monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/mcp-tools/analyze-tools.js

@@ -3,6 +3,34 @@
  * Provides diff analysis and classification via MCP protocol
  */
 import { analyzeDiff, assessFileRisk, assessOverallRisk, classifyDiff, suggestReviewers, getGitDiffNumstat, } from '../monovector/diff-classifier.js';
+// ===== Shared validation helpers =====
+const MAX_REF_LEN = 256; // git ref: branch/commit/tag names are bounded
+const MAX_PATH_LEN = 4096; // OS path limit
+const MAX_LIMIT = 100;
+const VALID_FILE_STATUS = new Set(['added', 'modified', 'deleted', 'renamed']);
+// Strip filesystem paths from error messages to avoid leaking internal layout
+function sanitizeError(error) {
+    if (error instanceof Error) {
+        return error.message
+            .replace(/\/[^\s:]+(\/|(?=\s|:|$))/g, '<path>/')
+            .substring(0, 500);
+    }
+    return 'Internal error';
+}
+// Validate a git ref: non-empty string, bounded length, no shell metacharacters.
+// execFileSync already prevents shell injection but we still cap the length and
+// reject control chars / obvious injection patterns so error messages don't echo
+// attacker-supplied content back.
+const REF_SAFE_RE = /^[a-zA-Z0-9_./:@^~\-\.{}\[\]]+$/;
+function validateRef(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return 'HEAD';
+    if (value.length > MAX_REF_LEN)
+        return null;
+    if (!REF_SAFE_RE.test(value))
+        return null;
+    return value;
+}
 /**
  * Diff Analysis Tool
  * Analyzes git diffs for change risk assessment and classification
@@ -38,7 +66,9 @@ export const analyzeDiffTool = {
         },
     },
     handler: async (params) => {
-        const ref = params.ref || 'HEAD';
+        const ref = validateRef(params.ref);
+        if (ref === null)
+            return { error: true, message: 'Invalid ref: must be a safe git ref (max 256 chars, alphanumeric/._/:@^~-)' };
         const includeFileRisks = params.includeFileRisks === true;
         const includeReviewers = params.includeReviewers !== false;
         const useMonoVector = params.useMonoVector !== false;
@@ -67,7 +97,7 @@ export const analyzeDiffTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
+                message: sanitizeError(error),
                 ref,
             };
         }
@@ -93,7 +123,9 @@ export const diffRiskTool = {
         },
     },
     handler: async (params) => {
-        const ref = params.ref || 'HEAD';
+        const ref = validateRef(params.ref);
+        if (ref === null)
+            return { error: true, message: 'Invalid ref: must be a safe git ref (max 256 chars, alphanumeric/._/:@^~-)' };
         try {
             const files = getGitDiffNumstat(ref);
             const fileRisks = files.map(assessFileRisk);
@@ -107,7 +139,7 @@ export const diffRiskTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
+                message: sanitizeError(error),
                 ref,
             };
         }
@@ -133,7 +165,9 @@ export const diffClassifyTool = {
         },
     },
     handler: async (params) => {
-        const ref = params.ref || 'HEAD';
+        const ref = validateRef(params.ref);
+        if (ref === null)
+            return { error: true, message: 'Invalid ref: must be a safe git ref (max 256 chars, alphanumeric/._/:@^~-)' };
         try {
             const files = getGitDiffNumstat(ref);
             const classification = classifyDiff(files);
@@ -146,7 +180,7 @@ export const diffClassifyTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
+                message: sanitizeError(error),
                 ref,
             };
         }
@@ -177,8 +211,13 @@ export const diffReviewersTool = {
         },
     },
     handler: async (params) => {
-        const ref = params.ref || 'HEAD';
-        const limit = params.limit || 5;
+        const ref = validateRef(params.ref);
+        if (ref === null)
+            return { error: true, message: 'Invalid ref: must be a safe git ref (max 256 chars, alphanumeric/._/:@^~-)' };
+        const rawLimit = params.limit;
+        const limit = (typeof rawLimit === 'number' && Number.isFinite(rawLimit) && rawLimit > 0)
+            ? Math.min(Math.floor(rawLimit), MAX_LIMIT)
+            : 5;
         try {
             const files = getGitDiffNumstat(ref);
             const fileRisks = files.map(assessFileRisk);
@@ -192,7 +231,7 @@ export const diffReviewersTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
+                message: sanitizeError(error),
                 ref,
             };
         }
@@ -234,11 +273,33 @@ export const fileRiskTool = {
     },
     handler: async (params) => {
         try {
+            const rawPath = params.path;
+            if (typeof rawPath !== 'string' || rawPath.length === 0) {
+                return { error: true, message: 'path is required (non-empty string)' };
+            }
+            if (rawPath.length > MAX_PATH_LEN) {
+                return { error: true, message: `path too long (max ${MAX_PATH_LEN} chars)` };
+            }
+            // Only use the path for regex matching (assessFileRisk); still reject
+            // control characters to prevent log injection.
