2 Commits

Author	SHA1	Message	Date
Jason Woltje	3880993b60	fix(SEC-ORCH-28+29): Add Valkey connection timeout + workItems MaxLength ... SEC-ORCH-28: Add connectTimeout (5000ms default) and commandTimeout (3000ms default) to Valkey/Redis client to prevent indefinite connection hangs. Both are configurable via VALKEY_CONNECT_TIMEOUT_MS and VALKEY_COMMAND_TIMEOUT_MS environment variables. SEC-ORCH-29: Add @ArrayMaxSize(50) and @MaxLength(2000) to workItems in AgentContextDto to prevent memory exhaustion from unbounded input. Also adds @ArrayMaxSize(20) and @MaxLength(200) to skills array. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-06 15:19:44 -06:00
Jason Woltje	433212e00f	test(CQ-ORCH-9): Add SpawnAgentDto validation tests ... Adds 23 dedicated DTO-level validation tests for SpawnAgentDto and AgentContextDto using plainToInstance + validate() from class-validator. Covers: valid payloads, missing/empty taskId, invalid agentType, empty repository/branch, empty workItems, shell injection in branch names, SSRF in repository URLs, file:// protocol blocking, option injection, and invalid gateProfile values. Replaces the 5 controller-level validation tests removed in CQ-ORCH-9 with proper DTO-level equivalents. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-06 14:31:37 -06:00