monomind 1.11.13 → 1.12.0

package/packages/@monomind/cli/dist/src/swarm/flow-enforcer.d.ts

@@ -0,0 +1,31 @@
+/**
+ * FlowEnforcer (Task 40)
+ *
+ * Checks messages against the communication graph and records violations.
+ * No database dependency — violations stored in memory.
+ */
+import type { FlowViolation } from '../../../shared/src/types/communication-flow.js';
+import type { CommunicationGraph } from './communication-graph.js';
+export declare class FlowEnforcer {
+    private readonly graph;
+    private readonly swarmId;
+    private readonly enforce;
+    private readonly violations;
+    private static readonly MAX_VIOLATIONS;
+    constructor(graph: CommunicationGraph, swarmId: string, enforceMode: boolean);
+    /**
+     * Check whether a message is authorized and record any violation.
+     *
+     * Returns BOTH `authorized` (the policy decision) and `enforced` (whether the
+     * decision is actually applied). Callers must read both — taking action based
+     * solely on `authorized` would let `enforce=false` silently bypass the policy.
+     */
+    checkAndRecord(fromSlug: string, toSlug: string, messageContent: string): {
+        authorized: boolean;
+        enforced: boolean;
+        violation?: FlowViolation;
+    };
+    /** Return all recorded violations */
+    getViolations(): FlowViolation[];
+}
+//# sourceMappingURL=flow-enforcer.d.ts.map

package/packages/@monomind/cli/dist/src/swarm/flow-enforcer.js

@@ -0,0 +1,61 @@
+/**
+ * FlowEnforcer (Task 40)
+ *
+ * Checks messages against the communication graph and records violations.
+ * No database dependency — violations stored in memory.
+ */
+import { randomUUID } from 'crypto';
+export class FlowEnforcer {
+    graph;
+    swarmId;
+    enforce;
+    violations = [];
+    static MAX_VIOLATIONS = 1000;
+    constructor(graph, swarmId, enforceMode) {
+        this.graph = graph;
+        this.swarmId = swarmId;
+        this.enforce = enforceMode;
+    }
+    /**
+     * Check whether a message is authorized and record any violation.
+     *
+     * Returns BOTH `authorized` (the policy decision) and `enforced` (whether the
+     * decision is actually applied). Callers must read both — taking action based
+     * solely on `authorized` would let `enforce=false` silently bypass the policy.
+     */
+    checkAndRecord(fromSlug, toSlug, messageContent) {
+        if (this.graph.isAuthorized(fromSlug, toSlug)) {
+            return { authorized: true, enforced: this.enforce };
+        }
+        const violation = {
+            violationId: randomUUID(),
+            swarmId: this.swarmId,
+            fromAgentSlug: fromSlug,
+            toAgentSlug: toSlug,
+            // Truncated preview only; for sensitive traffic, redact via a hook before
+            // it reaches this enforcer. Cap means an attacker can't fill memory with
+            // long messages either.
+            messagePreview: messageContent.slice(0, 120),
+            detectedAt: new Date().toISOString(),
+            action: this.enforce ? 'blocked' : 'logged',
+        };
+        // FIFO eviction so a sustained attack can't grow violations to GB-scale.
+        if (this.violations.length >= FlowEnforcer.MAX_VIOLATIONS) {
+            this.violations.shift();
+        }
+        this.violations.push(violation);
+        return {
+            // Policy decision: NOT authorized. Whether the caller blocks the send is
+            // governed by `enforced`, which is exposed separately so callers cannot
+            // accidentally treat audit-mode as "permitted".
+            authorized: false,
+            enforced: this.enforce,
+            violation,
+        };
+    }
+    /** Return all recorded violations */
+    getViolations() {
+        return [...this.violations];
+    }
+}
+//# sourceMappingURL=flow-enforcer.js.map

