jeo-code 0.8.36 → 0.8.37

package/CHANGELOG.md

@@ -6,6 +6,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.37] - 2026-07-21
+_Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full)._
+
+### Fixed
+- **A dropped/pasted image path with no size limit could read an arbitrarily large file entirely into memory before the format check ever ran** (`src/util/file-attachment.ts`'s `attachImagePaths`) — gjc parity in spirit (#2658's "source size" bound, scoped down for jeo's much simpler single-read attach path — jeo has none of gjc's symlink/hardlink/TOCTOU/remote-`file://`/consent hardening, and doesn't need most of it: unlike gjc's arbitrary bracketed-paste-from-a-possibly-untrusted-clipboard threat model, this reads a path the user directly typed/dropped into their own composer, and the existing magic-byte check already blocks the worst case of exfiltrating an arbitrary non-image file's contents via a misleadingly-named path). The default file reader now `stat()`s the path first and rejects non-files or anything over 25 MiB before ever calling `readFile`, instead of unconditionally reading the whole file into memory first.
+
+### Investigated, confirmed N/A (with direct evidence, not guesses)
+- **#2622** "fail closed on tab worker startup" — gjc's browser tool spawns a separate native-addon-resolving tab-WORKER PROCESS; jeo's `browser-tool.ts` runs Playwright in-process, with no analogous worker-process bootstrap to fail-close on.
+- **#2664** "isolate keybinding configuration arrays" — jeo has no user-configurable keybinding-array system to alias in the first place (confirmed via search: only a static, non-mutable key-hint display in `hints.ts`).
+- **#2665** "share restricted state argv classification" — this hardens gjc's own restricted-role-agent access to a `state` TOOL; jeo's `state.ts` is a human-invoked CLI command only, never a callable agent tool (`DEFAULT_TOOLS` has no `state` entry), so the vulnerability class (a subagent bypassing an argv-based restriction) cannot occur.
+- **#2670** "resource-gc: advance earlier sweep deadlines" — gjc tracks MULTIPLE independently-deadlined cleanup policies behind one shared re-armable timer (the bug: a newly-registered EARLIER deadline didn't preempt it); jeo's `process-reaper.ts` is a single global periodic sweep with no per-policy deadline tracking, so this specific race cannot occur.
+- **#2669** "bound malformed compatible responses" (web-search) — verified live (not just read) that jeo's own `parseOpenAISearchResponse`/`parseGeminiSearchResponse` (added in v0.8.31) already degrade gracefully on a wrong-shaped-but-valid-JSON response body (e.g. `output` being a string instead of an array) via existing `?? []`/`Array.isArray()` guards — fed exactly that shape through both parsers directly; neither threw, both returned an empty-but-valid result. Already correct; no change needed.
+- **#2652** "recover malformed Round 0 intent asks" — specific to gjc's own multi-turn "deep-interview Round 0" AskTool wire-schema/coordinator state machine; jeo's `deep-interview.ts` has no equivalent wire-schema-to-runtime-validation mismatch surface of this shape.
+
+### Verified
+- `test/file-attachment.test.ts` — 18 pass (was 17): new test writes a REAL oversized file (25 MiB + 1 KiB) and a real small PNG to a temp directory and drives them through the REAL (non-injected) filesystem reader — confirms the oversized one is rejected without ever being attached, and the small one still attaches normally through the same code path.
+- Full `bun test` — 3120 pass / 0 fail across 307 files.
+- `bun run typecheck` — no errors.
+
+### Audit status
+- 11 of gjc v0.11.5's ~65 PRs now triaged across this and the prior entry (2 fixed — #2591, #2658's size-cap; 9 confirmed N/A with evidence — #2667, #2749, #2721, #2622, #2664, #2665, #2670, #2669/already-correct, #2652). Tracked as an ongoing goal; remaining PRs continue in subsequent passes.
+
 ## [0.8.36] - 2026-07-21
 _First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase)._
 

package/README.ja.md

@@ -283,11 +283,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
 - **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -284,11 +284,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
 - **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -291,11 +291,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
 - **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -283,11 +283,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
 - **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.36",
+  "version": "0.8.37",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/util/file-attachment.ts

@@ -13,11 +13,23 @@
  * Only paths with a known image extension are considered, so ordinary prose is
  * never mistaken for a file. Non-image / unreadable paths are left untouched.
  */
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import type { ImageAttachment } from "../ai/types";
 
 const IMAGE_EXT_RE = /\.(?:png|jpe?g|gif|webp|bmp)$/i;
 
+/** Reject a dropped/pasted image path bigger than this before reading it fully into
+ *  memory (gjc parity, #2658's "source size" bound in spirit — a scoped-down version
+ *  for jeo's simpler single-read attach path, not the full symlink/TOCTOU/consent
+ *  hardening that PR added for a materially different threat model: gjc validates
+ *  arbitrary bracketed-paste text that may originate from an untrusted clipboard
+ *  source, while this reads a path the user directly typed/dropped into their own
+ *  composer). Without a cap, a stray path to a multi-GB file — a typo, or a dropped
+ *  huge video misidentified by extension — would be read ENTIRELY into memory before
+ *  the magic-byte check below ever gets to reject it. 25 MiB comfortably covers any
+ *  real photo/screenshot while bounding the worst case. */
+export const MAX_ATTACH_IMAGE_BYTES = 25 * 1024 * 1024;
+
 
 /**
  * Normalize the whitespace around every `[image #N]` tag to a single space:
@@ -150,6 +162,8 @@ export type FileReader = (path: string) => Promise<Uint8Array | null>;
 
 const defaultReader: FileReader = async (p) => {
   try {
+    const st = await stat(p);
+    if (!st.isFile() || st.size > MAX_ATTACH_IMAGE_BYTES) return null;
     return new Uint8Array(await readFile(p));
   } catch {
     return null;