prjct-cli 1.7.2 → 1.7.4

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [1.7.4] - 2026-02-07
+
+### Bug Fixes
+
+- add eviction policies to all in-memory caches (PRJ-288) (#143)
+
+
+## [1.7.4] - 2026-02-07
+
+### Bug Fixes
+- **Add eviction policies to all in-memory caches (PRJ-288)**: Replaced unbounded Maps with TTLCache in SessionLogManager and ContextBuilder, capped PatternStore decision contexts at 20 with FIFO eviction, and added 90-day archival for stale decisions to prevent unbounded memory growth.
+
+### Implementation Details
+- SessionLogManager: replaced 2 `Map` caches with `TTLCache` (maxSize: 50, TTL: 1hr)
+- ContextBuilder: replaced `Map` + `_mtimes` + manual TTL with single `TTLCache<CachedFile>` (maxSize: 200, TTL: 5s), added project-switch detection
+- PatternStore: added `afterLoad()` hook to truncate oversized contexts arrays, FIFO cap at 20 in `recordDecision()`, new `archiveStaleDecisions()` method for 90-day archival
+- Exposed `archiveStaleDecisions()` via MemorySystem facade
+
+### Test Plan
+
+#### For QA
+1. Run `bun test core/__tests__/agentic/cache-eviction.test.ts` — 12 new tests pass
+2. Run `bun test` — full suite (538 tests) passes with no regressions
+3. Run `bun run build` — compiles without errors
+4. Verify `prjct sync` and `prjct status` work normally
+
+#### For Users
+**What changed:** Internal optimization — in-memory caches now bounded to prevent memory growth during long sessions.
+**How to use:** No user-facing changes.
+**Breaking changes:** None
+
+## [1.7.3] - 2026-02-07
+
+### Bug Fixes
+
+- add Zod validation and token budgets for prompt injection (PRJ-282) (#142)
+
+
+## [1.7.3] - 2026-02-07
+
+### Bug Fixes
+- **Validate auto-injected state in prompt builder (PRJ-282)**: Added `safeInject()` validation utility, token-aware truncation via `InjectionBudgetTracker`, and domain-based skill filtering to prevent oversized or irrelevant content in LLM prompts. Replaced hardcoded character limits with configurable token budgets.
+
+### Implementation Details
+- Created `core/agentic/injection-validator.ts` with `safeInject()`, `safeInjectString()`, `truncateToTokenBudget()`, `estimateTokens()`, `filterSkillsByDomains()`, and `InjectionBudgetTracker` class
+- Wired validation into `prompt-builder.ts`: auto-context truncation, agent/skill token budgets, cumulative state budget tracking
+- Skills filtered by detected task domains before injection to reduce token waste
+- 33 new unit tests covering all validation, filtering, and truncation paths
+
+### Test Plan
+
+#### For QA
+1. Run `bun test` — all 526 tests pass (33 new)
+2. Verify `safeInject()` returns fallback on corrupt data
+3. Verify `filterSkillsByDomains()` excludes irrelevant skills
+4. Verify `InjectionBudgetTracker` enforces cumulative limits
+
+#### For Users
+- No user-facing changes — validation is automatic
+- Breaking changes: None
+
 ## [1.7.2] - 2026-02-07
 
 ### Bug Fixes

package/core/__tests__/agentic/cache-eviction.test.ts

@@ -0,0 +1,294 @@
+/**
+ * Cache Eviction Policy Tests (PRJ-288)
+ * Verifies TTLCache integration, context caps, and archival.