+            if (/[\x00-\x1F]/.test(rawPath)) {
+                return { error: true, message: 'path must not contain control characters' };
+            }
+            const rawStatus = params.status;
+            const status = (typeof rawStatus === 'string' && VALID_FILE_STATUS.has(rawStatus))
+                ? rawStatus
+                : 'modified';
+            const rawAdd = params.additions;
+            const additions = (typeof rawAdd === 'number' && Number.isFinite(rawAdd) && rawAdd >= 0)
+                ? Math.min(Math.floor(rawAdd), 1_000_000) : 0;
+            const rawDel = params.deletions;
+            const deletions = (typeof rawDel === 'number' && Number.isFinite(rawDel) && rawDel >= 0)
+                ? Math.min(Math.floor(rawDel), 1_000_000) : 0;
             const file = {
-                path: params.path,
-                status: params.status || 'modified',
-                additions: params.additions || 0,
-                deletions: params.deletions || 0,
+                path: rawPath,
+                status,
+                additions,
+                deletions,
                 hunks: 1,
                 binary: false,
             };
@@ -253,8 +314,8 @@ export const fileRiskTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
-                path: params.path,
+                message: sanitizeError(error),
+                path: typeof params.path === 'string' ? params.path.substring(0, 200) : '',
             };
         }
     },
@@ -279,7 +340,9 @@ export const diffStatsTool = {
         },
     },
     handler: async (params) => {
-        const ref = params.ref || 'HEAD';
+        const ref = validateRef(params.ref);
+        if (ref === null)
+            return { error: true, message: 'Invalid ref: must be a safe git ref (max 256 chars, alphanumeric/._/:@^~-)' };
         try {
             const files = getGitDiffNumstat(ref);
             const totalAdditions = files.reduce((sum, f) => sum + f.additions, 0);
@@ -307,7 +370,7 @@ export const diffStatsTool = {
         catch (error) {
             return {
                 error: true,
-                message: error instanceof Error ? error.message : String(error),
+                message: sanitizeError(error),
                 ref,
             };
         }

package/packages/@monomind/cli/dist/src/mcp-tools/browser-tools.js

@@ -299,17 +299,36 @@ export const browserTools = [
             },
         },
         handler: async (input) => {
-            const { session, interactive, compact, depth, selector } = input;
+            const raw = input;
+            let safeSession;
+            try {
+                safeSession = validateSessionId(raw.session);
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
             const args = ['snapshot'];
-            if (interactive)
+            if (raw.interactive)
                 args.push('-i');
-            if (compact)
+            if (raw.compact)
                 args.push('-c');
-            if (depth)
-                args.push('-d', String(depth));
-            if (selector)
-                args.push('-s', selector);
-            return execBrowserCommand(args, session);
+            if (raw.depth)
+                args.push('-d', String(raw.depth));
+            if (raw.selector !== undefined) {
+                try {
+                    args.push('-s', rejectFlagLike(raw.selector, 'selector'));
+                }
+                catch (e) {
+                    return {
+                        content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                        isError: true,
+                    };
+                }
+            }
+            return execBrowserCommand(args, safeSession);
         },
     },
     {
@@ -489,7 +508,15 @@ export const browserTools = [
         },
         handler: async (input) => {
             const { target, session } = input;
-            return execBrowserCommand(['check', target], session);
+            try {
+                return execBrowserCommand(['check', rejectFlagLike(target, 'target')], session);
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
         },
     },
     {
@@ -507,7 +534,15 @@ export const browserTools = [
         },
         handler: async (input) => {
             const { target, session } = input;
-            return execBrowserCommand(['uncheck', target], session);
+            try {
+                return execBrowserCommand(['uncheck', rejectFlagLike(target, 'target')], session);
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
         },
     },
     {
@@ -550,7 +585,15 @@ export const browserTools = [
         },
         handler: async (input) => {
             const { target, session } = input;
-            return execBrowserCommand(['get', 'text', target], session);
+            try {
+                return execBrowserCommand(['get', 'text', rejectFlagLike(target, 'target')], session);
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
         },
     },
