fix(security): bound focus manifest ingestion

[JSONbored]

Motivation

• The public repo focus manifest path previously fetched and JSON.parsed untrusted remote files via response.text() with no byte-size limit, allowing a repo owner or attacker to supply a very large file and cause memory/CPU exhaustion or fail background jobs.
• Bulk loading runs all fetches in parallel, amplifying the availability impact when a single oversized manifest is served.

Description

• Add a shared maximum manifest byte cap MAX_FOCUS_MANIFEST_BYTES = 64 * 1024 and reject content exceeding the cap before parsing in parseFocusManifestContent.
• Replace unbounded response.text() in fetchRepoFocusManifestFile with a readBoundedResponseText helper that checks Content-Length and performs a bounded streaming read that cancels and returns null if the response grows beyond the cap.
• Limit bulk manifest loads by introducing REPO_FOCUS_MANIFEST_MAX_CONCURRENT_LOADS = 4 and a mapWithConcurrencyLimit helper used by loadRepoFocusManifests to avoid unbounded parallel fetch/parse amplification.
• Add unit test coverage for the new behaviors: concurrency cap, oversized Content-Length, oversized stream cancellation, and pre-parse oversized-content rejection; update tests to import the new constants/helpers.

Testing

• Ran npm run typecheck (tsc --noEmit) and fixed a minor type issue; typecheck succeeded.
• Ran unit tests for the loader: npm test -- --run test/unit/focus-manifest-loader.test.ts and npm test -- --run test/unit/focus-manifest.test.ts test/unit/focus-manifest-loader.test.ts and both passed.
• Ran full test suite npm test and all tests passed (95 files, 1391 tests passed, 1 skipped).

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#494 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	519e8c1	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:46 AM