monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/commands/benchmark.js

@@ -5,7 +5,7 @@
  * @module v1/cli/commands/benchmark
  */
 import { output } from '../output.js';
-import { writeFileSync, renameSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
+import { writeFileSync, renameSync, readFileSync, existsSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { BenchmarkRunner } from '../benchmarks/benchmark-runner.js';
 // ============================================================================
@@ -63,9 +63,12 @@ const neuralCommand = {
         { command: 'monomind benchmark neural -d 768 -n 5000', description: 'Higher dimension, more vectors' },
     ],
     action: async (ctx) => {
-        const iterations = parseInt(ctx.flags.iterations || '100', 10);
-        const dimension = parseInt(ctx.flags.dimension || '384', 10);
-        const numVectors = parseInt(ctx.flags.vectors || '1000', 10);
+        const iterationsRaw = parseInt(ctx.flags.iterations || '100', 10);
+        const iterations = Number.isFinite(iterationsRaw) ? Math.max(1, Math.min(iterationsRaw, 10_000)) : 100;
+        const dimensionRaw = parseInt(ctx.flags.dimension || '384', 10);
+        const dimension = Number.isFinite(dimensionRaw) ? Math.max(1, Math.min(dimensionRaw, 4096)) : 384;
+        const numVectorsRaw = parseInt(ctx.flags.vectors || '1000', 10);
+        const numVectors = Number.isFinite(numVectorsRaw) ? Math.max(1, Math.min(numVectorsRaw, 100_000)) : 1000;
         const outputFormat = ctx.flags.output || 'text';
         output.writeln();
         output.writeln(output.bold('Neural Operations Benchmark'));
@@ -228,7 +231,8 @@ const memoryCommand = {
         { command: 'monomind benchmark memory', description: 'Run memory benchmarks' },
     ],
     action: async (ctx) => {
-        const iterations = parseInt(ctx.flags.iterations || '100', 10);
+        const iterationsRaw = parseInt(ctx.flags.iterations || '100', 10);
+        const iterations = Number.isFinite(iterationsRaw) ? Math.max(1, Math.min(iterationsRaw, 10_000)) : 100;
         const outputFormat = ctx.flags.output || 'text';
         output.writeln();
         output.writeln(output.bold('Memory Operations Benchmark'));
@@ -384,7 +388,15 @@ const allCommand = {
             if (!existsSync(resultsDir)) {
                 mkdirSync(resultsDir, { recursive: true });
             }
-            const savePath = saveFile.startsWith('/') ? saveFile : join(resultsDir, saveFile);
+            // Path traversal guard: resolve within resultsDir regardless of whether saveFile is absolute
+            const { resolve: resolvePath, basename } = await import('node:path');
+            const safeName = basename(saveFile);
+            const savePath = resolvePath(resultsDir, safeName);
+            const resolvedResultsDir = resolvePath(resultsDir);
+            if (!savePath.startsWith(resolvedResultsDir + '/') && savePath !== resolvedResultsDir) {
+                output.writeln(output.error(`Save path must be within ${resultsDir}`));
+                return { success: false, message: 'Invalid save path' };
+            }
             const saveTmp2 = savePath + '.tmp';
             writeFileSync(saveTmp2, JSON.stringify({
                 timestamp: new Date().toISOString(),
@@ -416,14 +428,30 @@ const regressionCommand = {
         { command: 'monomind benchmark regression -b agent-spawn -a output.txt --pin-baseline', description: 'Evaluate and pin results as new baseline' },
     ],
     action: async (ctx) => {
-        const suiteDir = ctx.flags.suite || '.monomind/benchmarks/definitions';
