dsh-unlag 1.9.36 → 1.9.38

package/client.js

@@ -15,8 +15,8 @@ window.__ModuleLoader__.load({
      * repeating one generic sentence.
      */
     const REASONS = zh
-      ? { list: '读不到启动信息', slow: '启动信息读得太慢', row: '启动信息不完整', src: '启动脚本没有地址', graph: '已装插件清单读不到', plugin: '有插件已不在运行', script: '启动脚本读不到', empty: '启动脚本是空的', covers: '启动脚本缺插件', parse: '启动脚本内容不完整', verify: '插件后端没有应答' }
-      : { list: 'startup info is unavailable', slow: 'the startup list answered too slowly', row: 'startup info is incomplete', src: 'a startup script has no address', graph: 'the plugin list cannot be read', plugin: 'a plugin is no longer running', script: 'a startup script cannot be read', empty: 'a startup script is empty', covers: 'a startup script misses a plugin', parse: 'a startup script is incomplete', verify: 'the plugin is not answering' };
+      ? { list: '读不到启动信息', slow: '启动信息读得太慢', row: '启动信息不完整', src: '启动脚本没有地址', graph: '已装插件清单读不到', plugin: '有插件已不在运行', script: '启动脚本读不到', empty: '启动脚本是空的', covers: '启动脚本缺插件', parse: '启动脚本内容不完整', size: '启动脚本太大', verify: '插件后端没有应答' }
+      : { list: 'startup info is unavailable', slow: 'the startup list answered too slowly', row: 'startup info is incomplete', src: 'a startup script has no address', graph: 'the plugin list cannot be read', plugin: 'a plugin is no longer running', script: 'a startup script cannot be read', empty: 'a startup script is empty', covers: 'a startup script misses a plugin', parse: 'a startup script is incomplete', size: 'a startup script is too large', verify: 'the plugin is not answering' };
 
     /** The last reason a readiness check refused for, or null after a check that passed. */
     let holdReason = null;
@@ -244,6 +244,7 @@ window.__ModuleLoader__.load({
       missing: 'script', // ui-copy-ignore
       network: 'script', // ui-copy-ignore
       parse: 'parse', // ui-copy-ignore
+      size: 'script', // ui-copy-ignore
       register: 'plugin', // ui-copy-ignore
       slow: 'slow', // ui-copy-ignore
       dependencies: 'covers',

package/index.js

@@ -91,6 +91,14 @@ const DEFAULT_ROOTS = [join(homedir(), '.dsh', 'plugins')]
 const MAX_DEFERRALS = 40
 const MAX_STARTUP_ROWS = 64
 const MAX_STARTUP_ROW_CHARS = 4096
+/**
+ * The largest one startup script may be before a check refuses it. A real client bundle is far
+ * below this; a body past it is either a mistake or an attempt to make a check read (and compile)
+ * an unbounded amount of text inside the process that owns every running turn.
+ */
+const MAX_SCRIPT_BYTES = 8 * 1024 * 1024
+/** The same bound for one whole startup list, so a list of large bodies cannot add up either. */
+const MAX_TOTAL_SCRIPT_BYTES = 32 * 1024 * 1024
 
