godpowers 3.13.0 → 3.13.2

package/lib/evidence.js

@@ -10,8 +10,9 @@
  * Adaptations from the upstream Node engine (see .provenance.json):
  *   - Mythify's plan/step context becomes Godpowers' arc/substep context.
  *   - The .mythify/ state dir becomes .godpowers/ledger/.
- *   - The jsonl append goes through lib/atomic-write.js (temp + rename) so a
- *     torn record is never visible.
+ *   - The jsonl append uses O_APPEND (fs.appendFileSync) so concurrent writers
+ *     never clobber each other's records; a torn line from an interleaved large
+ *     write is tolerated by the reader, which skips unparseable records.
  *
  * What this adds on top of the upstream engine (the Godpowers integration):
  *   1. .godpowers/ledger/verifications.jsonl: append-only, Mythify-shape record,
@@ -61,6 +62,9 @@ const events = require('./events');
 const TAIL_CHARS = 4000;
 const DEFAULT_TIMEOUT_SECONDS = 300;
 const DIAGNOSTICS_LIMIT = 1000;
+// Cap on captured stdout/stderr per verify command. Exceeding it makes
+// spawnSync raise ENOBUFS and truncate output, so the verdict is unreliable.
+const MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 
 // Substeps whose close gate requires an executed, verified:true record (the
 // runtime/executable-gated tiers). Other substeps (planning, repo, observe,
@@ -161,22 +165,40 @@ function slugify(text) {
     .slice(0, 40);
 }
 
+// SEC-003: mask obvious secret shapes before echoing a command into the
+// human-readable LEDGER-LOG.md. The durable verifications.jsonl record keeps the
+// exact command (it is the audit source of truth); this only protects the log
+// echo. Output tails can still carry secrets, so SECURITY.md documents that
+// .godpowers/ledger/ may capture sensitive output.
+function redactSecrets(text) {
+  return String(text == null ? '' : text)
+    .replace(/\bgh[pousr]_[A-Za-z0-9]{16,}\b/g, 'gh*_***REDACTED***')
+    .replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, 'sk-***REDACTED***')
+    .replace(/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***REDACTED***')
+    .replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, 'xox*-***REDACTED***')
+    .replace(/(--?(?:token|password|passwd|secret|api[-_]?key)[=\s])\S+/gi, '$1***REDACTED***');
+}
+
 // ---------------------------------------------------------------------------
-// Ledger append (atomic, via lib/atomic-write.js) and tolerant read
+// Ledger append (O_APPEND) and tolerant read
 // ---------------------------------------------------------------------------
 
 function appendJsonlAtomic(file, record) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  let existing = '';
-  try {
-    existing = fs.readFileSync(file, 'utf8');
-  } catch (_) {
-    existing = '';
-  }
-  atomic.writeFileAtomic(file, existing + JSON.stringify(record) + '\n');
+  // O_APPEND: each record is written at EOF in a single positioned write, so
+  // two concurrent writers never overwrite each other's record. The previous
+  // read-concat-rewrite was last-writer-wins (it lost records under concurrent
+  // invocation) and rewrote the whole file on every append (O(n) per record).
+  // A torn line from an interleaved oversized write is tolerated by readJsonl,
+  // which skips unparseable records. Mirrors the append in lib/events.js.
+  fs.appendFileSync(file, JSON.stringify(record) + '\n');
   return file;
 }
 
