kritya 0.8.22-beta → 0.8.23-beta

package/dist/agent/toolExecutor.js

@@ -1,8 +1,29 @@
 import { classifyDanger } from "../permissions/danger.js";
 import { acknowledgeUnsandboxedFallback, sandboxFallbackWarning } from "../shell/sandbox.js";
 import { isPlanningDocWrite, loadProjectState } from "./workflow.js";
+import { redactSecrets } from "../tools/secretScan.js";
 /** How much tool output to hand the UI (it shows a preview and expands on toggle). */
 const PREVIEW_CHARS = 4000;
+/**
+ * Upper bound on a raw tool-call argument payload, checked before JSON.parse.
+ * Individual tools cap their own inputs where it matters (e.g. write_file
+ * content), but this is a backstop against a malformed or adversarial model
+ * response ballooning memory before any tool-specific validation runs.
+ */
+const MAX_ARGS_JSON_CHARS = 2_000_000;
+/**
+ * Backstop cap on what a tool can return to the model, applied after every
+ * tool call regardless of whether that tool already truncates its own
+ * output (most do, via truncateResult/truncateTail — see src/tools/common.ts
+ * — but this catches the ones that don't, or a tool with a bug).
+ */
+const MAX_TOOL_OUTPUT_CHARS = 200_000;
+function truncateToolOutput(output) {
+    if (output.length <= MAX_TOOL_OUTPUT_CHARS)
+        return output;
+    return (output.slice(0, MAX_TOOL_OUTPUT_CHARS) +
+        `\n... [truncated, ${output.length - MAX_TOOL_OUTPUT_CHARS} more characters]`);
+}
 /**
  * A tool outlived its deadline and was abandoned. Carries the tool's name so
  * the message handed back to the model names what to avoid retrying blindly.
@@ -96,6 +117,10 @@ export class ToolExecutor {
         const tool = this.tools.find((t) => t.name === name);
         if (!tool)
             return `Error: unknown tool "${name}"`;
+        if (argsJson.length > MAX_ARGS_JSON_CHARS) {
+            return (`Error: tool arguments for "${name}" are too large ` +
+                `(${argsJson.length} characters, max ${MAX_ARGS_JSON_CHARS}). Use a smaller input.`);
+        }
         let args;
         try {
             args = JSON.parse(argsJson);
@@ -105,7 +130,13 @@ export class ToolExecutor {
         }
         let summary;
         try {
-            summary = tool.summarize(args);
+            // A tool's own summarize() may embed raw values (a fetch_url query
+            // string, a search query, arbitrary text) that happen to contain a
+            // secret the model saw earlier in the conversation. This is the one
+            // chokepoint every tool's summary passes through before it's written
+            // to the audit log and telemetry, so redact here rather than trusting
+            // every individual tool to have already done it.
+            summary = redactSecrets(tool.summarize(args)).redacted;
         }
         catch {
             summary = name;
@@ -291,6 +322,7 @@ export class ToolExecutor {
                 if (post.output.trim())
                     output += `\n[postToolUse hook]: ${post.output.trim()}`;
             }
+            output = truncateToolOutput(output);
             const failed = tool.failed?.(output) ?? false;
             logToolOutcome(failed ? "error" : "ok");
             finishSpan(failed ? "ERROR" : "OK");

package/dist/audit/audit.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnUser } from "../config/debug.js";
 const GENESIS = "0".repeat(64);
 /**
  * Where all audit logs live, across every workspace (not scoped per-project).
@@ -108,7 +108,7 @@ export class AuditLog {
         }
         catch (err) {
             // best-effort
-            debugLog(`AuditLog.write(${this.file})`, err);
+            warnUser(`AuditLog.write(${this.file})`, err);
         }
     }
     ensureDir() {

package/dist/config/config.js

@@ -2,8 +2,103 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { hardenWindowsDir } from "./winAcl.js";
-import { debugLog } from "./debug.js";
+import { debugLog, warnUser } from "./debug.js";
 import { writeFileAtomicSync } from "../atomicWrite.js";
+import { assertJsonWithinLimits } from "./jsonSafety.js";
+/**
+ * Bounds on `mcpServers` entries (from config.json or a workspace's
+ * .mcp.json) — without these, an oversized or malicious server list could
+ * balloon memory, or a single field (a giant command string, thousands of
+ * headers) could be used to abuse whatever eventually consumes it (a shell
+ * spawn, an HTTP client). Real MCP server configs are tiny; these limits are
+ * generous multiples of anything legitimate.
+ */
+const MAX_MCP_SERVERS = 50;
+const MAX_MCP_COMMAND_LENGTH = 4096;
+const MAX_MCP_ARGS = 200;
+const MAX_MCP_ARG_LENGTH = 4096;
+const MAX_MCP_URL_LENGTH = 8192;
+const MAX_MCP_CWD_LENGTH = 4096;
+const MAX_MCP_MAP_ENTRIES = 200;
+const MAX_MCP_MAP_VALUE_LENGTH = 16384;
+function sanitizeMcpStringMap(rec, label) {
+    if (!rec)
+        return undefined;
+    const entries = Object.entries(rec);
+    const out = {};
+    let kept = 0;
+    for (const [k, v] of entries) {
+        if (kept >= MAX_MCP_MAP_ENTRIES) {
+            warnUser(label, new Error(`more than ${MAX_MCP_MAP_ENTRIES} entries; extra entries dropped`));
+            break;
+        }
+        if (typeof v !== "string" || v.length > MAX_MCP_MAP_VALUE_LENGTH) {
+            warnUser(label, new Error(`entry "${k}" exceeds ${MAX_MCP_MAP_VALUE_LENGTH} char limit; dropped`));
+            continue;
+        }
+        out[k] = v;
+        kept++;
+    }
+    return out;
+}
+/** Validates one server entry against the bounds above; returns null to drop the whole server. */
+export function sanitizeMcpServerConfig(name, cfg) {
+    if (typeof cfg.command === "string" && cfg.command.length > MAX_MCP_COMMAND_LENGTH) {
+        warnUser(`mcpServers.${name}.command`, new Error(`exceeds ${MAX_MCP_COMMAND_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.url === "string" && cfg.url.length > MAX_MCP_URL_LENGTH) {
+        warnUser(`mcpServers.${name}.url`, new Error(`exceeds ${MAX_MCP_URL_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    if (typeof cfg.cwd === "string" && cfg.cwd.length > MAX_MCP_CWD_LENGTH) {
+        warnUser(`mcpServers.${name}.cwd`, new Error(`exceeds ${MAX_MCP_CWD_LENGTH} char limit; server dropped`));
+        return null;
+    }
+    let args = cfg.args;
+    if (args) {
+        if (args.length > MAX_MCP_ARGS) {
+            warnUser(`mcpServers.${name}.args`, new Error(`${args.length} args exceeds limit of ${MAX_MCP_ARGS}; extra args dropped`));
+            args = args.slice(0, MAX_MCP_ARGS);
+        }
+        if (args.some((a) => typeof a !== "string" || a.length > MAX_MCP_ARG_LENGTH)) {
+            warnUser(`mcpServers.${name}.args`, new Error(`an argument exceeds ${MAX_MCP_ARG_LENGTH} char limit; server dropped`));
+            return null;
+        }
+    }
+    return {
+        ...cfg,
+        args,
+        env: sanitizeMcpStringMap(cfg.env, `mcpServers.${name}.env`),
+        headers: sanitizeMcpStringMap(cfg.headers, `mcpServers.${name}.headers`),
+    };
+}
+/** Caps server count and validates each entry; oversized/malformed servers are dropped, not truncated. */
+export function sanitizeMcpServersRecord(servers, label = "mcpServers") {
+    if (!servers)
+        return undefined;
+    const names = Object.keys(servers);
+    if (names.length > MAX_MCP_SERVERS) {
+        warnUser(label, new Error(`${names.length} servers exceeds limit of ${MAX_MCP_SERVERS}; extra servers dropped`));
+    }
+    const out = {};
+    let kept = 0;
+    for (const name of names) {
+        if (kept >= MAX_MCP_SERVERS)
+            break;
+        const sanitized = sanitizeMcpServerConfig(name, servers[name]);
+        if (sanitized) {
+            out[name] = sanitized;
+            kept++;
+        }
+    }
+    return out;
+}
+function sanitizeCliConfig(config) {
+    if (!config.mcpServers)
+        return config;
+    return { ...config, mcpServers: sanitizeMcpServersRecord(config.mcpServers) };
+}
 export const CONFIG_DIR = path.join(os.homedir(), ".kritya");
 export const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 export const NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
@@ -102,16 +197,25 @@ export function listProviders(config) {
         .map((name) => ({ name, hasKey: !!resolveProvider(config, name).apiKey }));
 }
 export function loadConfig() {
+    let raw;
     try {
-        const raw = fs.readFileSync(CONFIG_FILE, "utf8");
-        return JSON.parse(raw);
+        raw = fs.readFileSync(CONFIG_FILE, "utf8");
     }
     catch (err) {
-        // A missing file is normal on first run; a malformed one is worth being
-        // able to see when someone reports "my config isn't taking effect".
+        // A missing file is normal on first run.
         debugLog(`loadConfig(${CONFIG_FILE})`, err);
         return {};
     }
+    try {
+        assertJsonWithinLimits(raw, "config.json");
+        return sanitizeCliConfig(JSON.parse(raw));
+    }
+    catch (err) {
+        // Malformed or oversized — worth being able to see when someone reports
+        // "my config isn't taking effect".
+        warnUser(`loadConfig(${CONFIG_FILE})`, err);
+        return {};
+    }
 }
 /**
  * Persist `model` as the default for one provider, leaving every other