     {
@@ -568,7 +611,15 @@ export const browserTools = [
         },
         handler: async (input) => {
             const { target, session } = input;
-            return execBrowserCommand(['get', 'value', target], session);
+            try {
+                return execBrowserCommand(['get', 'value', rejectFlagLike(target, 'target')], session);
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
         },
     },
     {
@@ -622,17 +673,28 @@ export const browserTools = [
             },
         },
         handler: async (input) => {
-            const { selector, text, url, timeout, session } = input;
+            const raw = input;
             const args = ['wait'];
-            if (selector)
-                args.push(selector);
-            if (text)
-                args.push('--text', text);
-            if (url)
-                args.push('--url', url);
-            if (timeout)
-                args.push(String(timeout));
-            return execBrowserCommand(args, session);
+            try {
+                if (raw.selector !== undefined)
+                    args.push(rejectFlagLike(raw.selector, 'selector'));
+                if (raw.text !== undefined)
+                    args.push('--text', rejectFlagLike(raw.text, 'text'));
+                if (raw.url !== undefined)
+                    args.push('--url', validateUrl(raw.url));
+            }
+            catch (e) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ success: false, error: e.message }) }],
+                    isError: true,
+                };
+            }
+            // Cap timeout to prevent event-loop blocking via a huge value
+            if (raw.timeout !== undefined && typeof raw.timeout === 'number') {
+                const clampedTimeout = Math.min(Math.max(Math.floor(raw.timeout), 0), 60_000);
+                args.push(String(clampedTimeout));
+            }
+            return execBrowserCommand(args, raw.session);
         },
     },
     // ==========================================================================

package/packages/@monomind/cli/dist/src/mcp-tools/claims-tools.js

@@ -7,7 +7,7 @@
  * @module @monomind/cli/mcp-tools/claims
  */
 // File-based persistence
-import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from 'fs';
+import { existsSync, readFileSync, statSync, writeFileSync, renameSync, mkdirSync } from 'fs';
 import { join, resolve } from 'path';
 const CLAIMS_DIR = '.monomind/claims';
 const CLAIMS_FILE = 'claims.json';
@@ -20,10 +20,11 @@ function ensureClaimsDir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+const MAX_CLAIMS_STORE_BYTES = 10 * 1024 * 1024; // 10 MB
 function loadClaims() {
     try {
         const path = getClaimsPath();
-        if (existsSync(path)) {
+        if (existsSync(path) && statSync(path).size <= MAX_CLAIMS_STORE_BYTES) {
             return JSON.parse(readFileSync(path, 'utf-8'));
         }
     }
@@ -80,7 +81,11 @@ export const claimsTools = [
         handler: async (input) => {
             const issueId = input.issueId;
             const claimantStr = input.claimant;
-            const context = input.context;
+            // Cap context: stored verbatim in the claim JSON record on disk.
+            const MAX_CLAIM_CONTEXT_LEN = 4 * 1024;
+            const rawContext = input.context;
+            const context = typeof rawContext === 'string' && rawContext.length > MAX_CLAIM_CONTEXT_LEN
+                ? rawContext.slice(0, MAX_CLAIM_CONTEXT_LEN) : rawContext;
             const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
             if (!issueId || issueId.length > 256 || RESERVED_KEYS.has(issueId)) {
                 return { success: false, error: 'Invalid issueId' };
@@ -211,7 +216,13 @@ export const claimsTools = [
             const issueId = input.issueId;
             const fromStr = input.from;
             const toStr = input.to;
-            const reason = input.reason;
+            // Cap handoff reason: stored as claim.handoffReason in the claims JSON store on disk.
+            // Without a cap, an arbitrarily long reason inflates every write of the store file.
+            const MAX_HANDOFF_REASON_LEN = 1024;
+            const rawHandoffReason = input.reason;
+            const reason = typeof rawHandoffReason === 'string' && rawHandoffReason.length > MAX_HANDOFF_REASON_LEN
+                ? rawHandoffReason.slice(0, MAX_HANDOFF_REASON_LEN)
+                : rawHandoffReason;
             const progress = input.progress || 0;
             const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
             if (!issueId || typeof issueId !== 'string' || issueId.length > 256 || RESERVED_KEYS.has(issueId)) {
@@ -337,7 +348,11 @@ export const claimsTools = [
             const issueId = input.issueId;
             const status = input.status;
             const claimantStr = input.claimant;
-            const note = input.note;
+            // Cap note: stored as claim.blockReason in the claims JSON store on disk.