+// Reads the whole ledger into memory. This is bounded and acceptable for a CLI:
+// each record caps its stdout/stderr tails (TAIL_CHARS) so growth is slow, and
+// every consumer reads it once per command, never in a loop. If a long-lived
+// project's ledger ever grows large, add an opt-in prune/size cap here (PERF-002).
 function readJsonl(file) {
   let raw;
   try {
@@ -255,18 +277,27 @@ function runCommand(command, timeoutSeconds) {
     shell: true,
     encoding: 'utf8',
     timeout: Math.round(timeoutSeconds * 1000),
-    maxBuffer: 16 * 1024 * 1024
+    maxBuffer: MAX_OUTPUT_BYTES
   });
   const durationSeconds = Number(process.hrtime.bigint() - startedAt) / 1e9;
   let stdoutTail = tail(run.stdout);
   let stderrTail = tail(run.stderr);
   const timedOut = Boolean(run.error && run.error.code === 'ETIMEDOUT');
+  const bufferOverflow = Boolean(run.error && run.error.code === 'ENOBUFS');
   let exitCode;
   let verified;
   if (timedOut) {
     exitCode = -1;
     verified = false;
     stderrTail = stderrTail + (stderrTail ? '\n' : '') + `(timed out after ${timeoutSeconds} seconds)`;
+  } else if (bufferOverflow) {
+    // Output exceeded the capture buffer: spawnSync truncated stdout/stderr, so
+    // we cannot trust the exit status. Surface this distinctly rather than
+    // folding it into a plain command failure.
+    exitCode = -1;
+    verified = false;
+    stderrTail = stderrTail + (stderrTail ? '\n' : '') +
+      `(output exceeded ${Math.round(MAX_OUTPUT_BYTES / (1024 * 1024))} MB buffer; output truncated and verdict unreliable)`;
   } else if (typeof run.status === 'number') {
     exitCode = run.status;
     verified = exitCode === 0;
@@ -280,7 +311,7 @@ function runCommand(command, timeoutSeconds) {
         : 'command did not produce an exit code';
     stderrTail = stderrTail + (stderrTail ? '\n' : '') + `(${reason})`;
   }
-  return { exitCode, verified, durationSeconds, stdoutTail, stderrTail, timedOut };
+  return { exitCode, verified, durationSeconds, stdoutTail, stderrTail, timedOut, bufferOverflow };
 }
 
 // ---------------------------------------------------------------------------
@@ -449,7 +480,7 @@ function verify(command, opts = {}) {
   appendRecord(projectRoot, record);
   appendLog(
     projectRoot,
-    `verify ${record.verified ? 'PASS' : 'FAIL'} substep=${context.substep || '-'} exit=${record.exit_code} cmd=\`${command}\``
+    `verify ${record.verified ? 'PASS' : 'FAIL'} substep=${context.substep || '-'} exit=${record.exit_code} cmd=\`${redactSecrets(command)}\``
   );
 
   const rollup = rollUp(projectRoot, opts.substep, record);
@@ -818,6 +849,15 @@ function outcomeCheck(name, opts = {}) {
   if (goal.status !== 'active') return { ran: false, reason: `outcome-${goal.status}`, goal };
   if (!goal.verifier) return { ran: false, reason: 'no-verifier', goal };
 
+  // SEC-002: the verifier is a shell command read from goal.json on disk, not
+  // from a live flag, so `outcome check` in a cloned untrusted repo would
+  // otherwise execute a planted command silently. Surface what is about to run
+  // and where it came from before executing. The notice is informational; the
+  // CLI passes one that prints to stderr.
+  if (typeof opts.notice === 'function') {
+    opts.notice({ verifier: goal.verifier, source: outcomeGoalPath(projectRoot, slug) });
+  }
+
   const result = verify(goal.verifier, {
     substep: goal.substep || undefined,
     claim: goal.title,
@@ -901,6 +941,7 @@ module.exports = {
   DEFAULT_TIMEOUT_SECONDS,
   // Internals exposed for tests and the re-sync script.
   _runCommand: runCommand,
+  _redactSecrets: redactSecrets,
   _toStateCommand: toStateCommand,
   _substepContext: substepContext,
   _rollUp: rollUp,

package/lib/gate.js

@@ -215,7 +215,7 @@ function checkStateStepEvidence(projectRoot, tier, result) {
   const stepRef = artifactMap.stateStepForTier(tier);
   if (!stepRef) return null;
 
-  const relPath = '.godpowers/state.json';
+  const relPath = stateStore.STATE_FILE;
   const currentState = stateStore.read(projectRoot);
   if (!currentState) {
     const finding = makeFinding(
@@ -275,7 +275,7 @@ function checkStateStepEvidence(projectRoot, tier, result) {
 // tier-prefixed so the build tier keeps its existing `build-verification-*`
 // contract while harden gains `harden-verification-*`.
 function checkExecutedEvidence(result, step, tier) {
-  const relPath = '.godpowers/state.json';
+  const relPath = stateStore.STATE_FILE;
   if (!step) return;
   const label = tier.charAt(0).toUpperCase() + tier.slice(1);
   const failedCommands = commandsWithStatus(step, 'fail');