package/dist/config/debug.js

@@ -17,3 +17,33 @@ export function debugLog(context, err) {
         // stderr itself failing isn't something debug logging can do anything about
     }
 }
+/**
+ * For best-effort persistence that a user actually needs to know failed
+ * (session/audit/telemetry writes) — unlike debugLog, this always prints a
+ * short one-line warning to stderr, not just under KRITYA_DEBUG. The full
+ * stack trace still only shows up under KRITYA_DEBUG, via the debugLog call
+ * this makes internally.
+ */
+/**
+ * Contexts already warned about via warnUser() this process. Some of these
+ * (a telemetry sink retried every span, an append() called every turn) would
+ * otherwise print the same warning on every single failure — once per
+ * context is enough to tell the user something is wrong without flooding
+ * the terminal.
+ */
+const warnedContexts = new Set();
+export function warnUser(context, err) {
+    if (warnedContexts.has(context)) {
+        debugLog(context, err);
+        return;
+    }
+    warnedContexts.add(context);
+    const message = err instanceof Error ? err.message : String(err);
+    try {
+        process.stderr.write(`[kritya] warning: ${context} failed: ${message}\n`);
+    }
+    catch {
+        // stderr itself failing isn't something this can do anything about
+    }
+    debugLog(context, err);
+}

package/dist/config/jsonSafety.js

@@ -0,0 +1,69 @@
+/**
+ * Shared bounds checks for JSON config files (config.json, .mcp.json) read
+ * from disk. These files are small by nature, so a huge file or pathological
+ * nesting is either corruption or a deliberately hostile input (e.g. a
+ * malicious .mcp.json checked into a repo someone was talked into trusting)
+ * — either way, better to refuse it than to hand an unbounded string or
+ * object graph to JSON.parse and whatever reads the result afterwards.
+ */
+/** Config files this small in practice; anything past this is refused outright. */
+export const MAX_CONFIG_JSON_BYTES = 5 * 1024 * 1024;
+/**
+ * Deep nesting costs stack frames in every recursive consumer downstream
+ * (JSON.stringify on save, object spreads, etc.), not just JSON.parse
+ * itself. Real configs nest a handful of levels deep at most.
+ */
+export const MAX_JSON_DEPTH = 64;
+export class JsonSafetyError extends Error {
+}
+/** Throws if `raw` is larger than `maxBytes` (measured in UTF-8 bytes, not chars). */
+export function assertJsonSizeWithinLimit(raw, maxBytes = MAX_CONFIG_JSON_BYTES, label = "JSON") {
+    if (Buffer.byteLength(raw, "utf8") > maxBytes) {
+        throw new JsonSafetyError(`${label} exceeds ${maxBytes} byte limit`);
+    }
+}
+/**
+ * Throws if the raw JSON text nests objects/arrays deeper than `maxDepth`.
+ * Scans the text directly rather than the parsed tree, so a hostile input is
+ * rejected before JSON.parse ever builds it. String contents (which may
+ * contain unbalanced-looking brace/bracket characters) are skipped rather
+ * than scanned, respecting escapes so an escaped quote doesn't end the
+ * string early.
+ */
+export function assertJsonDepthWithinLimit(raw, maxDepth = MAX_JSON_DEPTH, label = "JSON") {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (ch === "\\") {
+                escaped = true;
+            }
+            else if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === "{" || ch === "[") {
+            depth++;
+            if (depth > maxDepth) {
+                throw new JsonSafetyError(`${label} nests deeper than ${maxDepth} levels`);
+            }
+        }
+        else if (ch === "}" || ch === "]") {
+            depth--;
+        }
+    }
+}
+/** Runs both the size and depth checks together — the usual entry point before JSON.parse. */
+export function assertJsonWithinLimits(raw, label, maxBytes = MAX_CONFIG_JSON_BYTES, maxDepth = MAX_JSON_DEPTH) {
+    assertJsonSizeWithinLimit(raw, maxBytes, label);
+    assertJsonDepthWithinLimit(raw, maxDepth, label);
+}

