dsh-unlag 1.9.41 → 1.9.43

package/index.js

@@ -90,7 +90,13 @@ const DEFAULT_ROOTS = [join(homedir(), '.dsh', 'plugins')]
 /** A turn that never goes idle must not turn this into an endless poll. */
 const MAX_DEFERRALS = 40
 const MAX_STARTUP_ROWS = 64
-const MAX_STARTUP_ROW_CHARS = 4096
+/**
+ * The longest one startup address may be. The app folds a whole plugin set into one bundle address,
+ * and this profile's largest already measured 2.8 KB: one id list up to MAX_BUNDLE_IDS of normal
+ * plugin names is about 5 KB, so a bound below that would drop a sound address — and a script the
+ * check never reads is a script nothing proved would load in the next document.
+ */
+const MAX_STARTUP_ROW_CHARS = 8192
 /**
  * The largest one startup script may be before a check refuses it. The app serves a whole profile as
  * a few bundles, and those grow with every installed plugin: one profile's largest bundle measured
@@ -1490,7 +1496,12 @@ export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_V
   const wanted = []
   for (const row of offered) {
     if (typeof row !== 'string' || row === '') continue
-    if (row.length > MAX_STARTUP_ROW_CHARS) continue
+    // A row past the bound is a script that will not be read, and a script this check does not read
+    // is one nothing proved the next document could load: refuse the list instead of approving the
+    // part that happened to be readable.
+    if (row.length > MAX_STARTUP_ROW_CHARS) {
+      return { status: 'blocked', reason: 'list', detail: 'the startup list names an address longer than a document loads' }
+    }
     const path = row.includes('://') ? row.replace(/^[a-z]+:\/\/[^/]+/iu, '') : row
     const url = path.startsWith('/') ? path : `/${path.replace(/^\.?\//u, '')}`
     const request = bundleRequest(url)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.41",
+  "version": "1.9.43",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",