+        const suiteDirRaw = ctx.flags.suite || '.monomind/benchmarks/definitions';
         const benchmarkId = ctx.flags['benchmark-id'];
         const agentOutputFile = ctx.flags['agent-output'];
         const pinBaseline = ctx.flags['pin-baseline'] === true;
         const outputFormat = ctx.flags.output || 'text';
+        // Validate benchmarkId to prevent path traversal in baseline file names
+        if (benchmarkId !== undefined) {
+            if (!/^[a-zA-Z0-9_-]{1,128}$/.test(benchmarkId)) {
+                output.writeln(output.error('Invalid benchmark-id: must contain only alphanumeric, dash, or underscore characters (max 128).'));
+                return { success: false, message: 'Invalid benchmark-id' };
+            }
+        }
         const runner = new BenchmarkRunner();
         const baselinesDir = join(process.cwd(), '.monomind', 'benchmarks', 'baselines');
-        const definitions = runner.loadBenchmarks(join(process.cwd(), suiteDir));
+        // Path traversal guard for suiteDir
+        const { resolve: resolvePath2 } = await import('node:path');
+        const projectRoot = resolvePath2(process.cwd());
+        const resolvedSuiteDir = resolvePath2(process.cwd(), suiteDirRaw);
+        if (!resolvedSuiteDir.startsWith(projectRoot + '/') && resolvedSuiteDir !== projectRoot) {
+            output.writeln(output.error(`Suite directory must be within the project: ${projectRoot}`));
+            return { success: false, message: 'Invalid suite directory' };
+        }
+        const suiteDir = suiteDirRaw;
+        const definitions = runner.loadBenchmarks(resolvedSuiteDir);
         if (definitions.length === 0) {
             output.writeln(output.dim(`No benchmark definitions found in ${suiteDir}`));
             output.writeln(output.dim('Create JSON files there to define quality benchmarks.'));
@@ -446,6 +474,15 @@ const regressionCommand = {
             output.writeln(output.error(`Agent output file not found: ${agentOutputFile}`));
             return { success: false, message: 'Agent output file not found' };
         }
+        const MAX_AGENT_OUTPUT_BYTES = 10 * 1024 * 1024; // 10 MB
+        try {
+            const agentOutputStat = statSync(agentOutputFile);
+            if (agentOutputStat.size > MAX_AGENT_OUTPUT_BYTES) {
+                output.writeln(output.error(`Agent output file too large: ${agentOutputFile} (max 10 MB)`));
+                return { success: false, message: 'Agent output file too large' };
+            }
+        }
+        catch { /* existsSync already passed; ignore stat failure */ }
         const agentOutput = readFileSync(agentOutputFile, 'utf-8');
         const targetDefs = benchmarkId
             ? definitions.filter((d) => d.benchmarkId === benchmarkId)
@@ -473,8 +510,14 @@ const regressionCommand = {
             output.writeln();
         }
         // Baseline comparison
+        const MAX_BASELINE_BYTES = 5 * 1024 * 1024; // 5 MB
         const baselinePath = join(baselinesDir, `${benchmarkId ?? 'all'}.json`);
         if (existsSync(baselinePath)) {
+            const baselineStat = statSync(baselinePath);
+            if (baselineStat.size > MAX_BASELINE_BYTES) {
+                output.writeln(output.error(`Baseline file too large (max 5 MB)`));
+                return { success: false, message: 'Baseline file too large' };
+            }
             const baseline = JSON.parse(readFileSync(baselinePath, 'utf-8'));
             const hasRegression = runner.detectRegression(results, baseline);
             if (hasRegression) {

