fix(bug): passes cap limit set. passes text area bug fixed

Author: ivanvpetrov

src/config.ts

@@ -54,6 +54,10 @@ export const TEST_TIMEOUT_MS = Number(process.env.TEST_TIMEOUT_MS || 5 * 60 * 10
 // pre-loads — and by default auto-runs — a matrix without going through the UI.
 export const MATRIX_CONFIG = process.env.MATRIX_CONFIG || '';
 export const MATRIX_MAX_ENTRIES = Number(process.env.MATRIX_MAX_ENTRIES || 24);
+// Cap on the number of passes per matrix submission. Each pass pre-creates
+// combos × History records and queues a full sequential matrix run, so an
+// unbounded passes array is an easy DoS vector. Override with MATRIX_MAX_PASSES.
+export const MATRIX_MAX_PASSES = Number(process.env.MATRIX_MAX_PASSES || 10);
 export const AGENT_TIMEOUT_MS = Number(process.env.AGENT_TIMEOUT_MS || 25 * 60 * 1000);
 // How long to wait for the (headless) post-edit dev-server build before giving up
 // and screenshotting anyway. Generous because the first build of an agent-edited

src/matrix/request.ts

@@ -1,6 +1,6 @@
 'use strict';
 
-import { MATRIX_MAX_ENTRIES, PROMPT_IMAGES_DIR, PROMPT_IMAGE_MAX_COUNT } from '../config.ts';
+import { MATRIX_MAX_ENTRIES, MATRIX_MAX_PASSES, PROMPT_IMAGES_DIR, PROMPT_IMAGE_MAX_COUNT } from '../config.ts';
 import { getFramework } from '../provider-registry.ts';
 import { resolveSelection } from '../prompt-images.ts';
 import { parseVariants, variantLabel } from './variants.ts';
@@ -58,6 +58,10 @@ export function normalizeMatrixRequest(raw: any): MatrixRequestResult {
   }
   const prompt = passes[0].prompt;    // back-compat alias
   const name = passes[0].name ?? null; // back-compat alias
+  if (passes.length > MATRIX_MAX_PASSES) {
+    return { ok: false, error: `passes capped at ${MATRIX_MAX_PASSES}; reduce the number of passes` };
+  }
+
   if (!platforms.length || !variants.length) {
     return { ok: false, error: 'select at least one platform and one variant' };
   }

web/matrix.ts

@@ -503,7 +503,7 @@ async function onSubmit(e: Event) {
 
 const extraPassSection = () => html`
   ${st.extraPasses.length ? html`<div class="mx-passes-stack">
-    ${st.extraPasses.map((pass, i) => {
+    ${repeat(st.extraPasses, (p) => p.key, (pass, i) => {
       const num = i + 2;
       return html`
         <div class="mx-extra-pass">