 Jason WoltjeandClaude Opus 4.5
|
2cb3fe8f5a
|
fix(#329): Harden BudgetService against security review findings
- Fix CRITICAL: Unbounded memory growth via daily record purging
- Fix CRITICAL: Negative/NaN/Infinity token bypass via input clamping
- Fix HIGH: TOCTOU race via atomic trySpawnAgent() method
- Fix HIGH: Phantom agent leak via Set<string> ID tracking (not counter)
- Fix HIGH: isAgentOverBudget now scoped to today only
- Fix HIGH: Config validation clamps invalid values to safe defaults
- Fix MEDIUM: Wire BudgetModule into AppModule
- Fix MEDIUM: Sanitize agentId in log output to prevent log injection
- Fix MEDIUM: Use Date objects for timezone-safe comparisons
- Fix MEDIUM: Reject empty agentId/taskId in recordUsage
- Add tests for negative tokens, NaN, Infinity, empty IDs, config edge cases
Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
2026-02-05 13:15:33 -06:00 |
|
|
Jason WoltjeandClaude Opus 4.5
|
22dc964503
|
feat(#329): Add usage budget management and cost governance
Implement BudgetService for tracking and enforcing agent usage limits:
- Daily token limit tracking (default 10M tokens)
- Per-agent token limit enforcement (default 2M tokens)
- Maximum concurrent agent cap (default 10)
- Task duration limits (default 120 minutes)
- Hard/soft limit enforcement modes
- Real-time usage summaries with budget status
(within_budget/approaching_limit/at_limit/exceeded)
- Per-agent usage breakdown with percentage calculations
Includes BudgetModule for NestJS DI and 23 unit tests.
Fixes #329
Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
2026-02-05 13:00:26 -06:00 |
|