fix(preflight): bound duplicate detection inputs

[JSONbored]

Motivation

• The preflight duplicate-check tokenized unbounded title/body and re-tokenized collision items, enabling an authenticated caller to force heavy CPU/memory use and cause availability issues.
• The goal is to cap attacker-controlled inputs and avoid repeated expensive tokenization while preserving the term-overlap duplicate detection behavior.

Description

• Add centralized preflight size limits in src/signals/preflight-limits.ts and apply them to API and MCP schemas by updating src/api/routes.ts and src/mcp/server.ts to cap title, body, arrays, and array item lengths via PREFLIGHT_LIMITS and zod validators.
• Truncate/prebound preflight text and arrays before internal processing by introducing truncateText and boundedTextItems in src/signals/engine.ts, and use them when building planned and collision item term inputs so tokenization works on bounded data.
• Reuse the collision report term cache by storing the computed itemTerms map on the generated CollisionReport (collisionReportTermCache) and consult it during preflight cluster filtering instead of retokenizing cluster items.
• Add a regression unit test to test/unit/signals-coverage.test.ts that verifies linked-issue extraction only scans the bounded preflight body window.

Testing

• Ran type checking with npm run typecheck and it succeeded.
• Ran the targeted unit test file with npx vitest run test/unit/signals-coverage.test.ts and it passed.
• Ran the full unit test suite with npm run test:unit and all tests passed.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	414475e	Commit Preview URL Branch Preview URL	Jun 10 2026, 07:02 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#497 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.