package/packages/@monomind/cli/dist/src/commands/browse.js

@@ -214,13 +214,16 @@ const waitCommand = {
         const { client, sessionId } = await ensureConnected(_port);
         const browser = await getBrowser();
         if (ctx.flags.ms) {
-            await new Promise((r) => setTimeout(r, ctx.flags.ms));
+            const rawMs = ctx.flags.ms;
+            const waitMs = Number.isFinite(rawMs) ? Math.max(0, Math.min(rawMs, 60_000)) : 0; // cap at 60s
+            await new Promise((r) => setTimeout(r, waitMs));
             output.printSuccess(`Waited ${ctx.flags.ms}ms`);
             return { success: true };
         }
         if (ctx.flags.fn) {
             const expr = ctx.flags.fn;
-            const timeout = ctx.flags.timeout ?? 30000;
+            const rawTimeout = ctx.flags.timeout ?? 30000;
+            const timeout = Number.isFinite(rawTimeout) ? Math.max(100, Math.min(rawTimeout, 300_000)) : 30000; // cap at 5min
             const interval = 200;
             const deadline = Date.now() + timeout;
             while (Date.now() < deadline) {

package/packages/@monomind/cli/dist/src/commands/claims.js

@@ -35,7 +35,7 @@ function safeParseJson(content) {
 function loadClaimsConfig() {
     const configPaths = getClaimsConfigPaths();
     for (const configPath of configPaths) {
-        if (fs.existsSync(configPath)) {
+        if (fs.existsSync(configPath) && fs.statSync(configPath).size <= 1024 * 1024) {
             const content = fs.readFileSync(configPath, 'utf-8');
             return { config: safeParseJson(content), path: configPath };
         }
@@ -153,13 +153,19 @@ const checkCommand = {
         { command: 'monomind claims check -c admin:delete -u user123', description: 'Check user permission' },
     ],
     action: async (ctx) => {
-        const claim = ctx.flags.claim;
-        const user = ctx.flags.user || 'current';
-        const resource = ctx.flags.resource;
+        const claim = (ctx.flags.claim || '').slice(0, 256);
+        const user = (ctx.flags.user || 'current').slice(0, 128);
+        const resource = (ctx.flags.resource || '').slice(0, 256);
         if (!claim) {
             output.printError('Claim is required');
             return { success: false, exitCode: 1 };
         }
+        // Block prototype-polluting user or resource keys.
+        const PROTO_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+        if (PROTO_KEYS.has(user)) {
+            output.printError(`Forbidden user key: "${user}"`);
+            return { success: false, exitCode: 1 };
+        }
         output.writeln();
         output.writeln(output.bold('Claim Check'));
         output.writeln(output.dim('─'.repeat(40)));
@@ -189,7 +195,7 @@ const checkCommand = {
                 defaultClaims: ['swarm:create', 'swarm:status', 'agent:spawn', 'agent:list', 'memory:read', 'memory:write', 'task:create'],
             };
             for (const configPath of claimsConfigPaths) {
-                if (fs.existsSync(configPath)) {
+                if (fs.existsSync(configPath) && fs.statSync(configPath).size <= 1024 * 1024) {
                     const content = fs.readFileSync(configPath, 'utf-8');
                     claimsConfig = { ...claimsConfig, ...safeParseJson(content) };
                     policySource = configPath;
@@ -283,9 +289,9 @@ const grantCommand = {
         { command: 'monomind claims grant -c agent:spawn -r developer', description: 'Grant to role' },
     ],
     action: async (ctx) => {
-        const claim = ctx.flags.claim;
-        const user = ctx.flags.user;
-        const role = ctx.flags.role;
+        const claim = (ctx.flags.claim || '').slice(0, 256);
+        const user = (ctx.flags.user || '').slice(0, 128);
+        const role = (ctx.flags.role || '').slice(0, 64);
         if (!claim) {
             output.printError('Claim is required');
             return { success: false, exitCode: 1 };
@@ -294,6 +300,12 @@ const grantCommand = {
             output.printError('Either user or role is required');
             return { success: false, exitCode: 1 };
         }
+        // Block prototype-polluting user or role keys.
+        const PROTO_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+        if ((user && PROTO_KEYS.has(user)) || (role && PROTO_KEYS.has(role))) {
+            output.printError('Forbidden user or role key');
+            return { success: false, exitCode: 1 };
+        }
         try {
             const { config, path: configPath } = loadClaimsConfig();
             if (user) {
@@ -343,9 +355,9 @@ const revokeCommand = {
         { command: 'monomind claims revoke -c admin:* -r guest', description: 'Revoke from role' },
     ],
     action: async (ctx) => {
-        const claim = ctx.flags.claim;
-        const user = ctx.flags.user;
-        const role = ctx.flags.role;
+        const claim = (ctx.flags.claim || '').slice(0, 256);
+        const user = (ctx.flags.user || '').slice(0, 128);
+        const role = (ctx.flags.role || '').slice(0, 64);
         if (!claim) {
             output.printError('Claim is required');
             return { success: false, exitCode: 1 };
@@ -354,6 +366,12 @@ const revokeCommand = {
             output.printError('Either user or role is required');
             return { success: false, exitCode: 1 };
         }
+        // Block prototype-polluting user or role keys.
+        const PROTO_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+        if ((user && PROTO_KEYS.has(user)) || (role && PROTO_KEYS.has(role))) {
+            output.printError('Forbidden user or role key');
+            return { success: false, exitCode: 1 };
+        }
         try {
             const { config, path: configPath } = loadClaimsConfig();
             let removed = false;

