chainlesschain 0.162.124 → 0.162.125

package/src/commands/incentive.js

@@ -482,8 +482,8 @@ export function registerIncentiveCommand(program) {
     .command("register-account-v2 <account-id>")
     .description("V2: register a tracked account (tags ACTIVE)")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -511,8 +511,8 @@ export function registerIncentiveCommand(program) {
     .description("V2: transition account status (active|frozen|closed)")
     .option("-r, --reason <reason>", "Reason")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((accountId, status, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, status, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -530,8 +530,8 @@ export function registerIncentiveCommand(program) {
     .command("freeze-account <account-id>")
     .description("V2: shortcut → frozen")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = freezeAccount(db, accountId, opts.reason);
@@ -545,8 +545,8 @@ export function registerIncentiveCommand(program) {
     .command("unfreeze-account <account-id>")
     .description("V2: shortcut → active (from frozen)")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = unfreezeAccount(db, accountId, opts.reason);
@@ -560,8 +560,8 @@ export function registerIncentiveCommand(program) {
     .command("close-account <account-id>")
     .description("V2: shortcut → closed")
     .option("-r, --reason <reason>", "Reason")
-    .action((accountId, opts) => {
-      const ctx = bootstrap();
+    .action(async (accountId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = closeAccount(db, accountId, opts.reason);
@@ -578,8 +578,8 @@ export function registerIncentiveCommand(program) {
     .requiredOption("-a, --amount <amount>", "Amount")
     .option("-c, --contribution <id>", "Contribution ID")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -613,8 +613,8 @@ export function registerIncentiveCommand(program) {
     .description("V2: transition claim (pending|approved|paid|rejected)")
     .option("-r, --reason <reason>", "Reason")
     .option("-m, --metadata <meta>", "Metadata (JSON)")
-    .action((claimId, status, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, status, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const metadata = parseJsonOption(opts.metadata, "--metadata");
@@ -632,8 +632,8 @@ export function registerIncentiveCommand(program) {
     .command("approve-claim <claim-id>")
     .description("V2: shortcut → approved")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = approveClaim(db, claimId, opts.reason);
@@ -647,8 +647,8 @@ export function registerIncentiveCommand(program) {
     .command("reject-claim <claim-id>")
     .description("V2: shortcut → rejected")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = rejectClaim(db, claimId, opts.reason);
@@ -662,8 +662,8 @@ export function registerIncentiveCommand(program) {
     .command("pay-claim <claim-id>")
     .description("V2: shortcut → paid (stamps paidAt)")
     .option("-r, --reason <reason>", "Reason")
-    .action((claimId, opts) => {
-      const ctx = bootstrap();
+    .action(async (claimId, opts) => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const entry = payClaim(db, claimId, opts.reason);
@@ -676,8 +676,8 @@ export function registerIncentiveCommand(program) {
   inc
     .command("auto-expire-unclaimed-claims")
     .description("V2: bulk-reject stale PENDING claims")
-    .action(() => {
-      const ctx = bootstrap();
+    .action(async () => {
+      const ctx = await bootstrap({ verbose: program.opts().verbose });
       try {
         const db = _dbFromCtx(ctx);
         const expired = autoExpireUnclaimedClaims(db);

package/src/commands/mtc.js

@@ -595,7 +595,11 @@ export function registerMtcCommand(program) {
           return;
         }
         if (result.ok) {
-          logger.log(signerInfo ? signerInfo.banner : STOPGAP_BANNER);
+          // `verify` reads envelope+landmark from disk and creates no signer,
+          // so signerInfo is never defined here — referencing it threw a
+          // ReferenceError that the catch reported as "verify failed" on a
+          // SUCCESSFUL verify. Use the stopgap banner directly.
+          logger.log(STOPGAP_BANNER);
           logger.success(`Envelope verified`);
           logger.log(
             `  ${chalk.bold("Subject:")}   ${result.leaf.subject || "(no subject)"}`,