package/packages/@monomind/cli/dist/src/swarm/flow-visualizer.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Flow Visualizer (Task 40)
+ *
+ * ASCII and DOT (Graphviz) renderers for communication flow edges.
+ */
+import type { FlowEdge } from '../../../shared/src/types/communication-flow.js';
+/**
+ * Render edges as human-readable ASCII art.
+ * Empty edges produce a single-line "unrestricted" notice.
+ */
+export declare function toAscii(edges: FlowEdge[], title?: string): string;
+/**
+ * Render edges as a DOT language digraph (Graphviz compatible).
+ * Slugs are escaped so a malicious slug cannot inject DOT attributes
+ * (e.g., URL="javascript:..." would be rendered as a clickable link
+ * by Graphviz's SVG output without escaping).
+ */
+export declare function toDOT(edges: FlowEdge[], graphName?: string): string;
+//# sourceMappingURL=flow-visualizer.d.ts.map

package/packages/@monomind/cli/dist/src/swarm/flow-visualizer.js

@@ -0,0 +1,68 @@
+/**
+ * Flow Visualizer (Task 40)
+ *
+ * ASCII and DOT (Graphviz) renderers for communication flow edges.
+ */
+/** Escape a slug for safe DOT identifier interpolation. */
+function dotEscape(s) {
+    return String(s ?? '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+/** Strip newlines/CR for safe ASCII line emission (log-injection defense). */
+function asciiSafe(s) {
+    return String(s ?? '').replace(/[\r\n\x00-\x1f\x7f]/g, '?');
+}
+/** Restrict graph names to a safe DOT identifier — graph_name must be an ID. */
+function safeGraphName(name) {
+    return /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/.test(name) ? name : 'swarm_flow';
+}
+const MAX_DISPLAY_EDGES = 500;
+/**
+ * Render edges as human-readable ASCII art.
+ * Empty edges produce a single-line "unrestricted" notice.
+ */
+export function toAscii(edges, title) {
+    const lines = [];
+    if (title) {
+        lines.push(`=== ${asciiSafe(title)} ===`);
+        lines.push('');
+    }
+    if (edges.length === 0) {
+        lines.push('(unrestricted — all agents may communicate freely)');
+        return lines.join('\n');
+    }
+    const capped = edges.slice(0, MAX_DISPLAY_EDGES);
+    for (const [from, to] of capped) {
+        lines.push(`  ${asciiSafe(from)} --> ${asciiSafe(to)}`);
+    }
+    if (edges.length > MAX_DISPLAY_EDGES) {
+        lines.push(`  ... (${edges.length - MAX_DISPLAY_EDGES} more edges omitted)`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Render edges as a DOT language digraph (Graphviz compatible).
+ * Slugs are escaped so a malicious slug cannot inject DOT attributes
+ * (e.g., URL="javascript:..." would be rendered as a clickable link
+ * by Graphviz's SVG output without escaping).
+ */
+export function toDOT(edges, graphName) {
+    const name = safeGraphName(graphName ?? 'swarm_flow');
+    const lines = [];
+    lines.push(`digraph ${name} {`);
+    lines.push('  rankdir=LR;');
+    if (edges.length === 0) {
+        lines.push('  // unrestricted — no explicit edges');
+    }
+    else {
+        const capped = edges.slice(0, MAX_DISPLAY_EDGES);
+        for (const [from, to] of capped) {
+            lines.push(`  "${dotEscape(from)}" -> "${dotEscape(to)}";`);
+        }
+        if (edges.length > MAX_DISPLAY_EDGES) {
+            lines.push(`  // ... (${edges.length - MAX_DISPLAY_EDGES} more edges omitted)`);
+        }
+    }
+    lines.push('}');
+    return lines.join('\n');
+}
+//# sourceMappingURL=flow-visualizer.js.map

package/packages/@monomind/cli/dist/src/transfer/anonymization/index.d.ts

@@ -11,9 +11,6 @@ export declare function detectPII(content: string): PIIDetectionResult;
  * Redact PII from a string
  */
 export declare function redactPII(content: string): string;
-/**
- * Apply anonymization to CFP document
- */
 export declare function anonymizeCFP(cfp: CFPFormat, level: AnonymizationLevel): {
     cfp: CFPFormat;
     transforms: string[];