package/lib/have-nots-validator.js

@@ -53,9 +53,13 @@ const LABEL_TAGS = ['DECISION', 'HYPOTHESIS', 'OPEN QUESTION', 'OPEN-QUESTION'];
 function findPositions(content, regex) {
   const positions = [];
   const lines = content.split('\n');
+  // Compile once and reuse across lines (PERF-001); reset lastIndex per line so
+  // matching is identical to a fresh per-line regex.
+  const flags = regex.flags.includes('g') ? regex.flags : regex.flags + 'g';
+  const localRegex = new RegExp(regex.source, flags);
   for (let i = 0; i < lines.length; i++) {
+    localRegex.lastIndex = 0;
     let match;
-    const localRegex = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
     while ((match = localRegex.exec(lines[i])) !== null) {
       positions.push({ line: i + 1, column: match.index + 1, matched: match[0] });
     }

package/lib/installer-args.js

@@ -25,9 +25,74 @@ const COMMANDS = new Set([
   'import-ledger'
 ]);
 
-function parseArgs(argv, cwd = process.cwd()) {
-  const args = argv.slice(2);
-  const opts = {
+// Per-command positional slots, filled in order into the first empty slot.
+const POSITIONALS = {
+  state: ['stateAction'],
+  verify: ['verifyCommand'],
+  route: ['routePrompt'],
+  memory: ['memoryAction', 'memoryKey', 'memoryValue'],
+  lesson: ['lessonAction', 'lessonText'],
+  outcome: ['outcomeAction', 'outcomeSlug']
+};
+
+// Boolean flags (and their aliases) -> opts field set to true.
+const BOOL_FLAGS = {
+  '--json': 'json',
+  '--brief': 'brief',
+  '--full': 'full',
+  '--apply': 'apply',
+  '--dry-run': 'dryRun',
+  '--attest': 'attest',
+  '--peek': 'peek',
+  '--all': 'all',
+  '-g': 'global',
+  '--global': 'global',
+  '-l': 'local',
+  '--local': 'local',
+  '-h': 'help',
+  '--help': 'help',
+  '-u': 'uninstall',
+  '--uninstall': 'uninstall'
+};
+
+// Value flags -> opts field. Each accepts both "--flag value" and "--flag=value".
+const VALUE_FLAGS = {
+  '--tier': 'tier',
+  '--step': 'step',
+  '--status': 'status',
+  '--substep': 'substep',
+  '--claim': 'claim',
+  '--timeout': 'timeout',
+  '--evidence': 'evidence',
+  '--since': 'since',
+  '--action': 'reflectAction',
+  '--outcome': 'outcome',
+  '--observation': 'observation',
+  '--root-cause': 'rootCause',
+  '--next': 'nextAction',
+  '--lesson': 'lesson',
+  '--category': 'category',
+  '--tags': 'tags',
+  '--scope': 'scope',
+  '--goal': 'outcomeGoal',
+  '--verify': 'outcomeVerify',
+  '--budget': 'budget',
+  '--reason': 'reason',
+  '--from': 'importFrom',
+  '--profile': 'profile',
+  '--project': 'project',
+  '--name': 'extensionName',
+  '--output': 'extensionOutput',
+  '--skill': 'extensionSkill',
+  '--agent': 'extensionAgent',
+  '--workflow': 'extensionWorkflow'
+};
+
+// Value flags whose value is resolved to an absolute path.
+const PATH_FLAGS = new Set(['--project', '--output']);
+
+function defaultOpts(cwd) {
+  return {
     command: null,
     project: cwd,
     json: false,
@@ -80,301 +145,86 @@ function parseArgs(argv, cwd = process.cwd()) {
     all: false,
     help: false,
     uninstall: false,
-    profile: 'core',
+    profile: 'core'
   };
+}
 