+ */
+
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { ContextBuilder } from '../../agentic/context-builder'
+import { MemorySystem, PatternStore } from '../../agentic/memory-system'
+import pathManager from '../../infrastructure/path-manager'
+import { SessionLogManager } from '../../session/session-log-manager'
+import { TTLCache } from '../../utils/cache'
+
+const TEST_GLOBAL_BASE_DIR = path.join(process.cwd(), '.tmp', 'prjct-cli-cache-tests')
+let testCounter = 0
+const getTestProjectId = () => `test-cache-${Date.now()}-${++testCounter}`
+
+describe('Cache Eviction Policies (PRJ-288)', () => {
+  beforeAll(async () => {
+    pathManager.setGlobalBaseDir(TEST_GLOBAL_BASE_DIR)
+    await fs.mkdir(TEST_GLOBAL_BASE_DIR, { recursive: true })
+  })
+
+  afterAll(async () => {
+    await fs.rm(TEST_GLOBAL_BASE_DIR, { recursive: true, force: true })
+  })
+
+  // ===========================================================================
+  // TTLCache unit tests
+  // ===========================================================================
+
+  describe('TTLCache', () => {
+    it('should evict oldest entries when maxSize exceeded', () => {
+      const cache = new TTLCache<string>({ maxSize: 3, ttl: 60_000 })
+
+      cache.set('a', 'val-a')
+      cache.set('b', 'val-b')
+      cache.set('c', 'val-c')
+      expect(cache.size).toBe(3)
+
+      cache.set('d', 'val-d')
+      expect(cache.size).toBe(3)
+      // 'a' was oldest, should be evicted
+      expect(cache.get('a')).toBeNull()
+      expect(cache.get('d')).toBe('val-d')
+    })
+
+    it('should expire entries after TTL', async () => {
+      const cache = new TTLCache<string>({ maxSize: 10, ttl: 50 })
+
+      cache.set('key', 'value')
+      expect(cache.get('key')).toBe('value')
+
+      await new Promise((r) => setTimeout(r, 80))
+      expect(cache.get('key')).toBeNull()
+    })
+
+    it('should prune expired entries', async () => {
+      const cache = new TTLCache<string>({ maxSize: 10, ttl: 50 })
+
+      cache.set('a', '1')
+      cache.set('b', '2')
+      await new Promise((r) => setTimeout(r, 80))
+
+      cache.set('c', '3') // fresh
+      const pruned = cache.prune()
+      expect(pruned).toBe(2)
+      expect(cache.size).toBe(1)
+      expect(cache.get('c')).toBe('3')
+    })
+  })
+
+  // ===========================================================================
+  // SessionLogManager
+  // ===========================================================================
+
+  describe('SessionLogManager', () => {
+    it('should use TTLCache with LRU eviction at 50 entries', () => {
+      const manager = new SessionLogManager()
+      // Verify clearCache works (exercises TTLCache.clear())
+      manager.clearCache()
+    })
+  })
+
+  // ===========================================================================
+  // ContextBuilder
+  // ===========================================================================
+
+  describe('ContextBuilder', () => {
+    it('should report stats from TTLCache', () => {
+      const builder = new ContextBuilder()
+      const stats = builder.getCacheStats()
+      expect(stats).toHaveProperty('size')
+      expect(stats).toHaveProperty('maxSize')
+      expect(stats).toHaveProperty('ttl')
+      expect(stats.maxSize).toBe(200)
+      expect(stats.ttl).toBe(5000)
+    })
+
+    it('should clear cache and reset projectId', () => {
+      const builder = new ContextBuilder()
+      builder.clearCache()
+      const stats = builder.getCacheStats()
+      expect(stats.size).toBe(0)
+    })
+
+    it('should invalidate specific cache entries', async () => {
+      const builder = new ContextBuilder()
+
+      // Write a temp file, batchRead to populate cache, then invalidate
+      const tmpDir = path.join(TEST_GLOBAL_BASE_DIR, 'ctx-test')
+      await fs.mkdir(tmpDir, { recursive: true })
+      const tmpFile = path.join(tmpDir, 'test.txt')
+      await fs.writeFile(tmpFile, 'hello')
+
+      const result = await builder.batchRead([tmpFile])
+      expect(result.get(tmpFile)).toBe('hello')
+
+      // Invalidate and verify
+      builder.invalidateCache(tmpFile)
+      // After invalidation, a fresh batchRead should re-read from disk
+      await fs.writeFile(tmpFile, 'updated')
+      const result2 = await builder.batchRead([tmpFile])
+      expect(result2.get(tmpFile)).toBe('updated')
+    })
+  })
+
+  // ===========================================================================
+  // PatternStore - contexts cap
+  // ===========================================================================
+
+  describe('PatternStore contexts cap', () => {
+    let TEST_PROJECT_ID: string
+
+    beforeEach(() => {
+      TEST_PROJECT_ID = getTestProjectId()
+    })
+
+    it('should cap decision contexts at 20 (FIFO)', async () => {
+      const store = new PatternStore()
+
+      // Record a decision with many unique contexts
+      for (let i = 0; i < 25; i++) {
+        await store.recordDecision(TEST_PROJECT_ID, 'test-key', 'test-value', `context-${i}`)
+      }
+
+      const patterns = await store.load(TEST_PROJECT_ID)
+      const decision = patterns.decisions['test-key']
+      expect(decision.contexts.length).toBeLessThanOrEqual(20)
+      // Should keep the latest contexts
+      expect(decision.contexts).toContain('context-24')
+      expect(decision.contexts).toContain('context-5')
+      // Oldest should be evicted
+      expect(decision.contexts).not.toContain('context-0')
+    })
+
+    it('should truncate oversized contexts on afterLoad', async () => {
+      const store = new PatternStore()
+      const projectId = getTestProjectId()
+
+      // Manually write a patterns file with oversized contexts
+      const filePath = path.join(
+        pathManager.getGlobalProjectPath(projectId),
+        'memory',
+        'patterns.json'
+      )
+      await fs.mkdir(path.dirname(filePath), { recursive: true })
+
+      const oversizedPatterns = {
+        version: 1,
+        decisions: {
+          'big-key': {
+            value: 'v',
+            count: 30,
+            firstSeen: '2025-01-01T00:00:00.000Z',
+            lastSeen: '2025-06-01T00:00:00.000Z',
+            confidence: 'high',
+            contexts: Array.from({ length: 50 }, (_, i) => `ctx-${i}`),
+            userConfirmed: true,
+          },
+        },
+        preferences: {},
+        workflows: {},
+        counters: {},
+      }
+      await fs.writeFile(filePath, JSON.stringify(oversizedPatterns, null, 2), 'utf-8')
+
+      // Load triggers afterLoad which should truncate
+      const patterns = await store.load(projectId)
+      expect(patterns.decisions['big-key'].contexts.length).toBe(20)
+      // Should keep the latest 20 (indices 30-49)
+      expect(patterns.decisions['big-key'].contexts[19]).toBe('ctx-49')
+    })
+  })
+
+  // ===========================================================================
+  // PatternStore - archival
+  // ===========================================================================
+
+  describe('PatternStore archival', () => {
+    it('should archive decisions older than 90 days', async () => {
+      const store = new PatternStore()
+      const projectId = getTestProjectId()
+
+      // Write patterns with a stale and an active decision
+      const filePath = path.join(
+        pathManager.getGlobalProjectPath(projectId),
+        'memory',
+        'patterns.json'
+      )
+      await fs.mkdir(path.dirname(filePath), { recursive: true })
+
+      const now = new Date()
+      const staleDate = new Date(now.getTime() - 100 * 24 * 60 * 60 * 1000) // 100 days ago
+      const recentDate = new Date(now.getTime() - 5 * 24 * 60 * 60 * 1000) // 5 days ago
+
+      const patterns = {
+        version: 1,
+        decisions: {
+          'stale-key': {
+            value: 'old',
+            count: 3,
+            firstSeen: staleDate.toISOString(),
+            lastSeen: staleDate.toISOString(),
+            confidence: 'medium',
+            contexts: ['ctx1'],
+            userConfirmed: false,