package/packages/@monomind/cli/dist/src/transfer/anonymization/index.js

@@ -35,10 +35,15 @@ const REDACTIONS = {
 function hash(input) {
     return crypto.createHash('sha256').update(input).digest('hex');
 }
+/** Maximum content size for PII scanning/redaction (4 MB). */
+const MAX_SCAN_SIZE = 4 * 1024 * 1024;
 /**
  * Detect PII in a string
  */
 export function detectPII(content) {
+    if (content.length > MAX_SCAN_SIZE) {
+        throw new Error(`detectPII: content too large (${content.length} bytes; max ${MAX_SCAN_SIZE})`);
+    }
     const result = {
         found: false,
         count: 0,
@@ -85,6 +90,9 @@ function getSeverity(type) {
  * Redact PII from a string
  */
 export function redactPII(content) {
+    if (content.length > MAX_SCAN_SIZE) {
+        throw new Error(`redactPII: content too large (${content.length} bytes; max ${MAX_SCAN_SIZE})`);
+    }
     let result = content;
     for (const [type, pattern] of Object.entries(PII_PATTERNS)) {
         const replacement = REDACTIONS[type];
@@ -100,9 +108,16 @@ export function redactPII(content) {
 /**
  * Apply anonymization to CFP document
  */
+/** Maximum CFP payload size accepted for anonymization (10 MB). */
+const MAX_CFP_ANONYMIZE_SIZE = 10 * 1024 * 1024;
 export function anonymizeCFP(cfp, level) {
+    // Guard before deep clone to prevent OOM on a crafted large object
+    const serialized = JSON.stringify(cfp);
+    if (serialized.length > MAX_CFP_ANONYMIZE_SIZE) {
+        throw new Error(`anonymizeCFP: CFP payload too large (${serialized.length} bytes; max ${MAX_CFP_ANONYMIZE_SIZE})`);
+    }
     const transforms = [];
-    const anonymized = JSON.parse(JSON.stringify(cfp));
+    const anonymized = JSON.parse(serialized);
     // Level: Minimal
     if (['minimal', 'standard', 'strict', 'paranoid'].includes(level)) {
         // Redact author display name

package/packages/@monomind/cli/dist/src/transfer/deploy-seraphine.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env npx tsx
+/**
+ * Deploy Seraphine Genesis Model
+ * Exports and uploads the first Monomind pattern model to IPFS
+ *
+ * Usage:
+ *   npx tsx deploy-seraphine.ts
+ *   npx tsx deploy-seraphine.ts --output ./patterns/
+ *   npx tsx deploy-seraphine.ts --to-ipfs
+ *   npx tsx deploy-seraphine.ts --to-ipfs --anonymize strict
+ */
+export {};
+//# sourceMappingURL=deploy-seraphine.d.ts.map