package/dist/hooks/hooks.js

@@ -5,6 +5,7 @@ import { CONFIG_DIR, scrubbedShellEnv } from "../config/config.js";
 import { safeCompileRegex } from "../tools/common.js";
 import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { debugLog } from "../config/debug.js";
+import { redactSecrets } from "../tools/secretScan.js";
 const HOOK_TIMEOUT_MS = 30_000;
 export function loadHooks(workspace, trustWorkspace = true) {
     const merged = {};
@@ -85,7 +86,12 @@ export class HookRunner {
                 parent,
                 attributes: { "kritya.hook_command": def.command, "kritya.hook_tool": toolName },
             });
-            const { ok, output } = await execHook(def.command, this.workspace, env);
+            // Hook stdout/stderr is arbitrary command output — it can echo back
+            // whatever the command saw (an env var, a file's contents), so it goes
+            // through the same secret redaction as shell output before it's kept
+            // in the span or handed back to the model.
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, env);
+            const output = redactSecrets(rawOutput).redacted;
             if (output)
                 outputs.push(output);
             if (!ok && event === "preToolUse" && def.blocking) {
@@ -107,7 +113,8 @@ export class HookRunner {
                 attributes: { "kritya.hook_command": def.command },
             });
             // stop hooks are best-effort; failures are ignored beyond the span.
-            const { ok, output } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const { ok, output: rawOutput } = await execHook(def.command, this.workspace, scrubbedShellEnv());
+            const output = redactSecrets(rawOutput).redacted;
             span.setStatus(ok ? "OK" : "ERROR", ok ? undefined : output.slice(0, 500)).end();
         }
     }

package/dist/index.js

@@ -360,9 +360,16 @@ async function main() {
     // hung collector can't stall shutdown) — cleanup()'s own sessionMeter.flush()
     // is fire-and-forget and would otherwise usually be discarded by the
     // process.exit() that follows it.
+    // SIGINT is included alongside SIGTERM/SIGHUP for the same reason: Ink's
+    // own Ctrl+C handling only fires when it can read a raw keypress from
+    // stdin (which itself falls through to "exit" → cleanup), but a SIGINT
+    // delivered directly to the process — `kill -INT`, a terminal that still
+    // sends a real signal instead of raw-mode bytes — bypasses that path
+    // entirely unless it's handled here too.
     for (const [sig, code] of [
         ["SIGTERM", 143],
         ["SIGHUP", 129],
+        ["SIGINT", 130],
     ]) {
         process.on(sig, () => {
             void (async () => {

package/dist/mcp/client.js

@@ -10,6 +10,7 @@ import { assertSafeUrl as assertSafeUrlShared } from "../net/urlSafety.js";
 import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
 import { probeStdioEra, probeHttpEra } from "./eraDetect.js";
 import { ModernMcpConnection } from "./clientModern.js";
+import { redactSecrets } from "../tools/secretScan.js";
 import { ModernHttpTransport, ReusedProcessTransport, validateToolHeaders, } from "./transportModern.js";
 import { checkSchemaSafety } from "./schemaSafety.js";
 /**
@@ -853,9 +854,12 @@ export async function connectServer(name, cfg, trace) {
             status.error = err instanceof Error ? err.message : String(err);
             process.stderr.write(`kritya: MCP server "${name}" failed to start: ${status.error}\n`);
             span.setStatus("ERROR", status.error);
+            // status.error comes from the (untrusted) server process's own error
+            // output, which could echo back an env var or header value it was
+            // configured with.
             trace?.audit?.logTool({
                 tool: "mcp_connect",
-                summary: `server "${name}" failed to start: ${status.error}`,
+                summary: redactSecrets(`server "${name}" failed to start: ${status.error}`).redacted,
                 outcome: "error",
             });
         }

package/dist/mcp/eraDetect.js

@@ -44,6 +44,7 @@ import { spawn } from "node:child_process";
 import { planSpawn } from "./spawnWin.js";
 import { minimalEnv } from "./transport.js";
 import { OAuthSession } from "./oauth.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
 /**
  * Probe a stdio server with `server/discover`, per
@@ -160,18 +161,22 @@ export async function probeHttpEra(url, headers, timeoutMs = DEFAULT_HTTP_PROBE_
         }
         return built;
     };
-    const post = async () => fetch(url, {
-        method: "POST",
-        headers: await buildHeaders(),
-        body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: "discover-probe",
-            method: "server/discover",
-            params: { _meta: modernMeta() },
-        }),
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs),
-    });
+    const post = async () => {
+        const init = {
+            method: "POST",
+            headers: await buildHeaders(),
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: "discover-probe",
+                method: "server/discover",
+                params: { _meta: modernMeta() },
+            }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(timeoutMs),
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        return fetch(url, init);
+    };
     let res;
     try {
         res = await post();

package/dist/mcp/oauth.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import { VERSION } from "../version.js";
 import { debugLog } from "../config/debug.js";
 import { isExpired, loadAuth, saveAuth } from "./tokens.js";
-import { assertSafeUrl } from "../net/urlSafety.js";
+import { assertSafeUrl, pinnedDispatcherAllowLoopback, } from "../net/urlSafety.js";
 /**
  * OAuth 2.1 for remote (Streamable HTTP) MCP servers.
  *
@@ -55,7 +55,12 @@ function ua() {
  */
 async function getJson(url, timeoutMs = DISCOVERY_TIMEOUT_MS) {
     const safe = assertSafeUrl("OAuth discovery endpoint", url);
-    const res = await fetch(safe, { headers: ua(), signal: AbortSignal.timeout(timeoutMs) });
+    const init = {
+        headers: ua(),
+        signal: AbortSignal.timeout(timeoutMs),
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(safe, init);
     if (!res.ok)
         throw new Error(`HTTP ${res.status} from ${url}`);
     return res.json();
@@ -167,7 +172,7 @@ export async function registerClient(meta, redirectUri, scope) {
         throw new Error(`authorization server ${meta.issuer} does not support dynamic client registration; ` +
             `register kritya manually and put the client_id in mcp-auth.json`);
     }
-    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), {
+    const registrationInit = {
         method: "POST",
         headers: { ...ua(), "content-type": "application/json" },
         body: JSON.stringify({
@@ -180,7 +185,9 @@ export async function registerClient(meta, redirectUri, scope) {
             ...(scope ? { scope } : {}),
         }),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), registrationInit);
     if (!res.ok) {
         const body = await res.text().catch(() => "");
         throw new Error(`client registration failed: HTTP ${res.status}${body ? ` — ${body.slice(0, 200)}` : ""}`);
@@ -215,12 +222,14 @@ async function postToken(tokenEndpoint, params, clientSecret) {
         const basic = Buffer.from(`${params.client_id}:${clientSecret}`).toString("base64");
         headers.authorization = `Basic ${basic}`;
     }
-    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), {
+    const tokenInit = {
         method: "POST",
         headers,
         body: new URLSearchParams(params).toString(),
         signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-    });
+        dispatcher: pinnedDispatcherAllowLoopback,
+    };
+    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), tokenInit);
     const doc = (await res.json().catch(() => ({})));
     if (!res.ok || doc.error || !doc.access_token) {
         const detail = doc.error_description ?? doc.error ?? `HTTP ${res.status}`;
@@ -281,7 +290,7 @@ export async function revokeToken(auth) {
     const token = auth.refreshToken ?? auth.accessToken;
     const hint = auth.refreshToken ? "refresh_token" : "access_token";
     try {
-        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), {
+        const revokeInit = {
             method: "POST",
             headers: { ...ua(), "content-type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
@@ -290,7 +299,9 @@ export async function revokeToken(auth) {
                 client_id: auth.clientId,
             }).toString(),
             signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
-        });
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), revokeInit);
         return res.ok;
     }
     catch (err) {