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (COMMANDS.has(arg)) {
-      opts.command = arg;
-      continue;
-    }
-    if (opts.command === 'state' && !opts.stateAction && !arg.startsWith('-')) {
-      opts.stateAction = arg;
-      continue;
-    }
-    if (opts.command === 'verify' && opts.verifyCommand === null && !arg.startsWith('-')) {
-      opts.verifyCommand = arg;
-      continue;
-    }
-    if (opts.command === 'route' && opts.routePrompt === null && !arg.startsWith('-')) {
-      opts.routePrompt = arg;
-      continue;
+function setValue(opts, flag, value) {
+  opts[VALUE_FLAGS[flag]] = PATH_FLAGS.has(flag) ? path.resolve(value) : value;
+}
+
+// Fill the first empty positional slot for the active command. Returns true when
+// the arg was consumed as a positional.
+function consumePositional(opts, arg) {
+  if (arg.startsWith('-')) return false;
+  const slots = POSITIONALS[opts.command];
+  if (!slots) return false;
+  for (const slot of slots) {
+    if (opts[slot] === null) {
+      opts[slot] = arg;
+      return true;
     }
-    if (opts.command === 'memory' && !arg.startsWith('-')) {
-      if (opts.memoryAction === null) { opts.memoryAction = arg; continue; }
-      if (opts.memoryKey === null) { opts.memoryKey = arg; continue; }
-      if (opts.memoryValue === null) { opts.memoryValue = arg; continue; }
+  }
+  return false;
+}
+
+// Handle one flag at args[i]. Returns the index to continue from (advanced past
+// a consumed value for space-form flags).
+function consumeFlag(opts, args, i) {
+  const arg = args[i];
+
+  if (arg in BOOL_FLAGS) {
+    opts[BOOL_FLAGS[arg]] = true;
+    return i;
+  }
+  if (arg === '--minimal') {
+    opts.profile = 'core';
+    return i;
+  }
+  if (arg === '--runtime') {
+    if (args[i + 1]) {
+      opts.runtimes.push(args[i + 1]);
+      return i + 1;
     }
-    if (opts.command === 'lesson' && !arg.startsWith('-')) {
-      if (opts.lessonAction === null) { opts.lessonAction = arg; continue; }
-      if (opts.lessonText === null) { opts.lessonText = arg; continue; }
+    return i;
+  }
+  if (arg.startsWith('--runtime=')) {
+    opts.runtimes.push(arg.slice('--runtime='.length));
+    return i;
+  }
+  if (arg in VALUE_FLAGS) {
+    if (args[i + 1]) {
+      setValue(opts, arg, args[i + 1]);
+      return i + 1;
     }
-    if (opts.command === 'outcome' && !arg.startsWith('-')) {
-      if (opts.outcomeAction === null) { opts.outcomeAction = arg; continue; }
-      if (opts.outcomeSlug === null) { opts.outcomeSlug = arg; continue; }
+    return i;
+  }
+  const eq = arg.indexOf('=');
+  if (arg.startsWith('--') && eq > 0) {
+    const name = arg.slice(0, eq);
+    if (name in VALUE_FLAGS) {
+      setValue(opts, name, arg.slice(eq + 1));
+      return i;
     }
+  }
+  if (arg.startsWith('--') && RUNTIMES[arg.slice(2)]) {
+    opts.runtimes.push(arg.slice(2));
+  }
+  return i;
+}
+
+function parseArgs(argv, cwd = process.cwd()) {
+  const args = argv.slice(2);
+  const opts = defaultOpts(cwd);
 