package/packages/@monomind/cli/dist/src/transfer/deploy-seraphine.js

@@ -0,0 +1,205 @@
+#!/usr/bin/env npx tsx
+/**
+ * Deploy Seraphine Genesis Model
+ * Exports and uploads the first Monomind pattern model to IPFS
+ *
+ * Usage:
+ *   npx tsx deploy-seraphine.ts
+ *   npx tsx deploy-seraphine.ts --output ./patterns/
+ *   npx tsx deploy-seraphine.ts --to-ipfs
+ *   npx tsx deploy-seraphine.ts --to-ipfs --anonymize strict
+ */
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+import { createSeraphineGenesis, getSeraphineInfo } from './models/seraphine.js';
+import { exportPatterns } from './export.js';
+import { validateCFP } from './serialization/cfp.js';
+import { scanCFPForPII } from './anonymization/index.js';
+/**
+ * Parse CLI arguments
+ */
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const options = {
+        toIpfs: false,
+        anonymize: 'standard',
+        pin: true,
+        gateway: 'https://w3s.link',
+        validate: true,
+        verbose: false,
+    };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        switch (arg) {
+            case '--output':
+            case '-o':
+                options.output = args[++i];
+                break;
+            case '--to-ipfs':
+            case '--ipfs':
+                options.toIpfs = true;
+                break;
+            case '--anonymize':
+            case '-a':
+                options.anonymize = args[++i];
+                break;
+            case '--no-pin':
+                options.pin = false;
+                break;
+            case '--gateway':
+            case '-g':
+                options.gateway = args[++i];
+                break;
+            case '--no-validate':
+                options.validate = false;
+                break;
+            case '--verbose':
+            case '-v':
+                options.verbose = true;
+                break;
+            case '--help':
+            case '-h':
+                printHelp();
+                process.exit(0);
+        }
+    }
+    return options;
+}
+/**
+ * Print help message
+ */
+function printHelp() {
+    console.log(`
+Seraphine Genesis Deployer
+==========================
+
+Deploy the foundational Monomind pattern model.
+
+Usage:
+  npx ts-node deploy-seraphine.ts [options]
+
+Options:
+  --output, -o <path>     Output file path
+  --to-ipfs, --ipfs       Upload to IPFS
+  --anonymize, -a <level> Anonymization level (minimal|standard|strict|paranoid)
+  --gateway, -g <url>     IPFS gateway URL
+  --no-pin                Don't pin to pinning service
+  --no-validate           Skip validation
+  --verbose, -v           Verbose output
+  --help, -h              Show this help
+
+Examples:
+  npx ts-node deploy-seraphine.ts --output ./seraphine-genesis.cfp.json
+  npx ts-node deploy-seraphine.ts --to-ipfs --anonymize strict
+  npx ts-node deploy-seraphine.ts --to-ipfs --gateway https://dweb.link
+`);
+}
+/**
+ * Main deploy function
+ */
+async function deploy() {
+    const options = parseArgs();
+    console.log('');
+    console.log('╔══════════════════════════════════════════════════════════╗');
+    console.log('║        SERAPHINE GENESIS MODEL DEPLOYMENT                 ║');
+    console.log('║        The First Monomind Pattern Model                ║');
+    console.log('╚══════════════════════════════════════════════════════════╝');
+    console.log('');
+    // Step 1: Create Seraphine Genesis
+    console.log('📦 Creating Seraphine Genesis Model...');
+    const genesis = createSeraphineGenesis();
+    const info = getSeraphineInfo();
