opencode-self-improvement 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/gates.ts

@@ -10,6 +10,7 @@ import {
   loadScope,
   markSuperseded,
   snapshotFiles,
+  MAX_CONTENT_CHARS,
   type Memory,
 } from "./memory.ts";
 import { chainId, contentHash, record, recordWriteBlocked } from "./evidence.ts";
@@ -196,6 +197,24 @@ export async function runWriteGate(
   ctx: GateContext,
 ): Promise<GateOutcome> {
   const chain = chainId();
+
+  // Size/type floor BEFORE any scanning (issue #20): gate analysis regexes
+  // over megabyte content backtracked super-linearly and froze the service
+  // event loop. Measured pre-fix: 100KB write = 6s, 2MB = never returned.
+  if (typeof candidate.content !== "string") {
+    await recordWriteBlocked(4, "invalid_content", [`content_type=${typeof candidate.content}`], chain);
+    return { action: "blocked", reason: "invalid_content", chain, hint: "content must be a string." };
+  }
+  if (candidate.content.length > MAX_CONTENT_CHARS) {
+    await recordWriteBlocked(4, "content_too_long", [`len=${candidate.content.length}`, `max=${MAX_CONTENT_CHARS}`], chain);
+    return {
+      action: "blocked",
+      reason: "content_too_long",
+      chain,
+      hint: `content is ${candidate.content.length} chars (max ${MAX_CONTENT_CHARS}). Distill the memory to its durable core and retry.`,
+    };
+  }
+
   const ch = contentHash(candidate.content);
   await record("gate_start", {
     chain,

package/src/memory.ts

@@ -10,6 +10,14 @@ import { blockedTs } from "./blocklist.ts";
 
 export type MemoryStatus = "open" | "settled";
 
+// Hard ceiling on stored content (issue #20). No entry point may persist a
+// line longer than this: injection ever shows ~1200 chars, the gate runs on
+// the shared service event loop, and regex scanning over megabyte-scale
+// strings froze every session (measured: 100KB write = 6s, 2MB = hang).
+// Enforced twice — politely in runWriteGate (blocked outcome + evidence),
+// absolutely in appendMemory (throws, covering gate-bypassing callers).
+export const MAX_CONTENT_CHARS = 4000;
+
 export interface Memory {
   ts: string;
   type: string;
@@ -109,6 +117,13 @@ async function existingTs(): Promise<Set<string>> {
 
 // Append a durable memory. Only the gate's GATE-4 promotion step calls this.
 export async function appendMemory(input: AppendMemoryInput): Promise<string> {
+  // Absolute floor (issue #20): every write SHOULD arrive through the gate,
+  // which rejects oversized content politely; the viewer's restore/edit paths
+  // do not, so nothing oversized leaves this function either.
+  if (typeof input.content !== "string") throw new Error("memory content must be a string");
+  if (input.content.length > MAX_CONTENT_CHARS) {
+    throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
+  }
   const taken = await existingTs();
   let ts = new Date().toISOString();
   let guard = 0;

package/src/resolver.ts

@@ -82,7 +82,15 @@ function looksProseArgs(inner: string): boolean {
   return s.split(/\s+/).length >= 2;
 }
 
+// Regex scanning ceiling (issue #20): PATH_RE backtracks super-linearly on
+// long word-character runs (200KB of base64 as memory content hung the gate
+// on the service event loop; ~6s already at 100KB). The write gate rejects
+// content far above this ceiling upstream; the bails protect every scanner
+// from legacy oversized rows and any direct caller.
+export const REGEX_SCAN_MAX_CHARS = 10_000;
+
 export function extractCallForms(content: string): CallForm[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   const forms: CallForm[] = [];
   CALL_RE.lastIndex = 0;
   for (;;) {
@@ -111,6 +119,7 @@ export function extractCallForms(content: string): CallForm[] {
 const PATH_RE = /[A-Za-z0-9_@./-]+\.(?:ts|tsx|js|jsx|mjs|cjs)(?::\d+)?/g;
 
 export function extractPathRefs(content: string): string[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   return [...content.matchAll(PATH_RE)].map((m) => m[0]);
 }
 
@@ -121,6 +130,7 @@ export function extractPathRefs(content: string): string[] {
 // another machine, e.g. in `$BUILD_ROOT/src/a.ts` the regex match is
 // `BUILD_ROOT/src/a.ts`, which the preceding-char check drops.
 export function checkablePathRefs(content: string): string[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   const out: string[] = [];
   for (const m of content.matchAll(PATH_RE)) {
     const ref = m[0].replace(/:\d+$/, "");

package/src/undo.ts

@@ -9,7 +9,7 @@
 // must survive" — that call belongs to the caller, so the default mode CHECK
 // refuses and lists the divergent rows; MERGE replays them on top of the
 // snapshot; FORCE is the old exact rollback.
-import { join, basename } from "node:path";
+import { basename, join, resolve, sep } from "node:path";
 import { snapshotDir } from "./config.ts";
 import { ensureDir } from "./logfmt.ts";
 
@@ -78,7 +78,14 @@ export async function restoreSnapshot(
   if (!(await f.exists())) throw new Error(`snapshot not found: ${snapshot}`);
 
   const original = name.replace(/^\d+-/, "");
-  const target = join(memoryRootDir, original);
+  // Defense in depth (issue #21): `name` is basenamed above, so `original`
+  // carries no separators — but a restore must never write outside the memory
+  // root no matter what a future caller passes.
+  const rootAbs = resolve(memoryRootDir);
+  const target = resolve(rootAbs, original);
+  if (!target.startsWith(rootAbs + sep)) {
+    throw new Error(`snapshot target escapes the memory root: ${original}`);
+  }
   const snapLines = rows(await f.text());
   const cur = Bun.file(target);
   const curLines = (await cur.exists()) ? rows(await cur.text()) : [];

package/src/viewer/server.ts

@@ -4,7 +4,7 @@
 // through the same loadAll() used by recall/inject (so blocked entries are
 // hidden), and all mutations are non-destructive (snapshot + audit + supersede).
 // I2: serves only file data; never writes into any repo.
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { serve, type Server } from "bun";
 import { deletionsFile, memoryRoot, snapshotDir } from "../config.ts";
 import { blockedEntries } from "../blocklist.ts";
@@ -213,7 +213,14 @@ async function restoreEntryRoute(body: Record<string, unknown>): Promise<Respons
 }
 
 async function restoreRoute(body: Record<string, unknown>): Promise<Response> {
-  const name = String(body.name ?? "");
+  // Path containment (issue #21): name arrives raw from the wire. Basename it,
+  // then pin it to the real snapshot-name grammar — `<epoch-ms>-<YYYY-MM-DD>.logfmt`
+  // — so neither path join below can be steered outside snapshots/ and the
+  // store root with a `..` or absolute name.
+  const name = basename(String(body.name ?? ""));
+  if (!/^\d+-\d{4}-\d{2}-\d{2}\.logfmt$/.test(name)) {
+    return error("invalid snapshot name", 400);
+  }
   const original = name.replace(/^\d+-/, "");
   // Explicit human admin action: exact rollback — but the rollback is itself
   // rollback-able. Snapshot the current file first so concurrent-session rows