-    switch (arg) {
-      case '--json':
-        opts.json = true;
-        break;
-      case '--brief':
-        opts.brief = true;
-        break;
-      case '--full':
-        opts.full = true;
-        break;
-      case '--apply':
-        opts.apply = true;
-        break;
-      case '--dry-run':
-        opts.dryRun = true;
-        break;
-      case '--runtime':
-        if (args[i + 1]) {
-          opts.runtimes.push(args[i + 1]);
-          i++;
-        }
-        break;
-      case '--tier':
-        if (args[i + 1]) {
-          opts.tier = args[i + 1];
-          i++;
-        }
-        break;
-      case '--step':
-        if (args[i + 1]) {
-          opts.step = args[i + 1];
-          i++;
-        }
-        break;
-      case '--status':
-        if (args[i + 1]) {
-          opts.status = args[i + 1];
-          i++;
-        }
-        break;
-      case '--substep':
-        if (args[i + 1]) {
-          opts.substep = args[i + 1];
-          i++;
-        }
-        break;
-      case '--claim':
-        if (args[i + 1]) {
-          opts.claim = args[i + 1];
-          i++;
-        }
-        break;
-      case '--timeout':
-        if (args[i + 1]) {
-          opts.timeout = args[i + 1];
-          i++;
-        }
-        break;
-      case '--evidence':
-        if (args[i + 1]) {
-          opts.evidence = args[i + 1];
-          i++;
-        }
-        break;
-      case '--attest':
-        opts.attest = true;
-        break;
-      case '--peek':
-        opts.peek = true;
-        break;
-      case '--since':
-        if (args[i + 1]) {
-          opts.since = args[i + 1];
-          i++;
-        }
-        break;
-      case '--action':
-        if (args[i + 1]) {
-          opts.reflectAction = args[i + 1];
-          i++;
-        }
-        break;
-      case '--outcome':
-        if (args[i + 1]) {
-          opts.outcome = args[i + 1];
-          i++;
-        }
-        break;
-      case '--observation':
-        if (args[i + 1]) {
-          opts.observation = args[i + 1];
-          i++;
-        }
-        break;
-      case '--root-cause':
-        if (args[i + 1]) {
-          opts.rootCause = args[i + 1];
-          i++;
-        }
-        break;
-      case '--next':
-        if (args[i + 1]) {
-          opts.nextAction = args[i + 1];
-          i++;
-        }
-        break;
-      case '--lesson':
-        if (args[i + 1]) {
-          opts.lesson = args[i + 1];
-          i++;
-        }
-        break;
-      case '--category':
-        if (args[i + 1]) {
-          opts.category = args[i + 1];
-          i++;
-        }
-        break;
-      case '--tags':
-        if (args[i + 1]) {
-          opts.tags = args[i + 1];
-          i++;
-        }
-        break;
-      case '--scope':
-        if (args[i + 1]) {
-          opts.scope = args[i + 1];
-          i++;
-        }
-        break;
-      case '--goal':
-        if (args[i + 1]) {
-          opts.outcomeGoal = args[i + 1];
-          i++;
-        }
-        break;
-      case '--verify':
-        if (args[i + 1]) {
-          opts.outcomeVerify = args[i + 1];
-          i++;
-        }
-        break;
-      case '--budget':
-        if (args[i + 1]) {
-          opts.budget = args[i + 1];
-          i++;
-        }
-        break;
-      case '--reason':
-        if (args[i + 1]) {
-          opts.reason = args[i + 1];
-          i++;
-        }
-        break;
-      case '--from':
-        if (args[i + 1]) {
-          opts.importFrom = args[i + 1];
-          i++;
-        }
-        break;
-      case '--project':
-        if (args[i + 1]) {
-          opts.project = path.resolve(args[i + 1]);
-          i++;
-        }
-        break;
-      case '-g':
-      case '--global':
-        opts.global = true;
-        break;
-      case '-l':
-      case '--local':
-        opts.local = true;
-        break;
-      case '--all':
-        opts.all = true;
-        break;
-      case '--minimal':
-        opts.profile = 'core';
-        break;
-      case '--profile':
-        if (args[i + 1]) {
-          opts.profile = args[i + 1];
-          i++;
-        }
-        break;
-      case '-h':
-      case '--help':
-        opts.help = true;
-        break;
-      case '-u':
-      case '--uninstall':
-        opts.uninstall = true;
-        break;
-      default:
-        if (arg.startsWith('--project=')) {
-          opts.project = path.resolve(arg.slice('--project='.length));
-        } else if (arg.startsWith('--name=')) {
-          opts.extensionName = arg.slice('--name='.length);
-        } else if (arg.startsWith('--output=')) {
-          opts.extensionOutput = path.resolve(arg.slice('--output='.length));
-        } else if (arg.startsWith('--skill=')) {
-          opts.extensionSkill = arg.slice('--skill='.length);
-        } else if (arg.startsWith('--agent=')) {
-          opts.extensionAgent = arg.slice('--agent='.length);
-        } else if (arg.startsWith('--workflow=')) {
-          opts.extensionWorkflow = arg.slice('--workflow='.length);
-        } else if (arg.startsWith('--runtime=')) {
-          opts.runtimes.push(arg.slice('--runtime='.length));
-        } else if (arg.startsWith('--tier=')) {
-          opts.tier = arg.slice('--tier='.length);
-        } else if (arg.startsWith('--step=')) {
-          opts.step = arg.slice('--step='.length);
-        } else if (arg.startsWith('--status=')) {
-          opts.status = arg.slice('--status='.length);
-        } else if (arg.startsWith('--substep=')) {
-          opts.substep = arg.slice('--substep='.length);
-        } else if (arg.startsWith('--claim=')) {
-          opts.claim = arg.slice('--claim='.length);
-        } else if (arg.startsWith('--timeout=')) {
-          opts.timeout = arg.slice('--timeout='.length);
-        } else if (arg.startsWith('--evidence=')) {
-          opts.evidence = arg.slice('--evidence='.length);
-        } else if (arg.startsWith('--since=')) {
-          opts.since = arg.slice('--since='.length);
-        } else if (arg.startsWith('--action=')) {
-          opts.reflectAction = arg.slice('--action='.length);
-        } else if (arg.startsWith('--outcome=')) {
-          opts.outcome = arg.slice('--outcome='.length);
-        } else if (arg.startsWith('--observation=')) {
-          opts.observation = arg.slice('--observation='.length);
-        } else if (arg.startsWith('--root-cause=')) {
-          opts.rootCause = arg.slice('--root-cause='.length);
-        } else if (arg.startsWith('--next=')) {
-          opts.nextAction = arg.slice('--next='.length);
-        } else if (arg.startsWith('--lesson=')) {
-          opts.lesson = arg.slice('--lesson='.length);
-        } else if (arg.startsWith('--category=')) {
-          opts.category = arg.slice('--category='.length);
-        } else if (arg.startsWith('--tags=')) {
-          opts.tags = arg.slice('--tags='.length);
-        } else if (arg.startsWith('--scope=')) {
-          opts.scope = arg.slice('--scope='.length);
-        } else if (arg.startsWith('--goal=')) {
-          opts.outcomeGoal = arg.slice('--goal='.length);
-        } else if (arg.startsWith('--verify=')) {
-          opts.outcomeVerify = arg.slice('--verify='.length);
-        } else if (arg.startsWith('--budget=')) {
-          opts.budget = arg.slice('--budget='.length);
-        } else if (arg.startsWith('--reason=')) {
-          opts.reason = arg.slice('--reason='.length);
-        } else if (arg.startsWith('--from=')) {
-          opts.importFrom = arg.slice('--from='.length);
-        } else if (arg.startsWith('--profile=')) {
-          opts.profile = arg.slice('--profile='.length);
-        } else if (arg.startsWith('--') && RUNTIMES[arg.slice(2)]) {
-          opts.runtimes.push(arg.slice(2));
-        }
-        break;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (COMMANDS.has(arg)) {
+      opts.command = arg;
+      continue;
     }
+    if (consumePositional(opts, arg)) continue;
+    i = consumeFlag(opts, args, i);
   }
 