+    console.log(`   Name: ${info.name}`);
+    console.log(`   Version: ${info.version}`);
+    console.log(`   Description: ${info.description.slice(0, 60)}...`);
+    console.log('');
+    console.log('   Pattern Counts:');
+    for (const [type, count] of Object.entries(info.patternCounts)) {
+        console.log(`     - ${type}: ${count}`);
+    }
+    console.log('');
+    // Step 2: Validate
+    if (options.validate) {
+        console.log('✅ Validating CFP format...');
+        const validation = validateCFP(genesis);
+        if (!validation.valid) {
+            console.error('❌ Validation failed:');
+            for (const error of validation.errors) {
+                console.error(`   - ${error}`);
+            }
+            process.exit(1);
+        }
+        console.log('   Format is valid!');
+        console.log('');
+    }
+    // Step 3: Scan for PII
+    console.log('🔍 Scanning for PII...');
+    const piiScan = scanCFPForPII(genesis);
+    if (piiScan.found) {
+        console.log(`   Found ${piiScan.count} PII items:`);
+        for (const [type, count] of Object.entries(piiScan.types)) {
+            console.log(`     - ${type}: ${count}`);
+        }
+        console.log('   Will be redacted during export.');
+    }
+    else {
+        console.log('   No PII detected!');
+    }
+    console.log('');
+    // Step 4: Export
+    console.log(`📤 Exporting with ${options.anonymize} anonymization...`);
+    const exportOptions = {
+        output: options.output,
+        toIpfs: options.toIpfs,
+        anonymize: options.anonymize,
+        pin: options.pin,
+        gateway: options.gateway,
+        format: 'json',
+        redactPii: true,
+    };
+    // If no output specified and not uploading to IPFS, create default output
+    if (!options.output && !options.toIpfs) {
+        const defaultOutput = path.join(process.cwd(), 'seraphine-genesis.cfp.json');
+        exportOptions.output = defaultOutput;
+    }
+    const result = await exportPatterns(genesis, exportOptions);
+    console.log('');
+    console.log('═══════════════════════════════════════════════════════════');
+    console.log('                    DEPLOYMENT COMPLETE                     ');
+    console.log('═══════════════════════════════════════════════════════════');
+    console.log('');
+    if (result.success) {
+        console.log('✅ Successfully deployed Seraphine Genesis!');
+        console.log('');
+        console.log('   📊 Export Summary:');
+        console.log(`      Patterns: ${result.patternCount}`);
+        console.log(`      Size: ${result.size} bytes`);
+        console.log(`      Anonymization: ${result.anonymizationLevel}`);
+        if (result.outputPath) {
+            console.log('');
+            console.log(`   📁 File: ${result.outputPath}`);
+        }
+        if (result.cid) {
+            console.log('');
+            console.log('   🌐 IPFS:');
+            console.log(`      CID: ${result.cid}`);
+            console.log(`      Gateway URL: ${result.gateway}/ipfs/${result.cid}`);
+        }
+        console.log('');
+        console.log('   🎉 Hello World! The genesis pattern has been deployed.');
+        console.log('   🌟 This is the first Monomind pattern ever shared.');
+        console.log('');
+    }
+    else {
+        console.error('❌ Deployment failed!');
+        process.exit(1);
+    }
+}
+// Run if executed directly
+deploy().catch(error => {
+    console.error('Fatal error:', error);
+    process.exit(1);
+});
+//# sourceMappingURL=deploy-seraphine.js.map