package/dist/mcp/servers.js

@@ -1,5 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { sanitizeMcpServersRecord } from "../config/config.js";
+import { assertJsonWithinLimits } from "../config/jsonSafety.js";
+import { warnUser } from "../config/debug.js";
 /**
  * Where MCP server definitions come from and how they combine:
  *
@@ -83,13 +86,23 @@ function isServerConfig(v) {
  * degrade to "no project servers", not break startup.
  */
 export function loadProjectMcpServers(workspace) {
-    let parsed;
+    const file = path.join(workspace, ".mcp.json");
+    let raw;
     try {
-        parsed = JSON.parse(fs.readFileSync(path.join(workspace, ".mcp.json"), "utf8"));
+        raw = fs.readFileSync(file, "utf8");
     }
     catch {
         return undefined;
     }
+    let parsed;
+    try {
+        assertJsonWithinLimits(raw, ".mcp.json");
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        warnUser(`loadProjectMcpServers(${file})`, err);
+        return undefined;
+    }
     if (!parsed?.mcpServers || typeof parsed.mcpServers !== "object")
         return undefined;
     const servers = {};
@@ -97,7 +110,9 @@ export function loadProjectMcpServers(workspace) {
         if (isServerConfig(cfg))
             servers[name] = cfg;
     }
-    return Object.keys(servers).length ? servers : undefined;
+    if (!Object.keys(servers).length)
+        return undefined;
+    return sanitizeMcpServersRecord(servers, ".mcp.json mcpServers");
 }
 /**
  * Combine plugin, project, and global server definitions, expanding ${VAR} in

package/dist/mcp/transport.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { McpAuthRequiredError, OAuthSession, parseWwwAuthenticate } from "./oauth.js";
 import { planSpawn } from "./spawnWin.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 /** Same-origin redirects we'll follow before calling it a loop. */
 const MAX_REDIRECTS = 5;
 function isRedirect(status) {
@@ -212,7 +213,7 @@ export class HttpTransport {
         let url = this.url;
         // Bounded, because a redirect chain is otherwise a free loop.
         for (let hop = 0;; hop++) {
-            const res = await fetch(url, {
+            const init = {
                 method: "POST",
                 headers: await this.buildHeaders(),
                 body,
@@ -224,7 +225,12 @@ export class HttpTransport {
                 // Cancelling has to tear the socket down too, or the request stays in
                 // flight for the full timeout after the user has walked away.
                 signal: withTimeout(timeoutMs, signal),
-            });
+                // DNS-pin every connection, not just the URL kritya validated once at
+                // server-config time — closes the DNS-rebinding gap between that
+                // check and the actual connect.
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            const res = await fetch(url, init);
             if (!isRedirect(res.status))
                 return res;
             const location = res.headers.get("location");
@@ -284,12 +290,16 @@ export class HttpTransport {
         if (!this.sessionId)
             return;
         this.buildHeaders()
-            .then((headers) => fetch(this.url, {
-            method: "DELETE",
-            headers,
-            redirect: "manual",
-            signal: AbortSignal.timeout(3_000),
-        }))
+            .then((headers) => {
+            const init = {
+                method: "DELETE",
+                headers,
+                redirect: "manual",
+                signal: AbortSignal.timeout(3_000),
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            return fetch(this.url, init);
+        })
             .catch(() => { });
     }
 }

package/dist/mcp/transportModern.js

@@ -1,6 +1,7 @@
 import { McpAuthRequiredError, OAuthSession, parseWwwAuthenticate } from "./oauth.js";
 import { withTimeout } from "./transport.js";
 import { modernMeta, MODERN_PROTOCOL_VERSION } from "./eraDetect.js";
+import { pinnedDispatcherAllowLoopback } from "../net/urlSafety.js";
 /** Same-origin redirects we'll follow before calling it a loop. */
 const MAX_REDIRECTS = 5;
 /** How much of a server's stderr to keep for diagnostics, and how much to report. */
@@ -333,13 +334,17 @@ export class ModernHttpTransport {
         const body = JSON.stringify(msg);
         let url = this.url;
         for (let hop = 0;; hop++) {
-            const res = await fetch(url, {
+            const init = {
                 method: "POST",
                 headers: await this.buildHeaders(msg),
                 body,
                 redirect: "manual",
                 signal: withTimeout(timeoutMs, signal),
-            });
+                // DNS-pin the connection so a rebind between server-config validation
+                // and this request can't redirect it to a private address.
+                dispatcher: pinnedDispatcherAllowLoopback,
+            };
+            const res = await fetch(url, init);
             if (!isRedirect(res.status))
                 return res;
             const location = res.headers.get("location");