+          },
+          'active-key': {
+            value: 'new',
+            count: 5,
+            firstSeen: recentDate.toISOString(),
+            lastSeen: recentDate.toISOString(),
+            confidence: 'high',
+            contexts: ['ctx2'],
+            userConfirmed: true,
+          },
+        },
+        preferences: {},
+        workflows: {},
+        counters: {},
+      }
+      await fs.writeFile(filePath, JSON.stringify(patterns, null, 2), 'utf-8')
+
+      // Reset store cache to force disk read
+      store.reset()
+      const archived = await store.archiveStaleDecisions(projectId)
+      expect(archived).toBe(1)
+
+      // Verify active decision remains
+      const updated = await store.load(projectId)
+      expect(updated.decisions['active-key']).toBeDefined()
+      expect(updated.decisions['stale-key']).toBeUndefined()
+
+      // Verify archive file was created
+      const archivePath = path.join(
+        pathManager.getGlobalProjectPath(projectId),
+        'memory',
+        'patterns-archive.json'
+      )
+      const archiveContent = JSON.parse(await fs.readFile(archivePath, 'utf-8'))
+      expect(archiveContent['stale-key']).toBeDefined()
+      expect(archiveContent['stale-key'].value).toBe('old')
+    })
+
+    it('should return 0 when no stale decisions exist', async () => {
+      const store = new PatternStore()
+      const projectId = getTestProjectId()
+
+      // Record a fresh decision
+      await store.recordDecision(projectId, 'fresh-key', 'fresh-val', 'ctx')
+      const archived = await store.archiveStaleDecisions(projectId)
+      expect(archived).toBe(0)
+    })
+  })
+
+  // ===========================================================================
+  // MemorySystem delegation
+  // ===========================================================================
+
+  describe('MemorySystem.archiveStaleDecisions', () => {
+    it('should delegate to PatternStore', async () => {
+      const ms = new MemorySystem()
+      const projectId = getTestProjectId()
+
+      // Just verify no crash - no stale data to archive
+      ms.resetState()
+      await ms.recordDecision(projectId, 'key', 'val', 'ctx')
+      const count = await ms.archiveStaleDecisions(projectId)
+      expect(count).toBe(0)
+    })
+  })
+})

package/core/__tests__/agentic/injection-validator.test.ts

@@ -0,0 +1,255 @@
+/**
+ * Injection Validator Tests
+ * Tests for safeInject, truncation, skill filtering, and budget tracking.
+ */
+
+import { describe, expect, it } from 'bun:test'
+import { z } from 'zod'
+import {
+  DEFAULT_BUDGETS,
+  estimateTokens,
+  filterSkillsByDomains,
+  InjectionBudgetTracker,
+  safeInject,
+  safeInjectString,
+  truncateToTokenBudget,
+} from '../../agentic/injection-validator'
+
+// =============================================================================
+// safeInject
+// =============================================================================
+
+describe('safeInject', () => {
+  const schema = z.object({ name: z.string(), value: z.number() })
+  const fallback = { name: 'unknown', value: 0 }
+
+  it('returns validated data on valid input', () => {
+    const data = { name: 'test', value: 42 }
+    expect(safeInject(data, schema, fallback)).toEqual(data)
+  })
+
+  it('returns fallback on invalid input', () => {
+    const data = { name: 123, value: 'bad' }
+    expect(safeInject(data, schema, fallback)).toEqual(fallback)
+  })
+
+  it('returns fallback on null input', () => {
+    expect(safeInject(null, schema, fallback)).toEqual(fallback)
+  })
+
+  it('returns fallback on undefined input', () => {
+    expect(safeInject(undefined, schema, fallback)).toEqual(fallback)
+  })
+
+  it('strips extra fields via Zod', () => {
+    const data = { name: 'test', value: 42, extra: 'ignored' }
+    const result = safeInject(data, schema, fallback)
+    expect(result.name).toBe('test')
+    expect(result.value).toBe(42)
+  })
+})
+
+// =============================================================================