 /**
  * The most plugin ids one bundle address may name. A real startup list is far below this; a made-up
@@ -98,6 +106,18 @@ const MAX_STARTUP_ROW_CHARS = 4096
  * is work the request itself must not be able to grow without bound.
  */
 const MAX_BUNDLE_IDS = 128
+/**
+ * How long one stale-bundle answer may spend before it gives the request back to the app's own
+ * route. Each row is bounded on its own, but a request can name many rows and the route answers
+ * whatever a socket asks: without a whole-request bound one made-up address holds a connection for
+ * as long as its rows add up.
+ */
+const MAX_ANSWER_MS = 15_000
+/** The same bound for a test that must reach it quickly. */
+function answerBudgetMs() {
+  const set = Number(process.env.DSH_UNLAG_STALE_MS ?? '')
+  return set > 0 ? set : MAX_ANSWER_MS
+}
 /**
  * How long one startup check may spend reading the list. Each address is bounded on its own, but a
  * list of them is not: dozens of slow addresses would otherwise hold a press past the moment the
@@ -966,10 +986,11 @@ async function currentEntryBody(clientModules, graph, id) {
  * answering with them in the requested order registers exactly the plugins the document expects,
  * so a boot that would otherwise 404 and end the app comes up instead.
  */
-async function regroupedBundleAnswer(clientModules, graph, request) {
+async function regroupedBundleAnswer(clientModules, graph, request, deadline = Date.now() + answerBudgetMs()) {
   if (request.sourceMap) return null
   const parts = []
   for (const id of request.ids) {
+    if (Date.now() > deadline) return null
     const body = await currentEntryBody(clientModules, graph, id)
     if (body === null) return null
     parts.push(body)
@@ -997,7 +1018,7 @@ async function regroupedBundleAnswer(clientModules, graph, request) {
  * booting from an old startup list that meets one ends the whole app: a boot that comes up without
  * a plugin it no longer has beats that.
  */
-async function survivingBundleAnswer(clientModules, graph, request) {
+async function survivingBundleAnswer(clientModules, graph, request, deadline = Date.now() + answerBudgetMs()) {
   if (request.sourceMap) return null
   const entries = Array.isArray(graph?.entries) ? graph.entries : []
   const served = new Set(entries.filter((row) => typeof row?.id === 'string').map((row) => row.id))
@@ -1005,6 +1026,7 @@ async function survivingBundleAnswer(clientModules, graph, request) {
   if (gone.length === 0) return null
   const parts = []
   for (const id of request.ids) {
+    if (Date.now() > deadline) return null
     if (served.has(id)) {
       const body = await currentEntryBody(clientModules, graph, id)
       if (body === null) return null
@@ -1023,7 +1045,7 @@ async function survivingBundleAnswer(clientModules, graph, request) {
  * that really contains every plugin it claims is handed back; anything unsure answers null, so the
  * route then behaves exactly as before and an unknown id still ends as a plain 404.
  */
-async function currentBundleAnswer(clientModules, method, url) {
+async function currentBundleAnswer(clientModules, method, url, deadline = Date.now() + answerBudgetMs()) {
   const request = bundleRequest(url)
   if (request === null) return null
   const graph = clientModules.graph()
@@ -1049,7 +1071,7 @@ async function currentBundleAnswer(clientModules, method, url) {
       }
     }
   }
-  return (await regroupedBundleAnswer(clientModules, graph, request)) ?? survivingBundleAnswer(clientModules, graph, request)
+  return (await regroupedBundleAnswer(clientModules, graph, request, deadline)) ?? survivingBundleAnswer(clientModules, graph, request, deadline)
 }
 
 /** Answer one stale request over the plain request/response route an app registers. */
@@ -1468,6 +1490,7 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
   const listed = new Set()
   const bodies = []
   const began = Date.now()
+  let totalBytes = 0
   for (const item of wanted) {
     if (Date.now() - began > budgetMs) {
       return { status: 'blocked', reason: 'slow', detail: 'the startup list took longer than this check waits' }
@@ -1485,6 +1508,10 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
     }
     const bytes = Buffer.from(await response.arrayBuffer())
     if (bytes.length === 0) return { status: 'blocked', reason: 'empty', detail: `${item.url} answers an empty body` }
+    totalBytes += bytes.length
+    if (bytes.length > MAX_SCRIPT_BYTES || totalBytes > MAX_TOTAL_SCRIPT_BYTES) {
+      return { status: 'blocked', reason: 'size', detail: `${item.url} answers ${String(bytes.length)} bytes; this check reads at most ${String(MAX_SCRIPT_BYTES)} per script and ${String(MAX_TOTAL_SCRIPT_BYTES)} in all` }
+    }
     const text = bytes.toString('utf8')
     const complaint = parseAsScript(text, item.url)
     if (complaint !== null) return { status: 'blocked', reason: 'parse', detail: `${item.url}: ${complaint}` }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.36",
+  "version": "1.9.38",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",