, kind, name, file, line, col, signature, doc_comment FROM symbols ${where}${limitSql}`;
     const binds = limit !== void 0 ? [...values, limit] : values;
     const rows = this.stmt(sql).all(
       ...binds
@@ -3510,11 +3531,13 @@ var IndexStore = class _IndexStore {
   /** Legacy ranked path: LIKE candidates + in-process BM25 + JS snippets. */
   searchRankedFallback(query, filter, limit) {
     if (!query.trim()) {
-      const total = this.countSearch(query, filter);
-      if (total === 0) return { results: [], total: 0 };
-      return { results: this.search(query, filter, { limit }), total };
+      const total2 = this.countSearch(query, filter);
+      if (total2 === 0) return { results: [], total: 0 };
+      return { results: this.search(query, filter, { limit }), total: total2 };
     }
-    const candidates = this.search(query, filter);
+    const total = this.countSearch(query, filter);
+    if (total === 0) return { results: [], total: 0 };
+    const candidates = this.search(query, filter, { limit: SEARCH_CANDIDATE_SCAN_CAP });
     if (candidates.length === 0) return { results: [], total: 0 };
     const candidateById = new Map(candidates.map((c) => [c.id, c]));
     const bm25 = this.getOrBuildBm25();
@@ -3540,7 +3563,7 @@ var IndexStore = class _IndexStore {
       const c = expectDefined4(candidateById.get(id));
       return { ...c, score, snippet: bm25.extractSnippet(id, qTokens) };
     });
-    return { results, total: candidates.length };
+    return { results, total };
   }
   getAllIndexable() {
     return getAllIndexableWithStatement((sql) => this.stmt(sql));

package/dist/codebase-index/writer-search-helpers.d.ts

@@ -19,6 +19,22 @@ export interface WriterSearchRow {
     score?: number;
     snippet?: string;
 }
+/**
+ * Ceiling on how many LIKE candidates the FTS5-less ranked fallback pulls into
+ * memory before scoring (WS-031).
+ *
+ * The fallback ranks with an in-process BM25 pass, so it needs more than the
+ * caller's `limit` (≤100) to rank well — but it does not need the whole corpus.
+ * Without a bound, a broad query on a large index materializes every matching
+ * row as a JS object; this subsystem has a documented OOM history, and search
+ * runs on the request path.
+ *
+ * Set far above any query a human would type, so ranking quality is unchanged
+ * in practice: it bounds the pathological case, it does not shape normal ones.
+ * `total` is reported from a SQL `COUNT(*)` rather than the truncated array, so
+ * capping never makes the reported match count wrong.
+ */
+export declare const SEARCH_CANDIDATE_SCAN_CAP = 5000;
 export declare function normalizeSearchLimit(limit: number | undefined): number | undefined;
 export declare function buildWriterSearchWhere(query: string, filter?: WriterSearchFilter | undefined): {
     where: string;

package/dist/codebase-index/writer.d.ts

@@ -38,7 +38,19 @@ export declare class IndexStore {
      */
     private bm25Cache;
     private bm25Dirty;
-    /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+    /**
+     * Prepare-once helper: compile `sql` on first use, reuse thereafter.
+     *
+     * Bounded LRU rather than an open Map. The cache is keyed by SQL TEXT, and
+     * the fallback search builder emits one `text LIKE ?` clause per query token
+     * — so the SQL varies with the token count and a stream of differently-sized
+     * queries grew the cache without limit. Sage's store already bounds its
+     * equivalent at 128 (WS-096).
+     *
+     * Re-inserting on a hit keeps the hot fixed-SQL statements (upsertFile,
+     * insertRefs, …) at the young end, so a burst of one-off search SQL evicts
+     * itself rather than the reindex hot path.
+     */
     private stmt;
     constructor(projectRoot: string, opts?: {
         indexDir?: string | undefined;

package/dist/design.d.ts

@@ -1,5 +1,5 @@
-import type { Tool } from '@wrongstack/core/types';
 import { type SemanticTune } from '@wrongstack/core/design';
+import type { Tool } from '@wrongstack/core/types';
 type Overrides = Record<string, string>;
 interface DesignInput {
     action?: 'list' | 'use' | 'foundations' | 'set' | 'tune' | 'materialize' | 'verify' | undefined;

package/dist/design.js

@@ -48,6 +48,9 @@ var designTool = {
   description: 'Browse, load, customize, and enforce curated frontend/mobile UI design kits. Use BEFORE writing UI code to commit to one coherent, modern, responsive, dark/light, accessible design. Actions: "list" (menu), "use" (load+pin a kit for a stack), "foundations" (baseline), "set" (override kit colors/tokens), "materialize" (write the tokens to a real theme file \u2014 CSS @theme/OKLCH or native), "verify" (scan UI files for off-palette colors).',
   usageHint: 'Flow: `design {action:"use", kit:"minimal-clarity", stack:"web"}` \u2192 optionally `design {action:"set", set:{primary:"oklch(62% 0.2 25)"}}` \u2192 `design {action:"materialize"}` to write tokens to disk \u2192 implement against them \u2192 `design {action:"verify"}`.',
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; `out` is optional so it cannot be the subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   timeoutMs: 15e3,
@@ -228,9 +231,7 @@ Run \`design {action:"materialize"}\` to write the tuned tokens to your theme fi
       const abs = path.join(absParent, path.basename(absResolved));
       const rel = path.relative(root, abs);
       if (rel.startsWith("..") || path.isAbsolute(rel)) {
-        throw new Error(
-          `design: materialize path "${result.path}" would escape the project root`
-        );
+        throw new Error(`design: materialize path "${result.path}" would escape the project root`);
       }
       let exists = false;
       try {

package/dist/diff.js

@@ -31,6 +31,7 @@ function safeResolve(input, ctx) {
 }
 
 // src/diff.ts
+var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
 var diffTool = {
   name: "diff",
   category: "Filesystem",
@@ -38,6 +39,7 @@ var diffTool = {
   usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
+  maxOutputBytes: 262144,
   capabilities: ["fs.read"],
   icon: "diff",
   timeoutMs: 1e4,
@@ -156,10 +158,18 @@ async function fileDiff(input, ctx, _signal) {
     };
   }
   const results = [];
+  let truncated = false;
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
     const stat2 = await fs.stat(absPath).catch(() => null);
     if (!stat2?.isFile()) continue;
+    if (stat2.size > MAX_FILE_DUMP_BYTES) {
+      truncated = true;
+      results.push(
+        `--- ${file} (skipped: ${stat2.size} bytes exceeds the ${MAX_FILE_DUMP_BYTES} limit; use the read tool with offset/limit) ---`
+      );
+      continue;
+    }
     const content = await fs.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
     results.push(formatWithLineNumbers(file, lines));
@@ -167,7 +177,7 @@ async function fileDiff(input, ctx, _signal) {
   return {
     diff: results.join("\n\n"),
     files,
-    truncated: false,
+    truncated,
     mode: input.mode ?? "unified"
   };
 }

package/dist/e2e.js

@@ -27,12 +27,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -40,13 +41,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -54,8 +58,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 
 // src/e2e.ts