package/src/gateways/ws/message-dispatcher.js

@@ -23,7 +23,10 @@ export function createWsMessageDispatcher(server) {
       }
 
       const client = server.clients.get(clientId);
-      if (server.token && !client.authenticated && type !== "auth") {
+      // client may be undefined if it was removed mid-dispatch (heartbeat sweep
+      // / disconnect); treat a missing client as unauthenticated rather than
+      // throwing a TypeError (every sibling call site null-checks the client).
+      if (server.token && !client?.authenticated && type !== "auth") {
         server._send(ws, {
           id,
           type: "error",

package/src/gateways/ws/ws-session-gateway.js

@@ -109,6 +109,20 @@ export class WSSessionManager {
     this.maxSessions = Number.isFinite(options.maxSessions)
       ? options.maxSessions
       : 100;
+
+    // Cap patch bookkeeping per session. `patchHistory` is append-only (every
+    // applyPatch/rejectPatch pushes, nothing trims) and `pendingPatches` grows
+    // with each proposePatch — both are serialized in full by
+    // _persistSessionState on every session op, so unbounded growth means
+    // O(n) memory AND an O(n²) rewrite cost over a long session (and a tool
+    // proposing many large before/after/diff blobs amplifies it). Keep a
+    // recent window; oldest entries fall off (FIFO).
+    this.maxPatchHistory = Number.isFinite(options.maxPatchHistory)
+      ? options.maxPatchHistory
+      : 200;
+    this.maxPendingPatches = Number.isFinite(options.maxPendingPatches)
+      ? options.maxPendingPatches
+      : 50;
   }
 
   _normalizeEnabledToolNames(enabledToolNames) {
@@ -499,9 +513,7 @@ export class WSSessionManager {
         permanentMemory,
         reviewState: metadata.reviewState || null,
         pendingPatches: this._hydratePendingPatches(metadata.pendingPatches),
-        patchHistory: Array.isArray(metadata.patchHistory)
-          ? metadata.patchHistory
-          : [],
+        patchHistory: this._boundPatchHistory(metadata.patchHistory),
         taskGraph: this._hydrateTaskGraph(metadata.taskGraph),
         interaction: null,
         createdAt: dbSession.created_at,
@@ -889,6 +901,15 @@ export class WSSessionManager {
     if (!(session.pendingPatches instanceof Map)) {
       session.pendingPatches = new Map();
     }
+    // Bound un-reviewed proposals: evict the oldest pending (Map preserves
+    // insertion order) once at cap. 50 unresolved patches is already
+    // pathological; dropping the stalest keeps memory + persisted state bounded
+    // without blocking a legitimate new proposal.
+    while (session.pendingPatches.size >= this.maxPendingPatches) {
+      const oldestKey = session.pendingPatches.keys().next().value;
+      if (oldestKey === undefined) break;
+      session.pendingPatches.delete(oldestKey);
+    }
     session.pendingPatches.set(patchId, patch);
     session.lastActivity = now;
     this._persistSessionState(sessionId);
@@ -917,11 +938,35 @@ export class WSSessionManager {
       session.patchHistory = [];
     }
     session.patchHistory.push(patch);
+    this._trimPatchHistory(session);
     session.lastActivity = patch.resolvedAt;
     this._persistSessionState(sessionId);
     return patch;
   }
 
+  /**
+   * Keep `patchHistory` bounded to the most recent maxPatchHistory entries.
+   * Oldest fall off the front (FIFO) so memory + persisted JSON stay bounded.
+   */
+  _trimPatchHistory(session) {
+    if (!Array.isArray(session.patchHistory)) return;
+    const overflow = session.patchHistory.length - this.maxPatchHistory;
+    if (overflow > 0) {
+      session.patchHistory.splice(0, overflow);
+    }
+  }
+
+  /**
+   * Bound a (possibly persisted/tampered) patchHistory array on load, keeping
+   * the most recent entries. Returns a fresh array (never the input).
+   */
+  _boundPatchHistory(list) {
+    if (!Array.isArray(list)) return [];
+    return list.length > this.maxPatchHistory
+      ? list.slice(list.length - this.maxPatchHistory)
+      : list.slice();
+  }
+
   /**
    * Discard a pending patch. Same bookkeeping as applyPatch but records a
    * "rejected" decision instead.
@@ -944,6 +989,7 @@ export class WSSessionManager {
       session.patchHistory = [];
     }
     session.patchHistory.push(patch);
+    this._trimPatchHistory(session);
     session.lastActivity = patch.resolvedAt;
     this._persistSessionState(sessionId);
     return patch;
@@ -1339,7 +1385,13 @@ export class WSSessionManager {
   _hydratePendingPatches(list) {
     const map = new Map();
     if (Array.isArray(list)) {
-      for (const patch of list) {
+      // Trim from the front so the most recent proposals survive a reload even
+      // if a prior (or tampered) persisted state exceeded the cap.
+      const bounded =
+        list.length > this.maxPendingPatches
+          ? list.slice(list.length - this.maxPendingPatches)
+          : list;
+      for (const patch of bounded) {
         if (patch && patch.patchId) {
           map.set(patch.patchId, patch);
         }