package/packages/@monomind/cli/dist/src/commands/cleanup.js

@@ -5,7 +5,7 @@
  * github.com/monoes/monomind
  */
 import { output } from '../output.js';
-import { existsSync, statSync, rmSync, readdirSync } from 'fs';
+import { existsSync, lstatSync, rmSync, readdirSync } from 'fs';
 import { join } from 'path';
 /**
  * Artifact directories and files that monomind/monomind may create
@@ -30,11 +30,27 @@ const KEEP_CONFIG_PATHS = [
     join('.claude', 'settings.json'),
 ];
 /**
- * Calculate the total size of a path (file or directory) in bytes
+ * Maximum directory recursion depth for size calculation.
+ * Prevents stack overflow on deeply-nested or circular-symlink trees.
  */
-function getSize(fullPath) {
+const MAX_SIZE_DEPTH = 20;
+/**
+ * Calculate the total size of a path (file or directory) in bytes.
+ *
+ * Uses lstatSync (not statSync) so that symlinks are never followed:
+ * a symlink counts only the size of the link itself, not its target.
+ * This prevents a crafted symlink (e.g. .claude -> /) from causing
+ * the cleanup command to recursively traverse the entire filesystem.
+ */
+function getSize(fullPath, depth = 0) {
+    if (depth > MAX_SIZE_DEPTH)
+        return 0;
     try {
-        const stat = statSync(fullPath);
+        const stat = lstatSync(fullPath);
+        if (stat.isSymbolicLink()) {
+            // Count only the symlink entry itself; never traverse the target.
+            return stat.size;
+        }
         if (stat.isFile()) {
             return stat.size;
         }
@@ -42,7 +58,11 @@ function getSize(fullPath) {
             let total = 0;
             const entries = readdirSync(fullPath, { withFileTypes: true });
             for (const entry of entries) {
-                total += getSize(join(fullPath, entry.name));
+                // Skip symlinks at the entry level too — lstatSync below will still
+                // catch them, but checking here avoids unnecessary path joins.
+                if (!entry.isSymbolicLink()) {
+                    total += getSize(join(fullPath, entry.name), depth + 1);
+                }
             }
             return total;
         }

package/packages/@monomind/cli/dist/src/commands/config.js

@@ -69,7 +69,7 @@ const getCommand = {
         { command: 'monomind config get -k memory.backend', description: 'Get memory backend' }
     ],
     action: async (ctx) => {
-        const key = ctx.flags.key || ctx.args[0];
+        const key = (ctx.flags.key || ctx.args[0] || '').slice(0, 256);
         if (!key) {
             // Show all config from actual config file (fall back to defaults)
             const config = configManager.getConfig(ctx.cwd);
@@ -102,6 +102,14 @@ const getCommand = {
             });
             return { success: true, data: flatEntries };
         }
+        // Prototype pollution guard — mirrors the same check in setCommand.
+        const FORBIDDEN_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+        for (const seg of key.split('.')) {
+            if (FORBIDDEN_KEY_SEGMENTS.has(seg)) {
+                output.printError(`Forbidden config key segment: "${seg}"`);
+                return { success: false, exitCode: 1 };
+            }
+        }
         const value = configManager.get(ctx.cwd, key);
         if (value === undefined) {
             output.printError(`Configuration key not found: ${key}`);
@@ -141,8 +149,8 @@ const setCommand = {
         { command: 'monomind config set -k memory.backend -v agentdb', description: 'Set memory backend' }
     ],
     action: async (ctx) => {
-        const key = ctx.flags.key || ctx.args[0];
-        const value = ctx.flags.value || ctx.args[1];
+        const key = (ctx.flags.key || ctx.args[0] || '').slice(0, 256);
+        const value = (ctx.flags.value ?? ctx.args[1] ?? '');
         if (!key || value === undefined) {
             output.printError('Both key and value are required');
             return { success: false, exitCode: 1 };
@@ -203,10 +211,10 @@ const providersCommand = {
             { name: 'gemini', model: 'gemini-2.0-flash', priority: 4, enabled: false, status: 'Disabled' }
         ];
         // Handle mutation flags
-        const addProvider = ctx.flags.add;
-        const removeProvider = ctx.flags.remove;
-        const enableProvider = ctx.flags.enable;
-        const disableProvider = ctx.flags.disable;
+        const addProvider = ctx.flags.add?.slice(0, 64);
+        const removeProvider = ctx.flags.remove?.slice(0, 64);
+        const enableProvider = ctx.flags.enable?.slice(0, 64);
+        const disableProvider = ctx.flags.disable?.slice(0, 64);
         if (addProvider || removeProvider || enableProvider || disableProvider) {
             // Read current providers from config
             let currentProviders = configManager.get(ctx.cwd, 'providers') || [];