+            const MAX_CLAIM_NOTE_LEN = 4 * 1024;
+            const rawNote = input.note;
+            const note = typeof rawNote === 'string' && rawNote.length > MAX_CLAIM_NOTE_LEN
+                ? rawNote.slice(0, MAX_CLAIM_NOTE_LEN) : rawNote;
             const progress = input.progress;
             const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
             if (!issueId || typeof issueId !== 'string' || issueId.length > 256 || RESERVED_KEYS.has(issueId)) {
@@ -450,9 +465,22 @@ export const claimsTools = [
         },
         handler: async (input) => {
             const issueId = input.issueId;
-            const reason = input.reason;
+            // Runtime-validate StealReason: JSON schema declares an enum, but callers
+            // that bypass schema validation (raw MCP calls) can pass arbitrary strings,
+            // which would be persisted verbatim in store.stealable[issueId].reason.
+            const VALID_STEAL_REASONS = new Set(['overloaded', 'stale', 'blocked-timeout', 'voluntary']);
+            const rawStealReason = input.reason;
+            if (!rawStealReason || !VALID_STEAL_REASONS.has(rawStealReason)) {
+                return { success: false, error: `Invalid reason "${rawStealReason}". Must be one of: overloaded, stale, blocked-timeout, voluntary` };
+            }
+            const reason = rawStealReason;
             const preferredTypes = input.preferredTypes;
-            const context = input.context;
+            // Cap context: stored verbatim in the stealable record on disk.
+            const MAX_STEAL_CONTEXT_LEN = 4 * 1024;
+            const rawStealContext = input.context;
+            const context = typeof rawStealContext === 'string' && rawStealContext.length > MAX_STEAL_CONTEXT_LEN
+                ? rawStealContext.slice(0, MAX_STEAL_CONTEXT_LEN)
+                : rawStealContext;
             const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
             if (!issueId || typeof issueId !== 'string' || issueId.length > 256 || RESERVED_KEYS.has(issueId)) {
                 return { success: false, error: 'Invalid issueId' };

package/packages/@monomind/cli/dist/src/mcp-tools/config-tools.js

@@ -136,11 +136,27 @@ export const configTools = [
         },
         handler: async (input) => {
             const store = loadConfigStore();
-            const key = input.key;
-            const scope = input.scope || 'default';
+            // Cap key and scope to prevent DoS via O(n) key.split('.') and to block
+            // prototype-pollution when key/scope are used as object property names.
+            const MAX_CONFIG_KEY_LEN = 512;
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const rawKey = input.key;
+            const key = typeof rawKey === 'string' && rawKey.length > MAX_CONFIG_KEY_LEN
+                ? rawKey.slice(0, MAX_CONFIG_KEY_LEN) : rawKey;
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
+            if (DANGEROUS_KEYS.has(scope)) {
+                return { key, value: undefined, scope, exists: false, source: 'none' };
+            }
+            for (const seg of key.split('.')) {
+                if (DANGEROUS_KEYS.has(seg)) {
+                    return { key, value: undefined, scope, exists: false, source: 'none' };
+                }
+            }
             let value;
             // Check scope first, then default values
-            if (scope !== 'default' && store.scopes[scope]) {
+            if (scope !== 'default' && Object.hasOwn(store.scopes, scope)) {
                 value = store.scopes[scope][key];
             }
             if (value === undefined) {
@@ -173,9 +189,18 @@ export const configTools = [
         },
         handler: async (input) => {
             const store = loadConfigStore();
-            const key = input.key;
+            // Cap key and scope: both become JSON object keys in the on-disk config
+            // store (store.values[key] and store.scopes[scope][key]).  key is also
+            // split on '.' — O(n) — before the dangerous-key check.
+            const MAX_CONFIG_KEY_LEN = 512;
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const rawKey = input.key;
+            const key = typeof rawKey === 'string' && rawKey.length > MAX_CONFIG_KEY_LEN
+                ? rawKey.slice(0, MAX_CONFIG_KEY_LEN) : rawKey;
             const value = input.value;
-            const scope = input.scope || 'default';
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
             for (const seg of key.split('.')) {
                 if (DANGEROUS_KEYS.has(seg)) {
                     return { success: false, error: `Forbidden key segment: "${seg}"` };
@@ -219,9 +244,18 @@ export const configTools = [
         },
         handler: async (input) => {
             const store = loadConfigStore();
-            const scope = input.scope || 'default';
-            const prefix = input.prefix;
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const MAX_PREFIX_LEN = 256;
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
+            const rawPrefix = input.prefix;
+            const prefix = typeof rawPrefix === 'string' && rawPrefix.length > MAX_PREFIX_LEN
+                ? rawPrefix.slice(0, MAX_PREFIX_LEN) : rawPrefix;
             const includeDefaults = input.includeDefaults !== false;
+            if (DANGEROUS_KEYS.has(scope)) {
+                return { configs: [], total: 0, scope, updatedAt: store.updatedAt };
+            }
             // Merge stored values with defaults
             let configs = {};
             if (includeDefaults) {
@@ -230,7 +264,7 @@ export const configTools = [
             // Add stored values
             Object.assign(configs, store.values);
             // Add scope-specific values
-            if (scope !== 'default' && store.scopes[scope]) {
+            if (scope !== 'default' && Object.hasOwn(store.scopes, scope)) {
                 Object.assign(configs, store.scopes[scope]);
             }
             // Filter by prefix
@@ -265,18 +299,35 @@ export const configTools = [
         },
         handler: async (input) => {
             const store = loadConfigStore();
-            const scope = input.scope || 'default';
-            const key = input.key;
+            // Cap scope and key to prevent DoS and prototype pollution.
