rea/src
Dery Ferdika bfbfc7330a
fix(domain): reject excessive JSON depth with actionable diagnostics (#1029)
* fix(domain): bound JSON depth and oversized payloads at parsing boundaries

jsonValueSchema re-walked hostile input through z.json()'s recursive core, so a deeply nested payload from an MCP tool argument, inline evidence, provider result, or keyed archive threw RangeError: Maximum call stack size exceeded instead of a validation issue. The schema now runs an iterative depth guard first and keeps z.json() for full JSON semantics behind it, which also turns cyclic values into validation errors. The 1000-edge limit stays far below the range where the recursive core overflows its stack (measured between 2000 and 3000 on Node 24) while leaving room for legitimately deep target-derived trees such as compiled NIB view hierarchies, and the guard narrows with a typed record check instead of any or unchecked casts. The non-recursive JSON Schema advertisement stays intact on both the public and standard projection paths. Two payload sizes get explicit budgets tied to their producer constraints: web text artifacts reject beyond the 16 MiB source budget the web tooling already advertises, and native UI screenshot base64 beyond the 64 MiB helper output budget. Regenerated product catalog, skill catalog digest, and completion-ledger manifest follow the schema-boundary change.

* fix(validation): preserve depth diagnostics across process inputs

---------

Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 21:12:10 +08:00
..
android fix(process): preserve partial evidence and verify detached cleanup (#1011) 2026-10-08 04:46:46 +08:00
application fix(domain): reject excessive JSON depth with actionable diagnostics (#1029) 2026-10-08 21:12:10 +08:00
artifacts chore: merge main into feat/dylib-resolution 2026-10-08 04:45:50 +00:00
browser feat(browser): inspect historical web network captures (#992) 2026-10-08 07:53:41 +08:00
cli feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
composition feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
config fix(linux): improve Hopper reliability and CachyOS support (#963) 2026-10-07 23:16:48 +08:00
contracts fix(mcp): flatten root union input schemas (#1062) 2026-10-08 20:54:51 +08:00
domain fix(domain): reject excessive JSON depth with actionable diagnostics (#1029) 2026-10-08 21:12:10 +08:00
dotnet test(providers): verify framing through client socket boundaries 2026-10-08 04:03:23 +08:00
evaluation fix(evaluation): canonicalize Unicode argument keys (#980) 2026-10-07 23:19:49 +08:00
evm feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
firmware fix(process): preserve partial evidence and verify detached cleanup (#1011) 2026-10-08 04:46:46 +08:00
ghidra feat(ghidra): support native x86 PE applications on Windows (#1030) 2026-10-08 05:11:47 +08:00
hopper fix(process): preserve partial evidence and verify detached cleanup (#1011) 2026-10-08 04:46:46 +08:00
ida test(providers): verify framing through client socket boundaries 2026-10-08 04:03:23 +08:00
inspector test(providers): verify framing through client socket boundaries 2026-10-08 04:03:23 +08:00
javascript fix(process): preserve partial evidence and verify detached cleanup (#1011) 2026-10-08 04:46:46 +08:00
main fix(android)!: preserve JVM settings and reuse metadata sessions (#908) 2026-10-07 16:50:41 +08:00
native feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
process feat(browser): inspect historical web network captures (#992) 2026-10-08 07:53:41 +08:00
reference fix(reference): retain partial imports for unreadable directories (#766) 2026-10-07 02:36:21 +08:00
server perf(mcp): advertise each tool JSON Schema once per target (#1059) 2026-10-08 17:31:08 +08:00
windows fix(windows): accept ordinary drive path separators (#791) 2026-10-07 03:51:59 +08:00
catalogIdentity.ts perf(cli): defer unused catalog work during command startup (#920) 2026-10-07 18:16:10 +08:00
cli.ts feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
cliBrowserContext.ts fix(mcp): isolate optional observation adapter failures (#838) 2026-10-07 11:45:17 +08:00
cliBrowserScenarioCommands.ts fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs (#1004) 2026-10-08 00:52:37 +08:00
cliCommandNames.ts feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
cliEnvironmentSeam.test.ts test(cli): reduce repeated startup and filesystem setup 2026-10-08 04:03:24 +08:00
cliEvidenceCommands.ts refactor(domain): split error taxonomy into thematic modules (#636) 2026-10-06 05:57:38 +08:00
cliHostInputs.test.ts test(cli): reduce repeated startup and filesystem setup 2026-10-08 04:03:24 +08:00
cliJavaScriptRuntimeCommands.ts refactor(javascript): group domain semantics and contracts (#907) 2026-10-07 17:16:58 +08:00
cliJsonInput.ts fix(cli): preserve blank JSON paths for input validation (#1068) 2026-10-08 20:57:54 +08:00
cliJsonInputStatus.test.ts fix(cli): fail when JSON input files cannot be parsed 2026-10-06 03:02:22 -07:00
cliJsonPaths.test.ts fix(cli): preserve blank JSON paths for input validation (#1068) 2026-10-08 20:57:54 +08:00
cliLogging.test.ts refactor(process): separate capture implementation from analyst workflows (#988) 2026-10-08 00:46:21 +08:00
cliLogging.ts refactor(domain): split error taxonomy into thematic modules (#636) 2026-10-06 05:57:38 +08:00
cliObservationOptions.ts fix(tools)!: simplify direct invocation and harden boundary contracts (#555) 2026-10-05 20:16:44 +08:00
cliOutput.ts fix(cli): stream large JavaScript JSON results (#1024) 2026-10-08 03:44:51 +08:00
cliReferenceSourceImportStatus.test.ts fix(cli): preserve unsupported historical-source imports (#795) 2026-10-07 04:02:10 +08:00
config.test.ts fix(linux): improve Hopper reliability and CachyOS support (#963) 2026-10-07 23:16:48 +08:00
config.ts refactor(app): split session and CLI workflows 2026-07-18 05:49:14 +00:00
doctorRuntime.ts feat(ida): add read-only GUI and headless MCP providers (#754) 2026-10-07 01:47:05 +08:00
generatedPackageMetadata.ts chore(release/6.0.0): release rea-agents 6.0.0 (#1058) 2026-10-08 17:40:01 +08:00
identity.ts feat: streamline agent integration and MCP routing 2026-07-20 17:11:06 +08:00
logger.ts fix(tools)!: simplify direct invocation and harden boundary contracts (#555) 2026-10-05 20:16:44 +08:00
main.ts refactor(binary): move production composition outside application workflows (#965) 2026-10-07 21:56:58 +08:00
mcpDoctor.ts refactor(tools): remove remaining arbitrary workflow caps 2026-09-29 17:00:06 +08:00
mcpStartupPolicy.ts perf(mcp): reduce cold-start work 2026-07-26 15:02:58 +00:00
serverIdentity.ts refactor: return complete analysis results inline 2026-09-29 08:07:24 +08:00