package/src/harness/background-task-manager.js

@@ -194,7 +194,11 @@ export class BackgroundTaskManager extends EventEmitter {
       return history;
     }
 
-    const items = history.slice(offset, offset + limit);
+    // offset + null === offset, so an offset-only page (no limit) used to
+    // slice(offset, offset) === [] and lose every item past the offset. Use
+    // history.length as the end when limit is null.
+    const end = limit === null ? history.length : offset + limit;
+    const items = history.slice(offset, end);
     return {
       items,
       total: history.length,

package/src/harness/jsonl-session-store.js

@@ -21,7 +21,32 @@ function getSessionsDir() {
   return dir;
 }
 
+/**
+ * A session id must be a single safe path segment. Ids are generated as
+ * `session-<ts>-<hex>`, but also arrive from CLI args (`cc agent --resume <id>`,
+ * `cc insights <id>`, `cc session show <id>`), so an id like `../../etc/x` would
+ * otherwise let sessionPath() read / append / delete a .jsonl OUTSIDE the
+ * sessions dir. Reject any separator or `..` (mirrors goal-store's
+ * isUnsafeGoalId / FileUploadService.isUnsafeSegment).
+ */
+export function isUnsafeSessionId(id) {
+  return (
+    id == null ||
+    id === "" ||
+    typeof id !== "string" ||
+    id.includes("/") ||
+    id.includes("\\") ||
+    id.includes("..")
+  );
+}
+
 export function sessionPath(sessionId) {
+  // Fail closed for path building: every write/delete goes through here, so a
+  // traversal id can never escape the sessions dir. Reads guard separately and
+  // degrade to not-found instead of throwing.
+  if (isUnsafeSessionId(sessionId)) {
+    throw new Error(`unsafe session id: ${String(sessionId).slice(0, 60)}`);
+  }
   return join(getSessionsDir(), `${sessionId}.jsonl`);
 }
 
@@ -69,6 +94,7 @@ export function appendCompactEvent(sessionId, stats) {
 }
 
 export function readEvents(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return []; // traversal id → treat as empty
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) return [];
 
@@ -184,6 +210,7 @@ export function forkSession(sourceId) {
 }
 
 export function sessionExists(sessionId) {
+  if (isUnsafeSessionId(sessionId)) return false; // never resolve a traversal id
   return existsSync(sessionPath(sessionId));
 }
 
@@ -266,6 +293,15 @@ export function migrateLegacySessionFile(filePath, options = {}) {
 }
 
 export function validateJsonlSession(sessionId) {
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      sessionId,
+      valid: false,
+      reason: "invalid session id",
+      malformedLines: 0,
+      eventCount: 0,
+    };
+  }
   const filePath = sessionPath(sessionId);
   if (!existsSync(filePath)) {
     return {
@@ -335,6 +371,21 @@ function performLegacySessionMigration(sourcePath, options) {
   const legacy = normalizeLegacySession(parsed, basename(sourcePath, ".json"));
   const sessionId = legacy.id;
 