package/packages/@monomind/cli/dist/src/commands/daemon.js

@@ -327,6 +327,10 @@ async function killBackgroundDaemon(projectRoot) {
         return false;
     }
     try {
+        if (fs.statSync(pidFile).size > 32) {
+            fs.unlinkSync(pidFile);
+            return false;
+        }
         const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
         if (isNaN(pid)) {
             fs.unlinkSync(pidFile);
@@ -376,6 +380,8 @@ function getBackgroundDaemonPid(projectRoot) {
         return null;
     }
     try {
+        if (fs.statSync(pidFile).size > 32)
+            return null;
         const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
         return isNaN(pid) ? null : pid;
     }

package/packages/@monomind/cli/dist/src/commands/deployment.js

@@ -19,11 +19,23 @@ function getStatePath(cwd) {
 function emptyState() {
     return { environments: {}, history: [], activeDeployment: undefined };
 }
+const MAX_DEPLOYMENT_STATE_BYTES = 10 * 1024 * 1024; // 10 MB
+// Input length caps to prevent DoS via unbounded strings stored to disk
+const MAX_ENV_NAME_LEN = 128;
+const MAX_VERSION_LEN = 64;
+const MAX_DESCRIPTION_LEN = 1024;
+const MAX_URL_LEN = 2048;
+const MAX_ENV_TYPE_LEN = 64;
+const MAX_HISTORY_LIMIT = 1000;
+const MAX_LOGS_LIMIT = 1000;
 function loadDeploymentState(cwd) {
     const filePath = getStatePath(cwd);
     if (!fs.existsSync(filePath)) {
         return emptyState();
     }
+    if (fs.statSync(filePath).size > MAX_DEPLOYMENT_STATE_BYTES) {
+        return emptyState();
+    }
     try {
         const raw = fs.readFileSync(filePath, 'utf-8');
         const parsed = JSON.parse(raw);
@@ -66,6 +78,9 @@ function readProjectVersion(cwd) {
     if (!fs.existsSync(pkgPath)) {
         return null;
     }
+    if (fs.statSync(pkgPath).size > 1024 * 1024) {
+        return null;
+    }
     try {
         const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
         return pkg.version ?? null;
@@ -92,10 +107,10 @@ const deployCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || 'staging');
+            const envName = String(ctx.flags['env'] || 'staging').slice(0, MAX_ENV_NAME_LEN);
             const dryRun = Boolean(ctx.flags['dry-run']);
-            const description = ctx.flags['description'] ? String(ctx.flags['description']) : undefined;
-            let version = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const description = ctx.flags['description'] ? String(ctx.flags['description']).slice(0, MAX_DESCRIPTION_LEN) : undefined;
+            let version = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
             if (!version) {
                 version = readProjectVersion(ctx.cwd) || '0.0.0';
             }
@@ -181,7 +196,7 @@ const statusCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
             output.writeln();
             output.writeln(output.bold('Deployment Status'));
             output.writeln();
@@ -277,13 +292,13 @@ const rollbackCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || '');
+            const envName = String(ctx.flags['env'] || '').slice(0, MAX_ENV_NAME_LEN);
             if (!envName) {
                 output.printError('Environment is required', 'Use --env or -e to specify');
                 return { success: false, exitCode: 1 };
             }
-            const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']) : null;
-            const steps = parseInt(ctx.flags.steps || '1', 10);
+            const targetVersion = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
+            const steps = Math.min(Math.max(parseInt(ctx.flags.steps || '1', 10), 1), 100);
             if (steps > 1) {
                 output.printWarning(`Multi-step rollback (--steps ${steps}) is not yet implemented. Rolling back 1 step only.`);
             }
