Skip to content

fix(task-board): cap a column automation's prompt length - #6701

Merged
pedrofrxncx merged 1 commit into
mainfrom
fix/cap-column-automation-prompt-length
Aug 28, 2026
Merged

fix(task-board): cap a column automation's prompt length#6701
pedrofrxncx merged 1 commit into
mainfrom
fix/cap-column-automation-prompt-length

Conversation

@pedrofrxncx

@pedrofrxncx pedrofrxncx commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

TASK_BOARD_AUTOMATION_UPSERT (landed same-day in #6690, apps/api/src/tools/task-board/automations.ts) took prompt as an unbounded z.string().nullable().optional(), writable directly by any org member's tool call into an unbounded text column — the same gap this codebase has repeatedly capped on sibling fields (task description/title, comment body, repo string), per the resource-bound hardening lane in the project history.

Why it matters: an org member (or a buggy caller) can write an arbitrarily large prompt into task_board_column_automations, which then gets fed into the Super Agent's instruction on every card landing in that column — unbounded row growth and an unbounded string re-sent on every automated run.

Fix: added MAX_AUTOMATION_PROMPT_LENGTH = 50_000 next to the existing MAX_TASK_DESCRIPTION_LENGTH/MAX_TASK_TITLE_LENGTH/MAX_TASK_REPO_LENGTH caps in schema.ts (same 50k bound as description/comment body), and applied it to the prompt field in TASK_BOARD_AUTOMATION_UPSERT's input schema.

Regression test: apps/api/src/tools/task-board/automations.test.ts, mirroring the existing description-length.test.ts pattern — asserts the schema rejects a prompt one character over the cap, accepts one at the cap, and still accepts null (the default-instruction sentinel).

To verify: bun test apps/api/src/tools/task-board/automations.test.ts.

Checked locally: bun run fmt, cd apps/api && bunx tsc --noEmit, the targeted test above, and bunx oxlint on the three touched files — all clean. Full CI validates the rest.


Summary by cubic

Caps the prompt field in TASK_BOARD_AUTOMATION_UPSERT at 50,000 characters, matching the existing cap on task descriptions, so an org member's tool call can no longer store an arbitrarily large instruction that gets re-sent on every card landing.

  • Adds a regression test covering the cap and the null default-instruction sentinel.
  • No migration needed; existing prompts are unaffected.

Written for commit 080132c. Summary will update on new commits.

Review in cubic

@pedrofrxncx
pedrofrxncx merged commit 46ccb3b into main Aug 28, 2026
33 checks passed
@pedrofrxncx
pedrofrxncx deleted the fix/cap-column-automation-prompt-length branch August 28, 2026 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant