opencode-self-improvement 0.3.1 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-self-improvement",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Durable memory for opencode: remember facts, decisions, and commands across sessions, plus a one-command per-repo setup (/repo-init).",
   "main": "index.ts",
   "exports": {

package/src/gates.ts

@@ -10,6 +10,7 @@ import {
   loadScope,
   markSuperseded,
   snapshotFiles,
+  MAX_CONTENT_CHARS,
   type Memory,
 } from "./memory.ts";
 import { chainId, contentHash, record, recordWriteBlocked } from "./evidence.ts";
@@ -196,6 +197,24 @@ export async function runWriteGate(
   ctx: GateContext,
 ): Promise<GateOutcome> {
   const chain = chainId();
+
+  // Size/type floor BEFORE any scanning (issue #20): gate analysis regexes
+  // over megabyte content backtracked super-linearly and froze the service
+  // event loop. Measured pre-fix: 100KB write = 6s, 2MB = never returned.
+  if (typeof candidate.content !== "string") {
+    await recordWriteBlocked(4, "invalid_content", [`content_type=${typeof candidate.content}`], chain);
+    return { action: "blocked", reason: "invalid_content", chain, hint: "content must be a string." };
+  }
+  if (candidate.content.length > MAX_CONTENT_CHARS) {
+    await recordWriteBlocked(4, "content_too_long", [`len=${candidate.content.length}`, `max=${MAX_CONTENT_CHARS}`], chain);
+    return {
+      action: "blocked",
+      reason: "content_too_long",
+      chain,
+      hint: `content is ${candidate.content.length} chars (max ${MAX_CONTENT_CHARS}). Distill the memory to its durable core and retry.`,
+    };
+  }
+
   const ch = contentHash(candidate.content);
   await record("gate_start", {
     chain,

package/src/memory.ts

@@ -10,6 +10,14 @@ import { blockedTs } from "./blocklist.ts";
 
 export type MemoryStatus = "open" | "settled";
 
+// Hard ceiling on stored content (issue #20). No entry point may persist a
+// line longer than this: injection ever shows ~1200 chars, the gate runs on
+// the shared service event loop, and regex scanning over megabyte-scale
+// strings froze every session (measured: 100KB write = 6s, 2MB = hang).
+// Enforced twice — politely in runWriteGate (blocked outcome + evidence),
+// absolutely in appendMemory (throws, covering gate-bypassing callers).
+export const MAX_CONTENT_CHARS = 4000;
+
 export interface Memory {
   ts: string;
   type: string;
@@ -109,6 +117,13 @@ async function existingTs(): Promise<Set<string>> {
 
 // Append a durable memory. Only the gate's GATE-4 promotion step calls this.
 export async function appendMemory(input: AppendMemoryInput): Promise<string> {
+  // Absolute floor (issue #20): every write SHOULD arrive through the gate,
+  // which rejects oversized content politely; the viewer's restore/edit paths
+  // do not, so nothing oversized leaves this function either.
+  if (typeof input.content !== "string") throw new Error("memory content must be a string");
+  if (input.content.length > MAX_CONTENT_CHARS) {
+    throw new Error(`memory content exceeds ${MAX_CONTENT_CHARS} chars (${input.content.length})`);
+  }
   const taken = await existingTs();
   let ts = new Date().toISOString();
   let guard = 0;

package/src/resolver.ts

@@ -82,7 +82,15 @@ function looksProseArgs(inner: string): boolean {
   return s.split(/\s+/).length >= 2;
 }
 
+// Regex scanning ceiling (issue #20): PATH_RE backtracks super-linearly on
+// long word-character runs (200KB of base64 as memory content hung the gate
+// on the service event loop; ~6s already at 100KB). The write gate rejects
+// content far above this ceiling upstream; the bails protect every scanner
+// from legacy oversized rows and any direct caller.
+export const REGEX_SCAN_MAX_CHARS = 10_000;
+
 export function extractCallForms(content: string): CallForm[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   const forms: CallForm[] = [];
   CALL_RE.lastIndex = 0;
   for (;;) {
@@ -111,6 +119,7 @@ export function extractCallForms(content: string): CallForm[] {
 const PATH_RE = /[A-Za-z0-9_@./-]+\.(?:ts|tsx|js|jsx|mjs|cjs)(?::\d+)?/g;
 
 export function extractPathRefs(content: string): string[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   return [...content.matchAll(PATH_RE)].map((m) => m[0]);
 }
 
@@ -121,6 +130,7 @@ export function extractPathRefs(content: string): string[] {
 // another machine, e.g. in `$BUILD_ROOT/src/a.ts` the regex match is
 // `BUILD_ROOT/src/a.ts`, which the preceding-char check drops.
 export function checkablePathRefs(content: string): string[] {
+  if (content.length > REGEX_SCAN_MAX_CHARS) return [];
   const out: string[] = [];
   for (const m of content.matchAll(PATH_RE)) {
     const ref = m[0].replace(/:\d+$/, "");

package/src/viewer/server.ts

@@ -17,10 +17,20 @@ const PAGE = join(import.meta.dir, "page.html");
 const HOST = process.env.OPENCODE_VIEWER_HOST || "127.0.0.1";
 const PORT = Number(process.env.OPENCODE_VIEWER_PORT || 8787);
 
+// Defense-in-depth headers on every response. CSP: the page uses only inline
+// script/style and same-origin fetch, so everything else is off — a stored-XSS
+// payload (see issue #11) gains no exfil channel and no framing.
+const SECURITY_HEADERS: Record<string, string> = {
+  "x-content-type-options": "nosniff",
+  "content-security-policy":
+    "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; " +
+    "connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+};
+
 function json(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json" },
+    headers: { ...SECURITY_HEADERS, "content-type": "application/json" },
   });
 }
 
@@ -116,13 +126,21 @@ export async function startViewer(port: number = PORT): Promise<ViewerServer> {
     hostname: HOST,
     port,
     fetch(req, srv) {
-      // Bun builds req.url from the request's Host header.
-      const url = new URL(req.url);
+      // Bun builds req.url from the request's Host header. A malformed Host
+      // makes the URL parse THROW — before rejectRequest could answer. Letting
+      // that escape hands the caller Bun's dev error page (stack + absolute
+      // paths), so the parse itself is the first guarded step (issue #12).
+      let url: URL;
+      try {
+        url = new URL(req.url);
+      } catch {
+        return error("malformed request URL (bad Host header?)", 400);
+      }
       const rejected = rejectRequest(req, url, server.port ?? port);
       if (rejected) return rejected;
       if (url.pathname === "/") {
         return new Response(page, {
-          headers: { "content-type": "text/html; charset=utf-8" },
+          headers: { ...SECURITY_HEADERS, "content-type": "text/html; charset=utf-8" },
         });
       }
       if (req.method === "GET" && url.pathname === "/api/data") {