+  // A legacy file carries its OWN `id` (payload.id), so a crafted file could
+  // name a traversal target like "../../evil". sessionPath() throws on write
+  // (the backstop), but fail-fast HERE with a clear reason so the migration
+  // doesn't burn retry attempts on a deterministic error.
+  if (isUnsafeSessionId(sessionId)) {
+    return {
+      file: sourcePath,
+      sessionId,
+      migrated: false,
+      failed: true,
+      dryRun: Boolean(options.dryRun),
+      reason: "unsafe session id in legacy file",
+    };
+  }
+
   if (!options.force && sessionExists(sessionId)) {
     return {
       file: sourcePath,

package/src/harness/mcp-client.js

@@ -814,19 +814,18 @@ export class MCPClient extends EventEmitter {
       const contentType = response.headers?.get
         ? String(response.headers.get("content-type") || "").toLowerCase()
         : "";
+      // Bound the response body the same way the stdio path bounds its line
+      // buffer (per-server maxBufferChars override; 0 disables).
+      const cap = Number.isFinite(entry.config?.maxBufferChars)
+        ? entry.config.maxBufferChars
+        : MCP_MAX_BUFFER_CHARS;
 
       let envelope;
       if (contentType.includes("text/event-stream")) {
-        envelope = await _extractSseResponse(response, id);
+        envelope = await _extractSseResponse(response, id, cap);
       } else {
-        envelope =
-          typeof response.json === "function"
-            ? await response.json()
-            : JSON.parse(
-                typeof response.text === "function"
-                  ? await response.text()
-                  : "",
-              );
+        const text = await _readBodyCapped(response, cap);
+        envelope = text ? JSON.parse(text) : null;
       }
 
       if (!envelope || typeof envelope !== "object") {
@@ -957,28 +956,70 @@ export class MCPClient extends EventEmitter {
 }
 
 /**
- * Parse a `text/event-stream` HTTP response body and return the first
- * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
- * `data:` chunks, comments, and non-JSON-RPC events.
+ * Read an HTTP response body to text with a hard size cap, mirroring the stdio
+ * transport's MCP_MAX_BUFFER_CHARS guard. The per-call timeout bounds TIME but
+ * not MEMORY: a malicious/buggy HTTP MCP server could stream a multi-GB body
+ * within the timeout and OOM the client. When the body is a readable stream
+ * (real fetch) we accumulate with a running cap and cancel on overflow; for a
+ * non-stream response (test mocks) we fall back to text() + a post-hoc check.
+ * A declared Content-Length over the cap is rejected before any read. cap<=0
+ * disables the limit.
  */
-async function _extractSseResponse(response, requestId) {
-  let text;
-  if (typeof response.text === "function") {
-    text = await response.text();
-  } else if (response.body && typeof response.body.getReader === "function") {
+async function _readBodyCapped(response, cap) {
+  if (
+    cap > 0 &&
+    response.headers &&
+    typeof response.headers.get === "function"
+  ) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > cap) {
+      throw new Error(
+        `MCP HTTP response exceeds the ${cap}-byte cap (content-length ${declared})`,
+      );
+    }
+  }
+  if (response.body && typeof response.body.getReader === "function") {
     const reader = response.body.getReader();
     const decoder = new TextDecoder("utf-8");
     const chunks = [];
-    while (true) {
+    let total = 0;
+    for (;;) {
       const { value, done } = await reader.read();
       if (done) break;
+      total += value && value.length ? value.length : 0;
+      if (cap > 0 && total > cap) {
+        try {
+          await reader.cancel();
+        } catch {
+          /* best-effort — the throw below is what matters */
+        }
+        throw new Error(
+          `MCP HTTP response exceeded the ${cap}-byte cap (runaway server)`,
+        );
+      }
       chunks.push(decoder.decode(value, { stream: true }));
     }
     chunks.push(decoder.decode());
-    text = chunks.join("");
-  } else {
-    throw new Error("SSE response is not readable");
+    return chunks.join("");
+  }
+  if (typeof response.text !== "function") {
+    throw new Error("HTTP response is not readable");
   }
+  const text = await response.text();
+  if (cap > 0 && text.length > cap) {
+    throw new Error(`MCP HTTP response exceeded the ${cap}-char cap`);
+  }
+  return text;
+}
+
+/**
+ * Parse a `text/event-stream` HTTP response body and return the first
+ * JSON-RPC envelope whose id matches `requestId`. Tolerates multiple
+ * `data:` chunks, comments, and non-JSON-RPC events. `cap` bounds the body
+ * size (see _readBodyCapped).
+ */
+async function _extractSseResponse(response, requestId, cap = 0) {
+  const text = await _readBodyCapped(response, cap);
 