package/dist/net/urlSafety.js

@@ -1,3 +1,5 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { Agent } from "undici";
 /**
  * Shared "is this host on a private/internal network" check, used by both
  * fetch_url (src/tools/fetchUrl.ts) and the MCP HTTP transport guard
@@ -189,3 +191,57 @@ export function assertSafeUrl(label, url) {
     throw new Error(`${label} uses plain http:// (${parsed.host}), which would carry credentials in cleartext. ` +
         `Use https:// (localhost is exempt).`);
 }
+/**
+ * The actual SSRF boundary, shared by every outbound fetch kritya's own
+ * process makes on the user's behalf (fetch_url, MCP HTTP/SSE transports,
+ * OAuth discovery/registration/token/revocation, OTLP export): a connect-time
+ * `lookup` on a dedicated undici Agent, so the address that gets validated is
+ * the exact address the socket connects to — one DNS answer, not two.
+ * Checking a hostname once up front (assertSafeUrl) and letting `fetch`
+ * re-resolve it independently leaves a TOCTOU window: attacker-controlled or
+ * short-TTL DNS can answer differently the second time (DNS rebinding).
+ * Pinning the lookup closes that regardless of hop, hostname, or TTL.
+ *
+ * `isBlockedAddress` is pluggable because the two callers disagree on
+ * loopback: fetch_url refuses it outright (assertPublicUrl), while MCP
+ * servers and OAuth endpoints are routinely run locally during development
+ * and assertSafeUrl deliberately exempts loopback there. Each dispatcher
+ * instance holds no per-host state beyond ordinary connection pooling, so
+ * it's safe to share across every call site that uses the same policy.
+ */
+function createPinnedDispatcher(isBlockedAddress) {
+    return new Agent({
+        connect: {
+            lookup(hostname, options, callback) {
+                dnsLookup(hostname, { all: true })
+                    .then((addresses) => {
+                    if (addresses.length === 0) {
+                        callback(new Error(`Could not resolve ${hostname}`), []);
+                        return;
+                    }
+                    const bad = addresses.find((a) => isBlockedAddress(a.address));
+                    if (bad) {
+                        callback(new Error(`Refusing to connect to ${hostname}: resolves to private/internal address ${bad.address}`), []);
+                        return;
+                    }
+                    if (options.all) {
+                        callback(null, addresses);
+                    }
+                    else {
+                        const chosen = addresses[0];
+                        callback(null, chosen.address, chosen.family);
+                    }
+                })
+                    .catch((err) => callback(err, []));
+            },
+        },
+    });
+}
+/** For callers that never allow loopback either (fetch_url). */
+export const pinnedDispatcher = createPinnedDispatcher(isPrivateOrLoopbackHost);
+/**
+ * For callers that follow assertSafeUrl's policy: loopback is fine (a locally
+ * running MCP server or OAuth endpoint during development), other private/
+ * internal ranges are not.
+ */
+export const pinnedDispatcherAllowLoopback = createPinnedDispatcher((address) => !isLoopbackHost(address) && isPrivateOrLoopbackHost(address));

package/dist/permissions/danger.js

@@ -3,7 +3,31 @@
  * matches, kritya forces a permission prompt with a warning even if the
  * command would otherwise be covered by an allowlist rule or an "always allow"
  * choice — so a blanket `shell(*)` allow can't silently run `rm -rf /`.
+ *
+ * This is pattern matching over command text, not a shell parser — it can
+ * only see danger words that actually appear in the string. It normalizes
+ * one specific evasion ($IFS in place of a space) and flags several ways of
+ * running an opaque payload (eval, base64 -d, an interpreter's -c/-e,
+ * PowerShell's -EncodedCommand), but a command that reassembles a dangerous
+ * word at runtime without those (e.g. `a=r;b=m;$a$b -rf /`, or piping
+ * through `tr`/`rev`) has no literal substring left to match and will not be
+ * caught. Sandboxing (src/shell/sandbox.ts) is the actual backstop for that
+ * gap, not a replacement for closing it here.
  */
+/**
+ * `$IFS`/`${IFS}` in place of a literal space is a well-known filter-bypass
+ * trick (`rm${IFS}-rf${IFS}/` runs exactly like `rm -rf /`, but every
+ * pattern below that requires `\s+` between a command and its arguments
+ * never sees a whitespace character to match). Since this is purely a
+ * word-separator substitution — nothing about how the shell actually runs
+ * the command — normalizing it to a literal space before pattern matching
+ * catches the same commands the patterns already catch, without changing
+ * what any of them mean.
+ */
+const IFS_RE = /\$\{IFS[^}]*\}|\$IFS\b/g;
+function normalizeForDangerCheck(command) {
+    return command.replace(IFS_RE, " ");
+}
 const PATTERNS = [
     {
         re: /\brm\s+.*(-[a-z]*[rf][a-z]*\b|--recursive\b|--force\b|--no-preserve-root\b)/i,
@@ -83,11 +107,27 @@ const PATTERNS = [
         re: /\b(python3?|node|ruby|perl)\b\s+(-c|-e)\b/i,
         label: "running an inline script (bypasses command-text inspection)",
     },
+    {
+        // Shells' inline-command flag is -c specifically; unlike the
+        // interpreters above, -e means something else for a shell (errexit) and
+        // would false-positive on an ordinary `bash -e build.sh`.
+        re: /\b(bash|sh|zsh|dash|ksh)\b\s+-c\b/i,
+        label: "running an inline shell command (bypasses command-text inspection)",
+    },
+    {
+        // PowerShell accepts any unambiguous prefix of -EncodedCommand (-enc,
+        // -encodedcommand, ...); "en" is enough to disambiguate it from every
+        // other powershell.exe flag (-ExecutionPolicy starts "ex", not "en").
+        // This is the same base64-obfuscation evasion the generic `base64 -d`
+        // pattern above catches for POSIX shells, just spelled differently.
+        re: /\b(powershell(\.exe)?|pwsh)\b.*\s-en[a-z]*\b/i,
+        label: "running a base64-encoded PowerShell command (-EncodedCommand)",
+    },
     { re: /\bexec\s+\d*[<>]/i, label: "redirecting a shell's own file descriptors (exec)" },
 ];
 /** Returns a human-readable danger label if the command is destructive, else null. */
 export function classifyDanger(command) {
-    const cmd = command.trim();
+    const cmd = normalizeForDangerCheck(command.trim());
     for (const { re, label } of PATTERNS) {
         if (re.test(cmd))
             return label;