+// safeInjectString
+// =============================================================================
+
+describe('safeInjectString', () => {
+  const schema = z.object({ count: z.number() })
+  const formatter = (d: { count: number }) => `Items: ${d.count}`
+
+  it('returns formatted string on valid input', () => {
+    expect(safeInjectString({ count: 5 }, schema, formatter, 'N/A')).toBe('Items: 5')
+  })
+
+  it('returns fallback string on invalid input', () => {
+    expect(safeInjectString({ count: 'bad' }, schema, formatter, 'N/A')).toBe('N/A')
+  })
+
+  it('returns fallback string on null', () => {
+    expect(safeInjectString(null, schema, formatter, 'no data')).toBe('no data')
+  })
+})
+
+// =============================================================================
+// truncateToTokenBudget
+// =============================================================================
+
+describe('truncateToTokenBudget', () => {
+  it('returns text unchanged if within budget', () => {
+    const text = 'short text'
+    expect(truncateToTokenBudget(text, 100)).toBe(text)
+  })
+
+  it('truncates text that exceeds budget', () => {
+    const text = 'a'.repeat(500) // 500 chars = ~125 tokens
+    const result = truncateToTokenBudget(text, 50) // 50 tokens = 200 chars
+    expect(result.length).toBeLessThan(500)
+    expect(result).toContain('truncated')
+    expect(result).toContain('~50 tokens')
+  })
+
+  it('truncates to exact char limit', () => {
+    const text = 'a'.repeat(100)
+    const result = truncateToTokenBudget(text, 10) // 10 tokens = 40 chars
+    expect(result.startsWith('a'.repeat(40))).toBe(true)
+  })
+
+  it('handles empty string', () => {
+    expect(truncateToTokenBudget('', 100)).toBe('')
+  })
+
+  it('handles zero budget', () => {
+    const result = truncateToTokenBudget('some text', 0)
+    expect(result).toContain('truncated')
+  })
+})
+
+// =============================================================================
+// estimateTokens
+// =============================================================================
+
+describe('estimateTokens', () => {
+  it('estimates tokens at ~4 chars per token', () => {
+    expect(estimateTokens('a'.repeat(100))).toBe(25)
+  })
+
+  it('rounds up partial tokens', () => {
+    expect(estimateTokens('abc')).toBe(1) // 3/4 = 0.75, ceil = 1
+  })
+
+  it('handles empty string', () => {
+    expect(estimateTokens('')).toBe(0)
+  })
+})
+
+// =============================================================================
+// filterSkillsByDomains
+// =============================================================================
+
+describe('filterSkillsByDomains', () => {
+  const skills = [
+    { name: 'react-patterns', content: 'React component patterns and hooks' },
+    { name: 'api-design', content: 'RESTful API design and endpoint patterns' },
+    { name: 'jest-testing', content: 'Jest test patterns and assertions' },
+    { name: 'docker-deploy', content: 'Docker and Kubernetes deployment' },
+    { name: 'general-coding', content: 'General coding best practices' },
+  ]
+
+  it('returns all skills when no domains detected', () => {
+    expect(filterSkillsByDomains(skills, [])).toEqual(skills)
+  })
+
+  it('returns all skills when skills array is empty', () => {
+    expect(filterSkillsByDomains([], ['frontend'])).toEqual([])
+  })
+
+  it('filters to frontend-relevant skills', () => {
+    const result = filterSkillsByDomains(skills, ['frontend'])
+    expect(result.some((s) => s.name === 'react-patterns')).toBe(true)
+    expect(result.some((s) => s.name === 'docker-deploy')).toBe(false)
+  })
+
+  it('filters to backend-relevant skills', () => {
+    const result = filterSkillsByDomains(skills, ['backend'])
+    expect(result.some((s) => s.name === 'api-design')).toBe(true)
+    expect(result.some((s) => s.name === 'react-patterns')).toBe(false)
+  })
+
+  it('filters to testing-relevant skills', () => {
+    const result = filterSkillsByDomains(skills, ['testing'])
+    expect(result.some((s) => s.name === 'jest-testing')).toBe(true)
+  })
+
+  it('supports multiple domains', () => {
+    const result = filterSkillsByDomains(skills, ['frontend', 'testing'])
+    expect(result.some((s) => s.name === 'react-patterns')).toBe(true)
+    expect(result.some((s) => s.name === 'jest-testing')).toBe(true)
+    expect(result.some((s) => s.name === 'docker-deploy')).toBe(false)
+  })
+
+  it('matches domain name itself as keyword', () => {
+    const customSkills = [{ name: 'devops-helper', content: 'general devops tools' }]
+    const result = filterSkillsByDomains(customSkills, ['devops'])
+    expect(result).toHaveLength(1)
+  })
+
+  it('is case insensitive', () => {
+    const result = filterSkillsByDomains(skills, ['Frontend'])
+    expect(result.some((s) => s.name === 'react-patterns')).toBe(true)
+  })
+})
+
+// =============================================================================
+// InjectionBudgetTracker
+// =============================================================================
+
+describe('InjectionBudgetTracker', () => {
+  it('tracks cumulative token usage', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 100 })
+    tracker.addSection('a'.repeat(200), 100) // 200 chars = 50 tokens
+    expect(tracker.totalUsed).toBe(50)
+    expect(tracker.remaining).toBe(50)
+  })
+
+  it('truncates sections to per-section budget', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 1000 })
+    const result = tracker.addSection('a'.repeat(500), 50) // budget: 50 tokens = 200 chars
+    expect(result.length).toBeLessThan(500)
+  })
+
+  it('returns empty string when total budget exhausted', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 10 })
+    tracker.addSection('a'.repeat(100), 50) // uses all 10 tokens of total budget
+    const result = tracker.addSection('more content', 50)
+    expect(result).toBe('')
+  })
+
+  it('fits content to remaining total budget', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 30 })
+    tracker.addSection('a'.repeat(80), 30) // 80 chars = 20 tokens
+    // Remaining: 10 tokens
+    const result = tracker.addSection('b'.repeat(200), 100) // wants 100 tokens, only 10 left
+    expect(result.length).toBeLessThan(200)
+    expect(tracker.remaining).toBe(0)
+  })
+
+  it('uses default budgets when none provided', () => {
+    const tracker = new InjectionBudgetTracker()
+    expect(tracker.config.totalPrompt).toBe(DEFAULT_BUDGETS.totalPrompt)
+    expect(tracker.config.autoContext).toBe(DEFAULT_BUDGETS.autoContext)
+  })
+
+  it('allows partial budget overrides', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 5000 })
+    expect(tracker.config.totalPrompt).toBe(5000)
+    expect(tracker.config.autoContext).toBe(DEFAULT_BUDGETS.autoContext) // unchanged
+  })
+
+  it('remaining never goes negative', () => {
+    const tracker = new InjectionBudgetTracker({ totalPrompt: 5 })
+    tracker.addSection('a'.repeat(1000), 500)
+    expect(tracker.remaining).toBe(0)
+  })
+})
+
+// =============================================================================
+// DEFAULT_BUDGETS
+// =============================================================================
+
+describe('DEFAULT_BUDGETS', () => {
+  it('has all required fields', () => {
+    expect(DEFAULT_BUDGETS.autoContext).toBeGreaterThan(0)
+    expect(DEFAULT_BUDGETS.agentContent).toBeGreaterThan(0)
+    expect(DEFAULT_BUDGETS.skillContent).toBeGreaterThan(0)
+    expect(DEFAULT_BUDGETS.stateData).toBeGreaterThan(0)
+    expect(DEFAULT_BUDGETS.memories).toBeGreaterThan(0)
+    expect(DEFAULT_BUDGETS.totalPrompt).toBeGreaterThan(0)
+  })
+
+  it('totalPrompt is larger than individual budgets', () => {
+    expect(DEFAULT_BUDGETS.totalPrompt).toBeGreaterThan(DEFAULT_BUDGETS.autoContext)
+    expect(DEFAULT_BUDGETS.totalPrompt).toBeGreaterThan(DEFAULT_BUDGETS.agentContent)
+    expect(DEFAULT_BUDGETS.totalPrompt).toBeGreaterThan(DEFAULT_BUDGETS.skillContent)
+    expect(DEFAULT_BUDGETS.totalPrompt).toBeGreaterThan(DEFAULT_BUDGETS.stateData)
+  })
+})