   // Split into events on blank line, parse each event's concatenated `data:` lines.
   const events = text.split(/\r?\n\r?\n/);

package/src/harness/prompt-compressor.js

@@ -12,6 +12,12 @@
 import { createHash } from "node:crypto";
 import { feature, featureVariant } from "../lib/feature-flags.js";
 
+// Bounds for the fuzzy near-dup pass in _deduplicate (see there). Generous
+// enough that real near-dups are still caught; small enough that compaction of
+// a long, tool-heavy history stays sub-second instead of O(n²·content).
+const DEDUP_JACCARD_MAX_CHARS = 4000;
+const DEDUP_FUZZY_WINDOW = 100;
+
 export function estimateTokens(text) {
   if (!text) return 0;
   const chineseChars = (text.match(/[\u4e00-\u9fa5]/g) || []).length;
@@ -320,8 +326,18 @@ export class PromptCompressor {
     const last = [...messages].reverse().find((m) => m.role === "user");
     const rest = messages.filter((m) => m.role !== "system" && m !== last);
 
+    // Bound the fuzzy pass so it stays usable on the very conversations
+    // compaction targets (long + tool-heavy). The naive version compared every
+    // message against EVERY prior one (O(n²)) and ran jaccard over full content
+    // (O(content) per compare) — 300 msgs × ~8 KB tool results blocked ~3.4 s.
+    //  • Exact dedup (the md5 hash set) still covers ALL messages.
+    //  • The fuzzy near-dup compare uses a capped prefix (char-set jaccard is
+    //    alphabet-bounded, so a prefix barely changes the decision) and only the
+    //    most-recent kept entries (near-dups cluster; this can only UNDER-dedup,
+    //    never drop a genuinely-distinct message).
     const seen = new Map();
     const deduped = [];
+    const recent = []; // rolling window of recent kept {capped} contents
 
     for (const msg of rest) {
       const content = getContent(msg);
@@ -329,12 +345,13 @@ export class PromptCompressor {
 
       if (seen.has(hash)) continue;
 
+      const capped =
+        content.length > DEDUP_JACCARD_MAX_CHARS
+          ? content.slice(0, DEDUP_JACCARD_MAX_CHARS)
+          : content;
       let isDup = false;
-      for (const [, existing] of seen) {
-        if (
-          jaccardSimilarity(content, getContent(existing)) >=
-          this.similarityThreshold
-        ) {
+      for (const prev of recent) {
+        if (jaccardSimilarity(capped, prev) >= this.similarityThreshold) {
           isDup = true;
           break;
         }
@@ -343,6 +360,8 @@ export class PromptCompressor {
       if (!isDup) {
         seen.set(hash, msg);
         deduped.push(msg);
+        recent.push(capped);
+        if (recent.length > DEDUP_FUZZY_WINDOW) recent.shift();
       }
     }
 

package/src/harness/worktree-isolator.js

@@ -462,7 +462,11 @@ export function applyWorktreeAutomationCandidate(
     const commitMessage =
       options.commitMessage ||
       `Resolve ${filePath} via ${candidate.label || candidateId}`;
-    gitExec(`commit -m "${commitMessage.replace(/"/g, '\\"')}"`, worktree.path);
+    // Free-text message → argv (no shell) so `$()` / backticks / quotes in a
+    // caller-supplied commitMessage can't inject a command. The prior
+    // `-m "${msg.replace(/"/g,'\\"')}"` only neutralized double quotes — the
+    // same gap already fixed in mergeWorktree.
+    gitExecArgs(["commit", "-m", commitMessage], worktree.path);
 
     const diff = diffWorktree(repoDir, branchName, { baseBranch });
     const filesChanged = diff.summary?.filesChanged || 0;

package/src/lib/agent-core.js

@@ -28,6 +28,7 @@ export {
   listBackgroundShellTasks,
   killBackgroundShellTask,
   killAllBackgroundShellTasks,
+  reapIdleBackgroundShellTasks,
   writeFileVerified,
   formatProviderHttpError,
   _accumulateOllamaStream,