package/packages/@monomind/cli/dist/src/transfer/export.js

@@ -49,6 +49,14 @@ export async function exportPatterns(cfp, options = {}) {
         // Write to file
         const ext = getFileExtension(format);
         outputPath = output.endsWith(ext) ? output : output + ext;
+        // Path traversal guard — output must resolve within the current working
+        // directory to prevent callers from writing to arbitrary filesystem paths.
+        const projectRoot = path.resolve(process.cwd());
+        const resolvedOutputPath = path.resolve(process.cwd(), outputPath);
+        if (!resolvedOutputPath.startsWith(projectRoot + path.sep) && resolvedOutputPath !== projectRoot) {
+            throw new Error(`Output path must resolve within the project directory: ${projectRoot}`);
+        }
+        outputPath = resolvedOutputPath;
         // Ensure directory exists
         const dir = path.dirname(outputPath);
         if (!fs.existsSync(dir)) {

package/packages/@monomind/cli/dist/src/transfer/ipfs/upload.js

@@ -6,6 +6,14 @@
  * @version 3.0.0
  */
 import * as crypto from 'crypto';
+/**
+ * Sanitize a user-supplied filename before embedding it inside a multipart
+ * Content-Disposition header.  Strip all CR/LF characters (MIME header injection)
+ * and cap length to prevent oversized headers.
+ */
+function sanitizeFileName(name) {
+    return name.replace(/[\r\n]/g, '').slice(0, 200);
+}
 /**
  * Get web3.storage token from environment or config
  */
@@ -42,7 +50,7 @@ async function uploadToWeb3Storage(content, options) {
             'Get a free token at: https://web3.storage');
     }
     const endpoint = options.endpoint || 'https://api.web3.storage';
-    const name = options.name || 'pattern.cfp.json';
+    const name = sanitizeFileName(options.name || 'pattern.cfp.json');
     console.log(`[IPFS] Uploading ${content.length} bytes to web3.storage...`);
     // Create FormData-like body for upload
     const boundary = '----WebKitFormBoundary' + crypto.randomBytes(16).toString('hex');
@@ -91,7 +99,7 @@ async function uploadToPinata(content, options) {
         throw new Error('Pinata API credentials not found. Set PINATA_API_KEY and PINATA_API_SECRET.\n' +
             'Get credentials at: https://pinata.cloud');
     }
-    const name = options.name || 'pattern.cfp.json';
+    const name = sanitizeFileName(options.name || 'pattern.cfp.json');
     console.log(`[IPFS] Uploading ${content.length} bytes to Pinata...`);
     const boundary = '----WebKitFormBoundary' + crypto.randomBytes(16).toString('hex');
     const metadata = JSON.stringify({ name });
@@ -277,14 +285,36 @@ export async function unpinContent(cid, options = {}) {
     console.log(`[IPFS] Demo unpinned`);
     return { success: true };
 }
+/** Allowlisted IPFS gateway hosts for SSRF prevention */
+const ALLOWED_GATEWAY_HOSTS_UPLOAD = new Set([
+    'w3s.link',
+    'gateway.pinata.cloud',
+    'cloudflare-ipfs.com',
+    'ipfs.io',
+    'dweb.link',
+]);
+function isAllowedGateway(gateway) {
+    try {
+        const parsed = new URL(gateway);
+        return parsed.protocol === 'https:' && ALLOWED_GATEWAY_HOSTS_UPLOAD.has(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Check if content exists on IPFS
  */
 export async function checkContent(cid, gateway = 'https://w3s.link') {
+    if (!isAllowedGateway(gateway)) {
+        console.warn(`[IPFS] Blocked checkContent: gateway not in allowlist: ${gateway}`);
+        return { exists: false };
+    }
     console.log(`[IPFS] Checking ${cid}...`);
     try {
         const response = await fetch(`${gateway}/ipfs/${cid}`, {
             method: 'HEAD',
+            signal: AbortSignal.timeout(10000),
         });
         if (response.ok) {
             const size = parseInt(response.headers.get('content-length') || '0', 10);
@@ -315,7 +345,7 @@ export function getIPNSURL(name, gateway = 'https://w3s.link') {
  */
 async function uploadToLocalIPFS(content, options) {
     const apiUrl = process.env.IPFS_API_URL || 'http://localhost:5001';
-    const name = options.name || 'pattern.cfp.json';
+    const name = sanitizeFileName(options.name || 'pattern.cfp.json');
     console.log(`[IPFS] Uploading ${content.length} bytes to ${apiUrl}...`);
     const boundary = '----IPFSBoundary' + crypto.randomBytes(16).toString('hex');
     const body = Buffer.concat([

package/packages/@monomind/cli/dist/src/transfer/serialization/cfp.js

@@ -107,11 +107,17 @@ export function serializeToBuffer(cfp, format) {
             return Buffer.from(json, 'utf-8');
     }
 }
+/** Maximum CFP payload size (10 MB) — prevents OOM on crafted inputs. */
+const MAX_CFP_SIZE = 10 * 1024 * 1024;
 /**
  * Deserialize CFP from string/buffer
  */
 export function deserializeCFP(data) {
     const str = typeof data === 'string' ? data : data.toString('utf-8');
+    // Guard against OOM before parsing
+    if (str.length > MAX_CFP_SIZE) {
+        throw new Error(`CFP payload too large (${str.length} bytes; max ${MAX_CFP_SIZE})`);
+    }
     let parsed;
     try {
         parsed = JSON.parse(str);
@@ -119,9 +125,9 @@ export function deserializeCFP(data) {
     catch (e) {
         throw new Error(`Invalid CFP file: ${e instanceof Error ? e.message : String(e)}`);
     }
-    // Validate magic bytes
+    // Validate magic bytes — use a fixed message to avoid reflecting arbitrary input
     if (parsed.magic !== 'CFP1') {
-        throw new Error(`Invalid CFP format: expected magic 'CFP1', got '${parsed.magic}'`);
+        throw new Error('Invalid CFP format: unexpected magic bytes');
     }
     return parsed;
 }
@@ -131,7 +137,7 @@ export function deserializeCFP(data) {
 export function validateCFP(cfp) {
     const errors = [];
     if (cfp.magic !== 'CFP1') {
-        errors.push(`Invalid magic bytes: ${cfp.magic}`);
+        errors.push('Invalid magic bytes');
     }
     if (!cfp.version) {
         errors.push('Missing version');

