Priority: P1
Problem
RuntimeInspector normalizes limits with Math.trunc and Math.max without requiring finite values. NaN and Infinity can disable retention trimming or predictable redaction truncation, turning malformed configuration into unbounded operational-data retention.
Evidence
packages/framework-context/src/libs/RuntimeInspector.ts:164-174 accepts the raw limits.
trimRequests and trimTimeline at lines 353-370 rely on those values.
sanitizeString at lines 436-440 assumes a bounded truncation length.
packages/transports-http/src/libs/devInspectorEndpoint.ts:49-63 exposes the options.
Desired outcome
Inspector limits are valid, finite bounds before collection begins.
Implementation path
- Validate positive safe-integer retention and redaction limits at the constructor or policy boundary.
- Raise a stable configuration Problem with the invalid field.
- Add NaN, Infinity, fraction, zero, and valid-boundary tests.
Acceptance criteria
- Invalid numeric values fail fast.
- Valid limits preserve existing collection behavior.
- Inspector retention cannot become unbounded through configuration.
Validation
pnpm --filter @croco/framework-context test
pnpm --filter @croco/transports-http test
Scope boundaries
Does not change inspector authorization or response schemas.
Priority: P1
Problem
RuntimeInspector normalizes limits with
Math.truncandMath.maxwithout requiring finite values. NaN and Infinity can disable retention trimming or predictable redaction truncation, turning malformed configuration into unbounded operational-data retention.Evidence
packages/framework-context/src/libs/RuntimeInspector.ts:164-174accepts the raw limits.trimRequestsandtrimTimelineat lines 353-370 rely on those values.sanitizeStringat lines 436-440 assumes a bounded truncation length.packages/transports-http/src/libs/devInspectorEndpoint.ts:49-63exposes the options.Desired outcome
Inspector limits are valid, finite bounds before collection begins.
Implementation path
Acceptance criteria
Validation
pnpm --filter @croco/framework-context testpnpm --filter @croco/transports-http testScope boundaries
Does not change inspector authorization or response schemas.