package/dist/session/store.js

@@ -4,7 +4,56 @@ import path from "node:path";
 import { writeFileAtomicSync } from "../atomicWrite.js";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnUser } from "../config/debug.js";
+/**
+ * A session file loaded whole into memory has no upper bound otherwise —
+ * `--continue` on a pathologically large transcript (corruption, a runaway
+ * write loop, or an adversarial file dropped into the session directory)
+ * would try to allocate the entire thing at once. Above this size, only the
+ * most recent bytes are read; older history is dropped rather than the
+ * resume failing outright.
+ */
+const MAX_SESSION_FILE_BYTES = 50 * 1024 * 1024;
+/**
+ * Upper bound on a single message body persisted to a session file. Guards
+ * against a runaway model response or tool result ballooning the transcript
+ * — the live in-memory turn is unaffected, only what gets written to disk
+ * (and so what a future `loadFile` would have to hold in memory at once).
+ */
+const MAX_MESSAGE_CONTENT_CHARS = 2_000_000;
+/** Cap `message.content` in place when it's a plain string over the limit. */
+function capMessageContent(message) {
+    if (typeof message.content !== "string" || message.content.length <= MAX_MESSAGE_CONTENT_CHARS) {
+        return message;
+    }
+    return {
+        ...message,
+        content: message.content.slice(0, MAX_MESSAGE_CONTENT_CHARS) +
+            `\n... [truncated, ${message.content.length - MAX_MESSAGE_CONTENT_CHARS} more characters]`,
+    };
+}
+/**
+ * Read `filePath`, capped to the last `maxBytes` bytes when it exceeds that
+ * size. The byte cut can land mid-line, so the leading partial line is
+ * dropped — callers parse one JSON message per line and would otherwise
+ * choke on (or silently misparse) a truncated first line.
+ */
+export function readSessionFileCapped(filePath, maxBytes = MAX_SESSION_FILE_BYTES) {
+    const size = fs.statSync(filePath).size;
+    if (size <= maxBytes)
+        return fs.readFileSync(filePath, "utf8");
+    const fd = fs.openSync(filePath, "r");
+    try {
+        const buffer = Buffer.alloc(maxBytes);
+        fs.readSync(fd, buffer, 0, maxBytes, size - maxBytes);
+        const text = buffer.toString("utf8");
+        const firstNewline = text.indexOf("\n");
+        return firstNewline === -1 ? "" : text.slice(firstNewline + 1);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 function sessionDir(workspace) {
     const hash = crypto.createHash("sha1").update(workspace).digest("hex").slice(0, 12);
     return path.join(CONFIG_DIR, "sessions", hash);
@@ -78,7 +127,7 @@ export class SessionStore {
             writeSessionFile(this.tasksFilePath(), JSON.stringify(tasks));
         }
         catch (err) {
-            debugLog(`SessionStore.saveTasks(${this.tasksFilePath()})`, err);
+            warnUser(`SessionStore.saveTasks(${this.tasksFilePath()})`, err);
         }
     }
     /** Loads the task checklist saved alongside a given session file, if any. */
@@ -106,7 +155,7 @@ export class SessionStore {
         fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         hardenWindowsDir(CONFIG_DIR);
         if (seed.length) {
-            writeSessionFile(this.file, seed.map((m) => JSON.stringify(m) + "\n").join(""));
+            writeSessionFile(this.file, seed.map((m) => JSON.stringify(capMessageContent(m)) + "\n").join(""));
         }
     }
     /**
@@ -123,11 +172,13 @@ export class SessionStore {
         try {
             fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
             hardenWindowsDir(CONFIG_DIR);
-            fs.appendFileSync(this.file, JSON.stringify(message) + "\n", { mode: 0o600 });
+            fs.appendFileSync(this.file, JSON.stringify(capMessageContent(message)) + "\n", {
+                mode: 0o600,
+            });
         }
         catch (err) {
             // Persistence is best-effort; never crash the session over it.
-            debugLog(`SessionStore.append(${this.file})`, err);
+            warnUser(`SessionStore.append(${this.file})`, err);
         }
     }
     /** Start over with a fresh session file (used by /clear). */
@@ -146,11 +197,11 @@ export class SessionStore {
         try {
             fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
             hardenWindowsDir(CONFIG_DIR);
-            writeSessionFile(this.file, messages.map((m) => JSON.stringify(m) + "\n").join(""));
+            writeSessionFile(this.file, messages.map((m) => JSON.stringify(capMessageContent(m)) + "\n").join(""));
         }
         catch (err) {
             // Persistence is best-effort; never crash the session over it.
-            debugLog(`SessionStore.overwrite(${this.file})`, err);
+            warnUser(`SessionStore.overwrite(${this.file})`, err);
         }
     }
     /**
@@ -205,7 +256,7 @@ export class SessionStore {
         const messages = [];
         let raw;
         try {
-            raw = fs.readFileSync(filePath, "utf8");
+            raw = readSessionFileCapped(filePath);
         }
         catch {
             return messages;
@@ -226,7 +277,7 @@ export class SessionStore {
     static readLines(filePath) {
         let raw;
         try {
-            raw = fs.readFileSync(filePath, "utf8");
+            raw = readSessionFileCapped(filePath);
         }
         catch {
             return [];

package/dist/telemetry/otlp.js

@@ -1,4 +1,5 @@
-import { debugLog } from "../config/debug.js";
+import { warnUser } from "../config/debug.js";
+import { assertSafeUrl, pinnedDispatcherAllowLoopback, } from "../net/urlSafety.js";
 function toAnyValue(value) {
     if (typeof value === "string")
         return { stringValue: value };
@@ -97,14 +98,21 @@ export function encodeMetricsSnapshot(points, resource) {
  */
 export function postOtlp(endpoint, path, body, headers) {
     try {
-        fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+        // Same DNS-pinning + private-address policy as MCP server URLs and OAuth
+        // endpoints (loopback ok, other private ranges refused): KRITYA_OTEL_ENDPOINT
+        // is user config, not attacker input, but there's no reason this one
+        // outbound path should be less protected than the others.
+        const url = assertSafeUrl("OTLP endpoint", `${endpoint.replace(/\/+$/, "")}${path}`);
+        const init = {
             method: "POST",
             headers: { "content-type": "application/json", ...(headers ?? {}) },
             body: JSON.stringify(body),
-        }).catch((err) => debugLog(`postOtlp(${path})`, err));
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        fetch(url.href, init).catch((err) => warnUser(`postOtlp(${path})`, err));
     }
     catch (err) {
-        debugLog(`postOtlp(${path})`, err);
+        warnUser(`postOtlp(${path})`, err);
     }
 }
 /**
@@ -116,13 +124,16 @@ export function postOtlp(endpoint, path, body, headers) {
  */
 export async function postOtlpAndWait(endpoint, path, body, headers) {
     try {
-        await fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+        const url = assertSafeUrl("OTLP endpoint", `${endpoint.replace(/\/+$/, "")}${path}`);
+        const init = {
             method: "POST",
             headers: { "content-type": "application/json", ...(headers ?? {}) },
             body: JSON.stringify(body),
-        });
+            dispatcher: pinnedDispatcherAllowLoopback,
+        };
+        await fetch(url.href, init);
     }
     catch (err) {
-        debugLog(`postOtlpAndWait(${path})`, err);
+        warnUser(`postOtlpAndWait(${path})`, err);
     }
 }

package/dist/telemetry/tracer.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../config/config.js";
 import { hardenWindowsDir } from "../config/winAcl.js";
-import { debugLog } from "../config/debug.js";
+import { debugLog, warnUser } from "../config/debug.js";
 import { VERSION } from "../version.js";
 import { encodeSpan, postOtlp } from "./otlp.js";
 function nowUnixNano() {
@@ -158,7 +158,7 @@ function fileSink(file) {
         }
         catch (err) {
             // best-effort: telemetry must never crash a turn
-            debugLog(`tracer.fileSink(${file})`, err);
+            warnUser(`tracer.fileSink(${file})`, err);
         }
     };
 }