package/packages/@monomind/cli/dist/src/transfer/storage/gcs.js

@@ -105,7 +105,24 @@ export async function uploadToGCS(content, options = {}) {
         execFileSync('gcloud', uploadArgs, { encoding: 'utf-8', stdio: 'pipe', timeout: 60000 });
         // Set metadata if provided
         if (options.metadata && Object.keys(options.metadata).length > 0) {
-            const metadataJson = JSON.stringify(options.metadata);
+            // Cap metadata to prevent unbounded flag values; restrict key charset to
+            // alphanumeric/dash/underscore to avoid injection in --custom-metadata=<json>.
+            const MAX_META_KEY_LEN = 128;
+            const MAX_META_VAL_LEN = 512;
+            const MAX_META_ENTRIES = 20;
+            const safeMetadata = {};
+            let metaCount = 0;
+            for (const [k, v] of Object.entries(options.metadata)) {
+                if (metaCount >= MAX_META_ENTRIES)
+                    break;
+                if (typeof k !== 'string' || typeof v !== 'string')
+                    continue;
+                if (!/^[a-zA-Z0-9_-]+$/.test(k))
+                    continue;
+                safeMetadata[k.slice(0, MAX_META_KEY_LEN)] = v.slice(0, MAX_META_VAL_LEN);
+                metaCount++;
+            }
+            const metadataJson = JSON.stringify(safeMetadata);
             try {
                 const metaArgs = ['storage', 'objects', 'update', `gs://${config.bucket}/${objectPath}`, `--custom-metadata=${metadataJson}`];
                 if (config.projectId)
@@ -164,6 +181,15 @@ export async function downloadFromGCS(uri, config) {
         if (cfg?.projectId)
             downloadArgs.push(`--project=${cfg.projectId}`);
         execFileSync('gcloud', downloadArgs, { encoding: 'utf-8', stdio: 'pipe' });
+        const MAX_GCS_DOWNLOAD_BYTES = 50 * 1024 * 1024; // 50 MB
+        const fileSize = fs.statSync(tempFile).size;
+        if (fileSize > MAX_GCS_DOWNLOAD_BYTES) {
+            const resolvedTemp2 = path.resolve(tempFile);
+            if (resolvedTemp2.startsWith(path.resolve(tempDir)))
+                fs.unlinkSync(tempFile);
+            console.error(`[GCS] Downloaded file exceeds size limit (${fileSize} > ${MAX_GCS_DOWNLOAD_BYTES} bytes)`);
+            return null;
+        }
         const content = fs.readFileSync(tempFile);
         const resolvedTemp = path.resolve(tempFile);
         if (resolvedTemp.startsWith(path.resolve(tempDir))) {
@@ -215,9 +241,17 @@ export async function listGCSObjects(prefix, config) {
         const listArgs = ['storage', 'ls', '-l', uri, '--format=json'];
         if (cfg.projectId)
             listArgs.push(`--project=${cfg.projectId}`);
-        const result = execFileSync('gcloud', listArgs, { encoding: 'utf-8', stdio: 'pipe' });
+        const result = execFileSync('gcloud', listArgs, { encoding: 'utf-8', stdio: 'pipe', maxBuffer: 10 * 1024 * 1024 });
+        // Guard against gcloud returning a huge JSON payload that could OOM Node.
+        const MAX_LIST_BYTES = 10 * 1024 * 1024; // 10 MB
+        if (result.length > MAX_LIST_BYTES) {
+            console.error(`[GCS] listGCSObjects response too large (${result.length} bytes), truncating`);
+            return [];
+        }
         const objects = JSON.parse(result);
-        return objects.map((obj) => ({
+        if (!Array.isArray(objects))
+            return [];
+        return objects.slice(0, 10_000).map((obj) => ({
             name: obj.name,
             size: obj.size || 0,
             updated: obj.updated || new Date().toISOString(),