fix(task-board): cap a column automation's prompt length - #6701
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TASK_BOARD_AUTOMATION_UPSERT(landed same-day in #6690,apps/api/src/tools/task-board/automations.ts) tookpromptas an unboundedz.string().nullable().optional(), writable directly by any org member's tool call into an unboundedtextcolumn — the same gap this codebase has repeatedly capped on sibling fields (taskdescription/title, commentbody, repo string), per the resource-bound hardening lane in the project history.Why it matters: an org member (or a buggy caller) can write an arbitrarily large prompt into
task_board_column_automations, which then gets fed into the Super Agent's instruction on every card landing in that column — unbounded row growth and an unbounded string re-sent on every automated run.Fix: added
MAX_AUTOMATION_PROMPT_LENGTH = 50_000next to the existingMAX_TASK_DESCRIPTION_LENGTH/MAX_TASK_TITLE_LENGTH/MAX_TASK_REPO_LENGTHcaps inschema.ts(same 50k bound as description/comment body), and applied it to thepromptfield inTASK_BOARD_AUTOMATION_UPSERT's input schema.Regression test:
apps/api/src/tools/task-board/automations.test.ts, mirroring the existingdescription-length.test.tspattern — asserts the schema rejects a prompt one character over the cap, accepts one at the cap, and still acceptsnull(the default-instruction sentinel).To verify:
bun test apps/api/src/tools/task-board/automations.test.ts.Checked locally:
bun run fmt,cd apps/api && bunx tsc --noEmit, the targeted test above, andbunx oxlinton the three touched files — all clean. Full CI validates the rest.Summary by cubic
Caps the
promptfield inTASK_BOARD_AUTOMATION_UPSERTat 50,000 characters, matching the existing cap on task descriptions, so an org member's tool call can no longer store an arbitrarily large instruction that gets re-sent on every card landing.nulldefault-instruction sentinel.Written for commit 080132c. Summary will update on new commits.