From aae81c7dbf7f7f8ba35f007ce6de7095aff43782 Mon Sep 17 00:00:00 2001
From: ghost <49853598+JSONbored@users.noreply.github.com>
Date: Fri, 26 Jun 2026 01:39:03 -0700
Subject: [PATCH] fix(mcp): bound predict gate changed paths

---
 src/mcp/server.ts                  |  2 +-
 test/unit/mcp-predict-gate.test.ts | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/mcp/server.ts b/src/mcp/server.ts
index 8768332b6a..773a5b69e4 100644
--- a/src/mcp/server.ts
+++ b/src/mcp/server.ts
@@ -677,7 +677,7 @@ const predictGateShape = {
   linkedIssues: z.array(z.number().int().positive()).optional(),
   // The PR's changed file PATHS (metadata only — paths, never source content). Supplying them lets the predictor
   // also evaluate the focus-manifest path policy + path-gated pre-merge checks, matching the live gate (#11-13/#18).
-  changedPaths: z.array(z.string().min(1)).max(500).optional(),
+  changedPaths: z.array(z.string().min(1).max(PREFLIGHT_LIMITS.changedFileChars)).max(500).optional(),
 };
 
 // Pure local-metadata computation (no repo data, no secrets) — the agent supplies its own diff metadata
diff --git a/test/unit/mcp-predict-gate.test.ts b/test/unit/mcp-predict-gate.test.ts
index de86a09c68..cefbfd50f4 100644
--- a/test/unit/mcp-predict-gate.test.ts
+++ b/test/unit/mcp-predict-gate.test.ts
@@ -47,6 +47,19 @@ describe("MCP gittensory_predict_gate", () => {
     expect((minimal.structuredContent as { pack: string }).pack).toBe("oss-anti-slop");
   });
 
+  it("rejects changedPaths entries above the path metadata size cap", async () => {
+    const env = createTestEnv();
+    const client = await connect(env);
+
+    const result = await client.callTool({
+      name: "gittensory_predict_gate",
+      arguments: { login: "miner1", owner: "acme", repo: "widgets", title: "Huge path", changedPaths: [`src/${"a".repeat(301)}.ts`] },
+    });
+
+    expect(result.isError).toBe(true);
+    expect(JSON.stringify(result.content)).toContain("Too big");
+  });
+
   it("predicts the focus-manifest path policy when changedPaths are supplied (#11-13/#18)", async () => {
     const env = createTestEnv();
     await upsertRepositoryFromGitHub(env, { name: "widgets", full_name: "acme/widgets" });