gabriel / musehub public
feat patch security task/stream-security-phase3 #1 / 1
AI Agent gabriel · 128 days ago · May 11, 2026 · Diff

feat(security): cumulative decompressed size gate in stream path — Phase 3 of issue #51

Adds _cumulative_decompressed accumulator inside wire_push_stream. After each O/OC object is decoded, the running total is compared against settings.bundle_max_decompressed_bytes; if exceeded, yields ERROR (413) and returns — no write, no branch advance. Mirrors the bundle path gate.

Both O-frame paths (inline and OC-reassembled) are guarded. The cap is read from settings, not hardcoded — monkeypatched to small values in tests.

4 TDD tests green (test_stream_security_phase3.py); 74 regression tests pass.

sha256:16141f5093d996133d5bb396e94cccc25de9dc1651fcb4384650b67d9d7c85ae sha
sha256:f5873efcc9d23e7b1d00f7ddce5ab0b559959aaa1ccb05b5b7ec3bf86cdb37dd parent
+33 ~1 symbols
sha256:8fb53fa7719d1e62b5ea6ca6398a6de0bc98bbcbeeb5560b4d1defbd29471e82 snapshot
+33
symbols added
~1
symbol modified
0
dead code introduced
Semantic Changes 34 symbols
~ tests/test_stream_security_phase3.py .py 33 symbols added
+ _collect function async_function _collect L87–91
+ _commit_pack function function _commit_pack L65–68
+ _end function function _end L71–72
+ _fw variable variable _fw L37–37
+ _header function function _header L50–55
+ _make_commit function function _make_commit L75–84
+ _make_repo function async_function _make_repo L96–118
+ _obj function function _obj L58–62
+ _pack function function _pack L42–43
+ _set_decompressed_cap function function _set_decompressed_cap L142–145
+ _stub_backend function function _stub_backend L121–139
+ _wrap function function _wrap L46–47
+ AsyncMock import import AsyncMock L22–22
+ AsyncSession import import AsyncSession L21–21
+ MuseWireFrameWriter import import MuseWireFrameWriter L35–35
+ MusehubBranch import import MusehubBranch L26–26
+ MusehubRepo import import MusehubRepo L26–26
+ SFRAME_COMMIT_PACK import import SFRAME_COMMIT_PACK L27–27
+ SFRAME_END import import SFRAME_END L27–27
+ SFRAME_ERROR import import SFRAME_ERROR L27–27
+ SFRAME_HEADER import import SFRAME_HEADER L27–27
+ SFRAME_OBJECT import import SFRAME_OBJECT L27–27
+ SFRAME_RESULT import import SFRAME_RESULT L27–27
+ annotations import import annotations L17–17
+ blob_id import import blob_id L24–24
+ db import import db L25–25
+ msgpack import import msgpack L19–19
+ now_utc_iso import import now_utc_iso L24–24
+ pytest import import pytest L20–20
+ test_cap_is_read_from_settings function async_function test_cap_is_read_from_settings L264–315
+ test_cumulative_total_exceeds_cap_yields_error function async_function test_cumulative_total_exceeds_cap_yields_error L189–223
+ test_single_object_exceeds_cumulative_cap_yields_error function async_function test_single_object_exceeds_cumulative_cap_yields_error L153–185
+ test_stream_under_cap_completes_successfully function async_function test_stream_under_cap_completes_successfully L227–260
~ musehub/services/musehub_wire.py .py 1 symbol modified
~ wire_push_stream
← Older Oldest on task/stream-security-phase3
All commits
Newer → Latest on task/stream-security-phase3

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:16141f5093d996133d5bb396e94cccc25de9dc1651fcb4384650b67d9d7c85ae --body "your comment"