@@ -370,8 +385,8 @@ const historyCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
-            const limit = Number(ctx.flags['limit']) || 10;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
+            const limit = Math.min(Math.max(Number(ctx.flags['limit']) || 10, 1), MAX_HISTORY_LIMIT);
             let records = [...state.history].reverse();
             if (filterEnv) {
                 records = records.filter(r => r.environment === filterEnv);
@@ -455,7 +470,7 @@ const environmentsCommand = {
                 return { success: true };
             }
             if (action === 'add') {
-                const name = ctx.flags['name'] ? String(ctx.flags['name']) : null;
+                const name = ctx.flags['name'] ? String(ctx.flags['name']).slice(0, MAX_ENV_NAME_LEN) : null;
                 if (!name) {
                     output.printError('Environment name is required', 'Use --name or -n to specify');
                     return { success: false, exitCode: 1 };
@@ -464,8 +479,8 @@ const environmentsCommand = {
                     output.printWarning(`Environment '${name}' already exists`);
                     return { success: false, exitCode: 1 };
                 }
-                const envType = String(ctx.flags['type'] || 'local');
-                const url = ctx.flags['url'] ? String(ctx.flags['url']) : undefined;
+                const envType = String(ctx.flags['type'] || 'local').slice(0, MAX_ENV_TYPE_LEN);
+                const url = ctx.flags['url'] ? String(ctx.flags['url']).slice(0, MAX_URL_LEN) : undefined;
                 state.environments[name] = {
                     name,
                     type: envType,
@@ -481,7 +496,7 @@ const environmentsCommand = {
                 return { success: true };
             }
             if (action === 'remove') {
-                const name = ctx.flags['name'] ? String(ctx.flags['name']) : null;
+                const name = ctx.flags['name'] ? String(ctx.flags['name']).slice(0, MAX_ENV_NAME_LEN) : null;
                 if (!name) {
                     output.printError('Environment name is required', 'Use --name or -n to specify');
                     return { success: false, exitCode: 1 };
@@ -524,9 +539,9 @@ const logsCommand = {
     action: async (ctx) => {
         try {
             const state = loadDeploymentState(ctx.cwd);
-            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']) : null;
-            const deploymentId = ctx.flags['deployment'] ? String(ctx.flags['deployment']) : null;
-            const limit = Number(ctx.flags['lines']) || 50;
+            const filterEnv = ctx.flags['env'] ? String(ctx.flags['env']).slice(0, MAX_ENV_NAME_LEN) : null;
+            const deploymentId = ctx.flags['deployment'] ? String(ctx.flags['deployment']).slice(0, 64) : null;
+            const limit = Math.min(Math.max(Number(ctx.flags['lines']) || 50, 1), MAX_LOGS_LIMIT);
             output.writeln();
             output.writeln(output.bold('Deployment Logs'));
             output.writeln();
@@ -588,9 +603,9 @@ const releaseCommand = {
     ],
     action: async (ctx) => {
         try {
-            const envName = String(ctx.flags['env'] || 'production');
-            const description = ctx.flags['description'] ? String(ctx.flags['description']) : undefined;
-            let version = ctx.flags['version'] ? String(ctx.flags['version']) : null;
+            const envName = String(ctx.flags['env'] || 'production').slice(0, MAX_ENV_NAME_LEN);
+            const description = ctx.flags['description'] ? String(ctx.flags['description']).slice(0, MAX_DESCRIPTION_LEN) : undefined;
+            let version = ctx.flags['version'] ? String(ctx.flags['version']).slice(0, MAX_VERSION_LEN) : null;
             if (!version) {
                 const pkgVersion = readProjectVersion(ctx.cwd);
                 if (!pkgVersion) {