dsh-unlag 1.9.36 → 1.9.37

package/client.js

@@ -15,8 +15,8 @@ window.__ModuleLoader__.load({
      * repeating one generic sentence.
      */
     const REASONS = zh
-      ? { list: '读不到启动信息', slow: '启动信息读得太慢', row: '启动信息不完整', src: '启动脚本没有地址', graph: '已装插件清单读不到', plugin: '有插件已不在运行', script: '启动脚本读不到', empty: '启动脚本是空的', covers: '启动脚本缺插件', parse: '启动脚本内容不完整', verify: '插件后端没有应答' }
-      : { list: 'startup info is unavailable', slow: 'the startup list answered too slowly', row: 'startup info is incomplete', src: 'a startup script has no address', graph: 'the plugin list cannot be read', plugin: 'a plugin is no longer running', script: 'a startup script cannot be read', empty: 'a startup script is empty', covers: 'a startup script misses a plugin', parse: 'a startup script is incomplete', verify: 'the plugin is not answering' };
+      ? { list: '读不到启动信息', slow: '启动信息读得太慢', row: '启动信息不完整', src: '启动脚本没有地址', graph: '已装插件清单读不到', plugin: '有插件已不在运行', script: '启动脚本读不到', empty: '启动脚本是空的', covers: '启动脚本缺插件', parse: '启动脚本内容不完整', size: '启动脚本太大', verify: '插件后端没有应答' }
+      : { list: 'startup info is unavailable', slow: 'the startup list answered too slowly', row: 'startup info is incomplete', src: 'a startup script has no address', graph: 'the plugin list cannot be read', plugin: 'a plugin is no longer running', script: 'a startup script cannot be read', empty: 'a startup script is empty', covers: 'a startup script misses a plugin', parse: 'a startup script is incomplete', size: 'a startup script is too large', verify: 'the plugin is not answering' };
 
     /** The last reason a readiness check refused for, or null after a check that passed. */
     let holdReason = null;
@@ -244,6 +244,7 @@ window.__ModuleLoader__.load({
       missing: 'script', // ui-copy-ignore
       network: 'script', // ui-copy-ignore
       parse: 'parse', // ui-copy-ignore
+      size: 'script', // ui-copy-ignore
       register: 'plugin', // ui-copy-ignore
       slow: 'slow', // ui-copy-ignore
       dependencies: 'covers',

package/index.js

@@ -91,6 +91,14 @@ const DEFAULT_ROOTS = [join(homedir(), '.dsh', 'plugins')]
 const MAX_DEFERRALS = 40
 const MAX_STARTUP_ROWS = 64
 const MAX_STARTUP_ROW_CHARS = 4096
+/**
+ * The largest one startup script may be before a check refuses it. A real client bundle is far
+ * below this; a body past it is either a mistake or an attempt to make a check read (and compile)
+ * an unbounded amount of text inside the process that owns every running turn.
+ */
+const MAX_SCRIPT_BYTES = 8 * 1024 * 1024
+/** The same bound for one whole startup list, so a list of large bodies cannot add up either. */
+const MAX_TOTAL_SCRIPT_BYTES = 32 * 1024 * 1024
 
 /**
  * The most plugin ids one bundle address may name. A real startup list is far below this; a made-up
@@ -1468,6 +1476,7 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
   const listed = new Set()
   const bodies = []
   const began = Date.now()
+  let totalBytes = 0
   for (const item of wanted) {
     if (Date.now() - began > budgetMs) {
       return { status: 'blocked', reason: 'slow', detail: 'the startup list took longer than this check waits' }
@@ -1485,6 +1494,10 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
     }
     const bytes = Buffer.from(await response.arrayBuffer())
     if (bytes.length === 0) return { status: 'blocked', reason: 'empty', detail: `${item.url} answers an empty body` }
+    totalBytes += bytes.length
+    if (bytes.length > MAX_SCRIPT_BYTES || totalBytes > MAX_TOTAL_SCRIPT_BYTES) {
+      return { status: 'blocked', reason: 'size', detail: `${item.url} answers ${String(bytes.length)} bytes; this check reads at most ${String(MAX_SCRIPT_BYTES)} per script and ${String(MAX_TOTAL_SCRIPT_BYTES)} in all` }
+    }
     const text = bytes.toString('utf8')
     const complaint = parseAsScript(text, item.url)
     if (complaint !== null) return { status: 'blocked', reason: 'parse', detail: `${item.url}: ${complaint}` }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.36",
+  "version": "1.9.37",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",