Context
packages/loopover-engine/src/discovery-index-contract.ts:16-18 defines MAX_QUERY_ITEMS/MAX_PAGE_LIMIT = 200, both enforced on the request side (normalizeStringList, clampLimit). But normalizeDiscoveryIndexResponse:220-238, which parses the response from the "OPTIONAL hosted discovery-index service" this file's own header frames as an external, only-partially-trusted boundary ("no raw scores / rewards / wallet / hotkey data / source contents crossing the public boundary"), loops over rawCandidates with no length cap — a misbehaving or compromised discovery-index host can return an arbitrarily large candidates array and every entry gets processed.
Requirements
- Cap the number of candidates
normalizeDiscoveryIndexResponse will accept (reuse MAX_PAGE_LIMIT or add a dedicated MAX_RESPONSE_CANDIDATES), pushing a warning and dropping entries beyond the cap rather than processing an unbounded list.
Deliverables
Test Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
A misbehaving or compromised discovery-index host can no longer force unbounded processing on the client side.
Links & Resources
packages/loopover-engine/src/discovery-index-contract.ts:6-8,16-18,107-120,140-150,220-238.
Context
packages/loopover-engine/src/discovery-index-contract.ts:16-18definesMAX_QUERY_ITEMS/MAX_PAGE_LIMIT = 200, both enforced on the request side (normalizeStringList,clampLimit). ButnormalizeDiscoveryIndexResponse:220-238, which parses the response from the "OPTIONAL hosted discovery-index service" this file's own header frames as an external, only-partially-trusted boundary ("no raw scores / rewards / wallet / hotkey data / source contents crossing the public boundary"), loops overrawCandidateswith no length cap — a misbehaving or compromised discovery-index host can return an arbitrarily largecandidatesarray and every entry gets processed.Requirements
normalizeDiscoveryIndexResponsewill accept (reuseMAX_PAGE_LIMITor add a dedicatedMAX_RESPONSE_CANDIDATES), pushing a warning and dropping entries beyond the cap rather than processing an unbounded list.Deliverables
nextCursorstill round-trips correctly for a truncated pageTest Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
A misbehaving or compromised discovery-index host can no longer force unbounded processing on the client side.
Links & Resources
packages/loopover-engine/src/discovery-index-contract.ts:6-8,16-18,107-120,140-150,220-238.