   return opts;

package/lib/installer-core.js

@@ -6,6 +6,7 @@ const { resolveRuntime } = require('./installer-runtimes');
 const { selectedSkillNames, normalizeProfiles } = require('./install-profiles');
 const identity = require('./package-identity');
 const frontmatter = require('./frontmatter');
+const { log, success, error } = require('./cli-log');
 
 const VERSION = identity.PACKAGE_VERSION;
 
@@ -21,18 +22,6 @@ const VERSION = identity.PACKAGE_VERSION;
  * @property {number} agents Number of specialist agent files.
  */
 
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-
-function success(msg) {
-  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
-}
-
-function error(msg) {
-  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
-}
-
 function installSkillFile(srcFile, skillsDest, runtimeKey, targetName = null) {
   const baseName = targetName || path.basename(srcFile, '.md');
   if (runtimeKey === 'codex') {

package/lib/intent.js

@@ -332,15 +332,20 @@ function splitInlineArray(text) {
   return parts;
 }
 
-function cleanArrays(obj) {
-  if (Array.isArray(obj)) return obj.map(cleanArrays);
+// Far beyond any legitimate config nesting; caps recursion so a hostile,
+// thousands-deep YAML file cannot overflow the stack (SEC-002).
+const MAX_CLEAN_DEPTH = 200;
+
+function cleanArrays(obj, depth = 0) {
+  if (depth > MAX_CLEAN_DEPTH) return obj;
+  if (Array.isArray(obj)) return obj.map((v) => cleanArrays(v, depth + 1));
   if (obj && typeof obj === 'object') {
     // Detect array container (legacy or new)
-    if (obj.__items__) return obj.__items__.map(cleanArrays);
+    if (obj.__items__) return obj.__items__.map((v) => cleanArrays(v, depth + 1));
     if (obj.__pending_array__) return obj.__pending_array__;
     const cleaned = {};
     for (const [k, v] of Object.entries(obj)) {
-      cleaned[k] = cleanArrays(v);
+      cleaned[k] = cleanArrays(v, depth + 1);
     }
     return cleaned;
   }