src/limits.ts

Functions

Imports

It imports no other module of this repo. Imported by src/controls-plan.ts, src/doc-index.ts, src/doc-reads.ts, src/github/client.ts, src/github/contents.ts, src/github/search.ts, src/job-claims.ts, src/links.ts, src/namespace-delete.ts, src/portal-library.ts, src/public-code-schema.ts, src/public-stats.ts, src/resources.ts, src/system-model.ts, src/tools/admin.ts, src/tools/agents.ts, src/tools/claims.ts, src/tools/cloudflare.ts, src/tools/controls.ts, src/tools/docs-lifecycle.ts, src/tools/docs-read.ts, src/tools/docs-write.ts, src/tools/jobs.ts, src/tools/lint.ts, src/tools/namespaces.ts, src/tools/ops.ts, src/tools/repo.ts, src/tools/status.ts.

Source

1import { z } from "zod";
2
3// Repo file paths take this bound too, but are not held to docPath's grammar:
4// a GitHub path is whatever the repo contains.
5export const MAX_PATH = 512;
6export const MAX_TITLE = 1024;
7export const MAX_TAGS = 1024;
8export const MAX_NAMESPACE = 64;
9export const MAX_DOC_TYPE = 64;
10// Separate from MAX_DOC_TYPE despite the same value: different vocabularies.
11export const MAX_DOC_STATUS = 64;
12export const MAX_BODY = 1_000_000;
13export const MAX_LINKS_JSON = 8192;
14export const MAX_REPOS_JSON = 4096;
15export const MAX_QUERY = 512;
16export const MAX_GLOB = 512;
17export const MAX_REF = 255;
18export const MAX_REPO_SELECTOR = 256;
19export const MAX_SHA = 128;
20export const MAX_COMMIT_MESSAGE = 4096;
21export const MAX_PR_TITLE = 512;
22export const MAX_PR_BODY = 65_536;
23// A CI job or step name, or its numeric id, as capsid_inspect_repo action ci takes them. GitHub does not
24// document a ceiling; a name longer than this is not one a workflow file holds.
25export const MAX_CI_NAME = 512;
26// A review comment. Smaller than a PR body on purpose: a verdict plus its reasons is
27// a paragraph, and GitHub's own comment ceiling is 65_536 either way.
28export const MAX_PR_COMMENT = 16_384;
29// The seat's note on a capsid_work_jobs resume: rulings and a plan, longer than `reason` allows.
30// Not MAX_BODY: the note is stored in an audit row and rendered into the job's mirror
31// document beside the signed prompt, which can already be MAX_BODY on its own.
32export const MAX_RESUME_NOTE = 16_384;
33// The confirmation token capsid_admin_manage_namespaces action delete_preview returns: base64url claims carrying the plan's counts,
34// a dot and a 64-hex signature. Well under 2KB in practice.
35export const MAX_CONFIRM_TOKEN = 8192;
36
37export const MAX_ROWS = 500;
38export const SEARCH_ROWS = 25;
39export const BRIEF_BUDGET = 40_000;
40// Enforced by trimming, not warned about.
41export const GATHER_BUDGET = 150_000;
42// D1's ceiling on the statements in one batch, the number the bounds below are sized
43// against. delete_namespace derives its document cap from it.
44export const D1_BATCH_STATEMENTS = 100;
45// Four statements per path plus an audit row: 20 paths is 81, under D1's
46// 100-statement batch ceiling.
47export const LINT_CONSUMED_MAX = 20;
48export const CI_DISPATCH_MAX_INPUTS = 10;
49export const HISTORY_ROWS = 100;
50export const MAX_SCAN_CAP = 200;
51export const DEFAULT_SCAN_RESULTS = 20;
52export const DEFAULT_SCAN_FILES = 200;
53
54function hasControlChar(text: string): boolean {
55  for (let i = 0; i < text.length; i++) {
56    const code = text.charCodeAt(i);
57    if (code < 0x20 || code === 0x7f) return true;
58  }
59  return false;
60}
61
62export function pathProblem(path: string): string | null {
63  if (path.length === 0) return "path must not be empty";
64  if (path.length > MAX_PATH) return `path is longer than ${MAX_PATH} characters`;
65  if (path.startsWith("/")) return "path must not start with '/': paths are relative to the namespace";
66  if (path.endsWith("/")) return "path must not end with '/': it names a document, not a directory";
67  if (path.includes("..")) return "path must not contain '..'";
68  if (path.includes("//")) return "path must not contain an empty segment ('//')";
69  if (hasControlChar(path)) return "path must not contain control characters (including newlines and tabs)";
70  // SQL reads the archive with LIKE 'archive/%', which folds ASCII case, and JavaScript with
71  // startsWith("archive/"), which does not. A path like Archive/x.md would be archived to one
72  // and live to the other, so only the exact prefix is accepted (Grok audit 2026-10-21, CA-4).
73  if (path.slice(0, 8).toLowerCase() === "archive/" && !path.startsWith("archive/")) {
74    return "path must spell the archive prefix exactly 'archive/' (lowercase)";
75  }
76  return null;
77}
78
79// Whole-segment check, not includes(".."): "a..b" is a legal file name.
80// encodeURIComponent leaves "." and ".." untouched.
81export function repoPathProblem(value: string): string | null {
82  if (value.length === 0) return "must not be empty";
83  if (value.length > MAX_PATH) return `is longer than ${MAX_PATH} characters`;
84  if (hasControlChar(value)) return "must not contain control characters (including newlines and tabs)";
85  if (value.startsWith("/")) return "must not start with '/'";
86  if (value.endsWith("/")) return "must not end with '/'";
87  if (value.includes("//")) return "must not contain an empty segment ('//')";
88  for (const segment of value.split("/")) {
89    if (segment === "." || segment === "..") return "must not contain a '.' or '..' path segment";
90  }
91  return null;
92}
93
94export const docPath = z.string().superRefine((value, ctx) => {
95  const problem = pathProblem(value);
96  if (problem) ctx.addIssue({ code: "custom", message: problem });
97});
98
99// Every free-text input goes through this, so a bare z.string() in a tool schema
100// is a visible anomaly. test/limits.test.ts fails if one appears.
101export const bounded = (max: number) => z.string().max(max);
102
103export const nsName = bounded(MAX_NAMESPACE);
104
105// A job's result_ref is where the work landed: a document key inside the store, or
106// a pull request URL outside it. The URL is rendered as a link a human may click, so
107// the scheme is pinned to https and embedded credentials are refused.
108export function resultRefProblem(value: string): string | null {
109  if (value.length === 0) return "result ref must not be empty";
110  if (value.length > MAX_PATH) return `result ref is longer than ${MAX_PATH} characters`;
111  if (hasControlChar(value)) return "result ref must not contain control characters (including newlines and tabs)";
112  if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(value)) return pathProblem(value);
113
114  if (!value.startsWith("https://")) return "a result ref URL must use https";
115  let url: URL;
116  try {
117    url = new URL(value);
118  } catch {
119    return "result ref is not a valid URL";
120  }
121  if (url.username || url.password) return "a result ref URL must not carry credentials";
122  if (!url.hostname) return "a result ref URL must name a host";
123  return null;
124}
125
126export const resultRef = bounded(MAX_PATH).superRefine((value, ctx) => {
127  const problem = resultRefProblem(value);
128  if (problem) ctx.addIssue({ code: "custom", message: problem });
129});