package/dist/tools/document/docx.js

@@ -1,7 +1,13 @@
 import mammoth from "mammoth";
 import { Document, HeadingLevel, Packer, Paragraph, TextRun } from "docx";
 import { validateBlocks } from "./types.js";
+import { loadSafeZip } from "./zipSafety.js";
 export async function readDocx(buf) {
+    // .docx is a zip container, and mammoth decompresses every entry with no
+    // size limit — same decompression-bomb exposure as .xlsx (see
+    // zipSafety.ts). Validate declared uncompressed size before handing the
+    // buffer to mammoth.
+    await loadSafeZip(buf);
     const result = await mammoth.extractRawText({ buffer: buf });
     return result.value;
 }

package/dist/tools/document/pdf.js

@@ -9,6 +9,15 @@ import { validateBlocks } from "./types.js";
 // fileURLToPath yields backslash-separated paths — normalize to forward
 // slashes, which fs.readFile accepts on every platform.
 const STANDARD_FONT_DATA_URL = fileURLToPath(new URL("../../../node_modules/pdfjs-dist/standard_fonts/", import.meta.url)).replace(/\\/g, "/");
+/**
+ * A hostile or corrupt PDF can declare an enormous page count, or pack a
+ * huge amount of text into a single page; without a cap, extracting text
+ * page-by-page has no upper bound on how long it runs or how much memory the
+ * accumulated text consumes. Both caps stop the extraction early rather than
+ * failing outright — the caller gets whatever was read so far, plus a note.
+ */
+const MAX_PDF_PAGES = 5_000;
+const MAX_PDF_TEXT_CHARS = 5_000_000;
 export async function readPdf(buf) {
     const loadingTask = getDocument({
         data: new Uint8Array(buf),
@@ -16,16 +25,27 @@ export async function readPdf(buf) {
     });
     const doc = await loadingTask.promise;
     const pageTexts = [];
-    for (let i = 1; i <= doc.numPages; i++) {
+    let totalChars = 0;
+    let truncated = false;
+    const pageCount = Math.min(doc.numPages, MAX_PDF_PAGES);
+    for (let i = 1; i <= pageCount; i++) {
         const page = await doc.getPage(i);
         const content = await page.getTextContent();
         const text = content.items
             .map((item) => ("str" in item ? item.str : ""))
             .join(" ");
         pageTexts.push(text);
+        totalChars += text.length;
+        if (totalChars > MAX_PDF_TEXT_CHARS) {
+            truncated = true;
+            break;
+        }
     }
     await loadingTask.destroy();
-    return pageTexts.join("\n\n");
+    if (pageCount < doc.numPages)
+        truncated = true;
+    return (pageTexts.join("\n\n") +
+        (truncated ? `\n\n... [truncated: read ${pageTexts.length} of ${doc.numPages} page(s)]` : ""));
 }
 const PAGE_WIDTH = 612; // US Letter, points
 const PAGE_HEIGHT = 792;

package/dist/tools/document/pptx.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import JSZip from "jszip";
+import { loadSafeZip } from "./zipSafety.js";
 // pptxgenjs is CommonJS-only and its bundled types don't resolve cleanly
 // under NodeNext + esModuleInterop (the default import type-checks as the
 // module namespace, not the constructor). Load it via require and type the
@@ -9,7 +9,10 @@ const PptxGenJS = require("pptxgenjs");
 // Matches text runs inside slide XML, e.g. <a:t>Hello</a:t>.
 const TEXT_RUN_RE = /<a:t>([^<]*)<\/a:t>/g;
 export async function readPptx(buf) {
-    const zip = await JSZip.loadAsync(buf);
+    // .pptx is a zip container; same decompression-bomb exposure as .xlsx/.docx
+    // (see zipSafety.ts) — validate declared uncompressed size before reading
+    // any entry's content.
+    const zip = await loadSafeZip(buf);
     const slideFiles = Object.keys(zip.files)
         .filter((name) => /^ppt\/slides\/slide\d+\.xml$/.test(name))
         .sort((a, b) => slideNumber(a) - slideNumber(b));

package/dist/tools/document/xlsx.js

@@ -1,27 +1,12 @@
 import ExcelJS from "exceljs";
-import JSZip from "jszip";
+import { loadSafeZip } from "./zipSafety.js";
 const CELL_REF_RE = /^[A-Za-z]{1,3}[1-9][0-9]*$/;
 // exceljs's xlsx loader decompresses every entry of the .xlsx zip with no
-// size limit (CVE-2026-78206, unpatched upstream as of this writing) — a
-// small file whose declared uncompressed size is huge can exhaust memory
-// before exceljs itself ever runs. JSZip.loadAsync only reads the central
-// directory (cheap, no inflation), so summing each entry's *declared*
-// uncompressed size here rejects a bomb before handing the buffer to exceljs.
-const MAX_XLSX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+// size limit (CVE-2026-78206, unpatched upstream as of this writing) — see
+// zipSafety.ts for why checking declared sizes up front (via JSZip, which
+// doesn't inflate) catches this before exceljs itself ever runs.
 async function assertSafeXlsxSize(buf) {
-    const zip = await JSZip.loadAsync(buf);
-    let total = 0;
-    for (const entry of Object.values(zip.files)) {
-        // `_data` is JSZip's internal CompressedObject; there is no public API
-        // for a zip entry's declared (pre-inflation) uncompressed size.
-        total +=
-            entry._data?.uncompressedSize ?? 0;
-        if (total > MAX_XLSX_UNCOMPRESSED_BYTES) {
-            throw new Error(`This .xlsx file's declared uncompressed size exceeds ` +
-                `${MAX_XLSX_UNCOMPRESSED_BYTES / (1024 * 1024)}MB and was refused ` +
-                `as a likely decompression bomb rather than risk exhausting memory.`);
-        }
-    }
+    await loadSafeZip(buf);
 }
 export async function readXlsx(buf) {
     await assertSafeXlsxSize(buf);

package/dist/tools/document/zipSafety.js

@@ -0,0 +1,34 @@
+import JSZip from "jszip";
+/**
+ * .docx, .xlsx, and .pptx are all zip containers, and every library that
+ * reads them (exceljs, mammoth, and this codebase's own pptx reader via
+ * JSZip directly) decompresses each entry with no size limit — a small file
+ * whose declared uncompressed size is huge can exhaust memory before the
+ * library that actually parses the format ever runs (see CVE-2026-78206 for
+ * exceljs specifically; mammoth uses the same unbounded JSZip decompression
+ * path). Loading with JSZip first only reads the central directory (cheap,
+ * no inflation) so summing each entry's *declared* uncompressed size rejects
+ * a bomb before any real parsing starts.
+ */
+const MAX_ZIP_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+/** Throws if `zip`'s entries declare more than `maxBytes` of uncompressed data combined. */
+export function assertSafeZipEntries(zip, maxBytes = MAX_ZIP_UNCOMPRESSED_BYTES) {
+    let total = 0;
+    for (const entry of Object.values(zip.files)) {
+        // `_data` is JSZip's internal CompressedObject; there is no public API
+        // for a zip entry's declared (pre-inflation) uncompressed size.
+        total +=
+            entry._data?.uncompressedSize ?? 0;
+        if (total > maxBytes) {
+            throw new Error(`This file's declared uncompressed size exceeds ` +
+                `${maxBytes / (1024 * 1024)}MB and was refused as a likely decompression bomb ` +
+                `rather than risk exhausting memory.`);
+        }
+    }
+}
+/** Loads `buf` as a zip and validates its declared uncompressed size, returning the loaded zip for reuse. */
+export async function loadSafeZip(buf, maxBytes = MAX_ZIP_UNCOMPRESSED_BYTES) {
+    const zip = await JSZip.loadAsync(buf);
+    assertSafeZipEntries(zip, maxBytes);
+    return zip;
+}