+            const MAX_CONFIG_KEY_LEN = 512;
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
+            const rawKey = input.key;
+            const key = typeof rawKey === 'string' && rawKey.length > MAX_CONFIG_KEY_LEN
+                ? rawKey.slice(0, MAX_CONFIG_KEY_LEN) : rawKey;
+            if (DANGEROUS_KEYS.has(scope)) {
+                return { success: false, error: `Forbidden scope: "${scope}"` };
+            }
+            if (key) {
+                for (const seg of key.split('.')) {
+                    if (DANGEROUS_KEYS.has(seg)) {
+                        return { success: false, error: `Forbidden key segment: "${seg}"` };
+                    }
+                }
+            }
             let resetKeys = [];
             if (key) {
                 // Reset specific key
                 if (scope === 'default') {
-                    if (key in store.values) {
+                    if (Object.hasOwn(store.values, key)) {
                         delete store.values[key];
                         resetKeys.push(key);
                     }
                 }
-                else if (store.scopes[scope] && key in store.scopes[scope]) {
+                else if (Object.hasOwn(store.scopes, scope) && Object.hasOwn(store.scopes[scope], key)) {
                     delete store.scopes[scope][key];
                     resetKeys.push(key);
                 }
@@ -287,7 +338,7 @@ export const configTools = [
                     resetKeys = Object.keys(store.values);
                     store.values = { ...DEFAULT_CONFIG };
                 }
-                else if (store.scopes[scope]) {
+                else if (Object.hasOwn(store.scopes, scope)) {
                     resetKeys = Object.keys(store.scopes[scope]);
                     delete store.scopes[scope];
                 }
@@ -315,14 +366,21 @@ export const configTools = [
         },
         handler: async (input) => {
             const store = loadConfigStore();
-            const scope = input.scope || 'default';
+            // Cap scope to prevent DoS and prototype pollution.
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
             const includeDefaults = input.includeDefaults !== false;
+            if (DANGEROUS_KEYS.has(scope)) {
+                return { config: {}, scope, version: store.version, exportedAt: new Date().toISOString(), count: 0 };
+            }
             let exportData = {};
             if (includeDefaults) {
                 exportData = { ...DEFAULT_CONFIG };
             }
             Object.assign(exportData, store.values);
-            if (scope !== 'default' && store.scopes[scope]) {
+            if (scope !== 'default' && Object.hasOwn(store.scopes, scope)) {
                 Object.assign(exportData, store.scopes[scope]);
             }
             return {
@@ -350,8 +408,15 @@ export const configTools = [
         handler: async (input) => {
             const store = loadConfigStore();
             const config = filterDangerousKeys(input.config);
-            const scope = input.scope || 'default';
+            // Cap scope to prevent DoS and prototype pollution.
+            const MAX_CONFIG_SCOPE_LEN = 128;
+            const rawScope = input.scope || 'default';
+            const scope = typeof rawScope === 'string' && rawScope.length > MAX_CONFIG_SCOPE_LEN
+                ? rawScope.slice(0, MAX_CONFIG_SCOPE_LEN) : rawScope;
             const merge = input.merge !== false;
+            if (DANGEROUS_KEYS.has(scope)) {
+                return { success: false, error: `Forbidden scope: "${scope}"` };
+            }
             const importedKeys = Object.keys(config);
             if (scope === 'default') {
                 if (merge) {
@@ -362,7 +427,7 @@ export const configTools = [
                 }
             }
             else {
-                if (!store.scopes[scope] || !merge) {
+                if (!Object.hasOwn(store.scopes, scope) || !merge) {
                     store.scopes[scope] = {};
                 }
                 Object.assign(store.scopes[scope], config);