package/src/lib/autonomous-agent.js

@@ -48,6 +48,12 @@ export class CLIAutonomousAgent extends EventEmitter {
     this._initialized = false;
     this._maxIterations = 20;
     this._maxRetries = 3;
+    // Cap retained goal history. submitGoal stores every goal in _goals and
+    // nothing removes it; the REPL keeps one long-lived agent for the whole
+    // session, so goals (each holding steps/errors/result) accumulate without
+    // bound — and listGoals() returns the whole growing Map. Prune the oldest
+    // TERMINAL goals beyond this cap; running/pending/paused goals are kept.
+    this._maxGoals = 200;
   }
 
   /**
@@ -58,12 +64,14 @@ export class CLIAutonomousAgent extends EventEmitter {
     toolExecutor,
     hookManager,
     maxIterations,
+    maxGoals,
     iterationBudget,
   } = {}) {
     this._llmChat = llmChat || null;
     this._toolExecutor = toolExecutor || null;
     this._hookManager = hookManager || null;
     if (maxIterations) this._maxIterations = maxIterations;
+    if (Number.isFinite(maxGoals) && maxGoals > 0) this._maxGoals = maxGoals;
     this._iterationBudget = iterationBudget || null; // shared budget from caller
     this._initialized = true;
   }
@@ -96,6 +104,7 @@ export class CLIAutonomousAgent extends EventEmitter {
     };
 
     this._goals.set(goalId, goal);
+    this._pruneGoals();
     this.emit("goal:submitted", { goalId, description });
 
     // Start the ReAct loop asynchronously
@@ -108,6 +117,26 @@ export class CLIAutonomousAgent extends EventEmitter {
     return { goalId };
   }
 
+  /**
+   * Bound retained goal history to _maxGoals. Evicts the oldest TERMINAL goals
+   * (completed/failed/cancelled) FIFO; a still-active goal (pending/running/
+   * paused) is never dropped, so a burst of concurrent goals can briefly exceed
+   * the cap rather than losing live work.
+   */
+  _pruneGoals() {
+    if (this._goals.size <= this._maxGoals) return;
+    for (const [id, g] of this._goals) {
+      if (this._goals.size <= this._maxGoals) break;
+      if (
+        g.status === GoalStatus.COMPLETED ||
+        g.status === GoalStatus.FAILED ||
+        g.status === GoalStatus.CANCELLED
+      ) {
+        this._goals.delete(id);
+      }
+    }
+  }
+
   /**
    * Pause a running goal.
    */

package/src/lib/chat-intent-service.js

@@ -319,7 +319,12 @@ const FOLLOWUP_RULES = {
       /(颜色|字体|大小|位置|标题).*(是|用|为)/,
       /^.{1,20}(应该|具体)(是|为)/,
       /^数据(来源|是)/,
-      /.*(用|采用).*(字体|颜色|大小)/,
+      // De-catastrophized: the old `/.*(用|采用).*(字体…)/` had a leading greedy
+      // `.*` overlapping `(用)`, causing exponential backtracking (a 2 KB input
+      // of "用" took ~3 s). `.test()` already searches anywhere, so the leading
+      // `.*` is redundant; a lazy middle drops it to quadratic, and the input
+      // cap in ruleBasedClassify bounds that.
+      /(用|采用)[\s\S]*?(字体|颜色|大小)/,
     ],
   },
   CANCEL_TASK: {
@@ -334,8 +339,15 @@ const FOLLOWUP_RULES = {
   },
 };
 
+// A follow-up intent (continue / modify / clarify / cancel) is determinable
+// from the start of the message; cap the text the heuristic regexes see so a
+// huge paste can't drive their (quadratic) backtracking into a DoS. The full
+// input is still forwarded to the LLM path / downstream — only this local
+// classification is truncated.
+const MAX_CLASSIFY_INPUT = 2000;
+
 function ruleBasedClassify(userInput) {
-  const input = (userInput || "").trim();
+  const input = (userInput || "").trim().slice(0, MAX_CLASSIFY_INPUT);
 
   if (input.length === 0) {
     return {