package/dist/tools/document.js

@@ -7,6 +7,13 @@ import { readXlsx, writeXlsx, editXlsx } from "./document/xlsx.js";
 import { readPptx, writePptx } from "./document/pptx.js";
 import { readPdf, writePdf, editPdf } from "./document/pdf.js";
 const READABLE_EXTENSIONS = [".docx", ".xlsx", ".pptx", ".pdf"];
+/**
+ * Bound the raw file read before it's dispatched to any format-specific
+ * reader. Each reader has its own internal limits (zip decompression caps,
+ * PDF page/text caps), but those only kick in once parsing has started —
+ * this stops an absurdly large file from being buffered into memory at all.
+ */
+const MAX_DOCUMENT_FILE_BYTES = 200 * 1024 * 1024;
 const BLOCK_SCHEMA = {
     type: "array",
     description: "Flowed content blocks, in document order.",
@@ -39,6 +46,11 @@ export const readDocumentTool = {
         const relPath = String(args.path);
         const abs = resolveSafe(ctx.workspace, relPath);
         const ext = path.extname(abs).toLowerCase();
+        const { size } = await fs.stat(abs);
+        if (size > MAX_DOCUMENT_FILE_BYTES) {
+            throw new Error(`${relPath} is ${Math.round(size / (1024 * 1024))}MB, over the ` +
+                `${MAX_DOCUMENT_FILE_BYTES / (1024 * 1024)}MB limit for read_document.`);
+        }
         const buf = await fs.readFile(abs);
         switch (ext) {
             case ".docx":

package/dist/tools/fetchUrl.js

@@ -1,7 +1,6 @@
 import { lookup as dnsLookup } from "node:dns/promises";
-import { Agent } from "undici";
 import { truncateResult } from "./common.js";
-import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { isPrivateOrLoopbackHost, pinnedDispatcher, } from "../net/urlSafety.js";
 /** Cap on how much text a single fetch returns, unless the caller asks for less. */
 const DEFAULT_MAX_CHARS = 20_000;
 /** Give up on a slow or hanging server rather than blocking the whole turn. */
@@ -67,41 +66,6 @@ export async function hostResolvesToPrivateAddress(hostname, lookupFn = dnsLooku
 }
 /** Refuse to keep chasing redirects forever. */
 const MAX_REDIRECTS = 5;
-/**
- * The actual SSRF boundary: a connect-time `lookup` on a dedicated undici
- * Agent, so the address that gets validated is the exact address the socket
- * connects to — one DNS answer, not two. Checking the hostname up front and
- * then letting `fetch` re-resolve it independently (the previous approach)
- * left a TOCTOU window: attacker-controlled or short-TTL DNS can answer
- * differently the second time (classic DNS rebinding). Pinning the lookup
- * closes that regardless of hop, hostname, or TTL.
- */
-const pinnedDispatcher = new Agent({
-    connect: {
-        lookup(hostname, options, callback) {
-            dnsLookup(hostname, { all: true })
-                .then((addresses) => {
-                if (addresses.length === 0) {
-                    callback(new Error(`Could not resolve ${hostname}`), []);
-                    return;
-                }
-                const bad = addresses.find((a) => isPrivateOrLoopbackHost(a.address));
-                if (bad) {
-                    callback(new Error(`Refusing to connect to ${hostname}: resolves to private/internal address ${bad.address}`), []);
-                    return;
-                }
-                if (options.all) {
-                    callback(null, addresses);
-                }
-                else {
-                    const chosen = addresses[0];
-                    callback(null, chosen.address, chosen.family);
-                }
-            })
-                .catch((err) => callback(err, []));
-        },
-    },
-});
 /**
  * Fetch `url`, following redirects manually so every hop — not just the
  * original URL — is checked against assertPublicUrl before the (DNS-pinned)

package/dist/tools/notebook.js

@@ -56,7 +56,20 @@ function summarizeOutputs(outputs) {
     return (text.slice(0, MAX_OUTPUT_CHARS) +
         `\n... [output truncated, ${text.length - MAX_OUTPUT_CHARS} more characters]`);
 }
+/**
+ * Cell *output* text is already capped post-parse (MAX_OUTPUT_CHARS above),
+ * but nothing bounded the input file itself — a pathologically large
+ * .ipynb (corrupt, or a runaway export) would otherwise be read and
+ * JSON.parse'd whole regardless of size. Real notebooks are nowhere near
+ * this large even with heavy output.
+ */
+const MAX_NOTEBOOK_FILE_BYTES = 50 * 1024 * 1024;
 async function loadNotebook(abs) {
+    const { size } = await fs.stat(abs);
+    if (size > MAX_NOTEBOOK_FILE_BYTES) {
+        throw new Error(`Notebook file is ${Math.round(size / (1024 * 1024))}MB, over the ` +
+            `${MAX_NOTEBOOK_FILE_BYTES / (1024 * 1024)}MB limit for reading a .ipynb file.`);
+    }
     const text = await fs.readFile(abs, "utf8");
     let nb;
     try {

package/dist/tools/shell.js

@@ -38,7 +38,12 @@ export const shellTool = {
     // background command returns immediately. A second, shorter cap from the
     // agent loop would cut off commands the user explicitly asked to run longer.
     timeoutMs: 0,
-    summarize: (args) => `Run${args.background ? " in background" : ""}: ${args.command}`,
+    // The summary is what lands in the audit log and telemetry spans (see
+    // toolExecutor's `kritya.summary` attribute), so it needs the same
+    // redaction as the background-start echo below — otherwise a credential
+    // embedded in the command (e.g. a curl Authorization header) gets
+    // persisted in plain text on every ordinary foreground call.
+    summarize: (args) => `Run${args.background ? " in background" : ""}: ${redactSecrets(String(args.command ?? "")).redacted}`,
     // A command that printed nothing needs no preview to say so — but every
     // other command's output is the answer, so keep it (null = show the preview).
     resultSummary: (output) => (output.trim() === "(no output)" ? "no output" : null),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.22-beta",
+  "version": "0.8.23-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {