Bound oversized diagnostics across CLI and MCP

changelog.d/unreleased/3090.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3090
+affected:
+  - src/CodeIndex/Mcp/RateLimiter.cs
+  - tests/CodeIndex.Tests/RateLimiterTests.cs
+---
+
+## English
+
+- **MCP rate-limiter environment warnings now truncate oversized values (#3090)** — invalid or clamped `CDIDX_MCP_RATE_LIMIT_*` diagnostics bound the echoed environment value before writing warnings.
+
+## 日本語
+
+- **MCP rate limiter の環境変数 warning は過大な値を切り詰めるようになりました (#3090)** — invalid / clamp される `CDIDX_MCP_RATE_LIMIT_*` 診断は、warning に出す環境変数値を上限付き表示にします。

changelog.d/unreleased/3091.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3091
+affected:
+  - src/CodeIndex/Mcp/McpServer.cs
+  - tests/CodeIndex.Tests/McpServerTests.cs
+---
+
+## English
+
+- **MCP keep-alive interval warnings now truncate oversized environment values (#3091)** — invalid `CDIDX_MCP_KEEP_ALIVE_INTERVAL_S` diagnostics bound the echoed raw value before writing stderr.
+
+## 日本語
+
+- **MCP keep-alive interval warning は過大な環境変数値を切り詰めるようになりました (#3091)** — invalid な `CDIDX_MCP_KEEP_ALIVE_INTERVAL_S` 診断は、stderr に出す raw 値を上限付き表示にします。

changelog.d/unreleased/3092.fixed.md

@@ -0,0 +1,25 @@
+---
+category: fixed
+issues:
+  - 3092
+affected:
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Parse.cs
+  - src/CodeIndex/Cli/QueryCommandRunner.cs
+  - src/CodeIndex/Cli/HookCommandRunner.cs
+  - tests/CodeIndex.Tests/ConsoleUiTests.cs
+  - tests/CodeIndex.Tests/IndexCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerGraphTests.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerMapTests.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/HookCommandRunnerTests.cs
+---
+
+## English
+
+- **CLI option diagnostics now bound user-supplied values (#3092)** — index, query, and hooks warnings/errors now use the shared bounded display formatter before echoing option tokens or values, truncating oversized input and flattening control characters.
+
+## 日本語
+
+- **CLI option 診断はユーザー指定値を上限付き表示にするようになりました (#3092)** — index / query / hooks の warning / error は option token や値を表示する前に共有の bounded display formatter を通し、過大入力を切り詰めて制御文字を空白化します。

changelog.d/unreleased/3093.security.md

@@ -0,0 +1,16 @@
+---
+category: security
+issues:
+  - 3093
+affected:
+  - src/CodeIndex/Cli/QueryCommandRunner.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerTests.cs
+---
+
+## English
+
+- **Database path diagnostics now truncate oversized `--db` values (#3093)** — query and batch database errors keep the URI/path kind visible while bounding echoed database paths before writing stderr.
+
+## 日本語
+
+- **database path 診断は過大な `--db` 値を切り詰めるようになりました (#3093)** — query / batch の database error は URI/path の種別を残しつつ、stderr に出す database path を上限付き表示にしました。

changelog.d/unreleased/3094.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3094
+affected:
+  - src/CodeIndex/Database/DbWriter.cs
+  - tests/CodeIndex.Tests/DatabaseTests.cs
+---
+
+## English
+
+- **Batch-row skip warnings now truncate oversized row details (#3094)** — `DbWriter` bounds row identifiers and batch/row exception messages before emitting skipped-row diagnostics.
+
+## 日本語
+
+- **batch-row skip warning は過大な row 詳細を切り詰めるようになりました (#3094)** — `DbWriter` は skipped-row 診断を出す前に row identifier と batch / row exception message を上限付き表示にします。

changelog.d/unreleased/3095.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3095
+affected:
+  - src/CodeIndex/Cli/MacProfileDetector.cs
+  - tests/CodeIndex.Tests/MacProfileDetectorTests.cs
+---
+
+## English
+
+- **MAC profile detection now bounds proc-attr reads and hint output (#3095)** — `/proc/self/attr/*` reads are capped, and oversized AppArmor/SELinux profile strings are truncated before appearing in database-access hints.
+
+## 日本語
+
+- **MAC profile 検出は proc-attr 読み取りと hint 出力を上限付きにしました (#3095)** — `/proc/self/attr/*` の読み取りを制限し、過大な AppArmor / SELinux profile 文字列は database-access hint に出す前に切り詰めます。

changelog.d/unreleased/3135.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3135
+affected:
+  - src/CodeIndex/Cli/IndexCommandRunner.Parse.cs
+  - tests/CodeIndex.Tests/IndexCommandRunnerTests.cs
+---
+
+## English
+
+- **Invalid `CDIDX_NOTIFY` values now warn before falling back (#3135)** — index argument parsing reports bounded stderr warnings for unsupported notification modes instead of silently ignoring the environment value.
+
+## 日本語
+
+- **無効な `CDIDX_NOTIFY` 値は fallback 前に warning を出すようになりました (#3135)** — index の引数解析は未対応の notification mode を黙って無視せず、上限付きの stderr warning として報告します。

changelog.d/unreleased/3181.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3181
+affected:
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - tests/CodeIndex.Tests/ConsoleUiTests.cs
+---
+
+## English
+
+- **Did-you-mean suggestions now reject oversized inputs before distance matching (#3181)** — command, flag, language, and kind suggestions skip values beyond the diagnostic display limit so typo matching does not allocate large edit-distance matrices for malformed input.
+
+## 日本語
+
+- **Did-you-mean 候補は距離計算前に過大入力を拒否するようになりました (#3181)** — command / flag / language / kind の候補提示は診断表示上限を超える値をスキップし、不正な入力で巨大な編集距離行列を割り当てないようになりました。

src/CodeIndex/Cli/ConsoleUi.cs

@@ -128,6 +128,7 @@ public static string FormatSummaryLine(string label, object? value, int labelWid
         => $"{indent}{label.PadRight(labelWidth)}: {value}";
 
     internal const int DefaultDiagnosticValueCharLimit = 120;
+    internal const int MaxSuggestionInputCharLength = DefaultDiagnosticValueCharLimit;
 
     internal readonly record struct BoundedDisplayText(string Text, bool Truncated, int OriginalLength);
 
@@ -139,19 +140,40 @@ internal static BoundedDisplayText BoundDisplayText(string? value, int maxChars
         if (value == null)
             return new BoundedDisplayText("<null>", Truncated: false, OriginalLength: 0);
 
-        if (value.Length <= maxChars)
-            return new BoundedDisplayText(value, Truncated: false, value.Length);
+        var displayValue = FlattenDiagnosticControlChars(value);
+        if (displayValue.Length <= maxChars)
+            return new BoundedDisplayText(displayValue, Truncated: false, value.Length);
 
         var marker = string.Create(CultureInfo.InvariantCulture, $"... <truncated; original length {value.Length} chars>");
         var text = maxChars == 0
             ? marker.TrimStart('.', ' ')
-            : value[..maxChars] + marker;
+            : displayValue[..maxChars] + marker;
         return new BoundedDisplayText(text, Truncated: true, value.Length);
     }
 
     internal static string FormatBoundedValue(string? value, int maxChars = DefaultDiagnosticValueCharLimit)
         => BoundDisplayText(value, maxChars).Text;
 
+    private static string FlattenDiagnosticControlChars(string value)
+    {
+        for (var i = 0; i < value.Length; i++)
+        {
+            if (char.IsControl(value[i]))
+            {
+                var chars = value.ToCharArray();
+                for (var j = i; j < chars.Length; j++)
+                {
+                    if (char.IsControl(chars[j]))
+                        chars[j] = ' ';
+                }
+
+                return new string(chars);
+            }
+        }
+
+        return value;
+    }
+
     private const int SpinnerFrameDelayMs = 100;
     private const int SpinnerStopDelayMs = 20;
     private const int ConsoleLineMargin = 1;
@@ -1231,16 +1253,18 @@ private static IReadOnlyList<string> GetCommandUsageNotes(string command)
     /// </summary>
     public static string? FindClosestMatch(string? input, IEnumerable<string> candidates)
     {
-        if (string.IsNullOrWhiteSpace(input))
+        var normalized = NormalizeSuggestionInput(input);
+        if (normalized == null)
             return null;
 
-        var normalized = input.ToLowerInvariant();
         string? best = null;
         var bestDist = int.MaxValue;
         foreach (var candidate in candidates)
         {
             if (string.IsNullOrEmpty(candidate))
                 continue;
+            if (candidate.Length > MaxSuggestionInputCharLength)
+                continue;
             var candidateNormalized = candidate.ToLowerInvariant();
             if (string.Equals(normalized, candidateNormalized, StringComparison.Ordinal))
                 return candidate;
@@ -1265,15 +1289,17 @@ private static IReadOnlyList<string> GetCommandUsageNotes(string command)
     /// </summary>
     public static IReadOnlyList<string> FindClosestMatches(string? input, IEnumerable<string> candidates, int maxResults = 3)
     {
-        if (string.IsNullOrWhiteSpace(input) || maxResults <= 0)
+        var normalized = NormalizeSuggestionInput(input);
+        if (normalized == null || maxResults <= 0)
             return Array.Empty<string>();
 
-        var normalized = input.ToLowerInvariant();
         var matches = new List<(string Candidate, int Distance)>();
         foreach (var candidate in candidates)
         {
             if (string.IsNullOrEmpty(candidate))
                 continue;
+            if (candidate.Length > MaxSuggestionInputCharLength)
+                continue;
             var candidateNormalized = candidate.ToLowerInvariant();
             if (string.Equals(normalized, candidateNormalized, StringComparison.Ordinal))
                 continue;
@@ -1290,6 +1316,14 @@ public static IReadOnlyList<string> FindClosestMatches(string? input, IEnumerabl
             .ToList();
     }
 
+    private static string? NormalizeSuggestionInput(string? input)
+    {
+        if (input == null || input.Length > MaxSuggestionInputCharLength || string.IsNullOrWhiteSpace(input))
+            return null;
+
+        return input.ToLowerInvariant();
+    }
+
     private static int GetSuggestionDistanceThreshold(int inputLength, int commandLength)
     {
         var shorter = Math.Min(inputLength, commandLength);

src/CodeIndex/Cli/HookCommandRunner.cs

@@ -65,7 +65,10 @@ internal static HookCommandOptions ParseArgs(string[] args)
                     break;
                 default:
                     if (args[i].StartsWith("-", StringComparison.Ordinal))
-                        Console.Error.WriteLine($"Warning: unknown option '{args[i]}' (ignored) / 不明なオプション '{args[i]}'（無視されます）");
+                    {
+                        var displayValue = ConsoleUi.FormatBoundedValue(args[i]);
+                        Console.Error.WriteLine($"Warning: unknown option '{displayValue}' (ignored) / 不明なオプション '{displayValue}'（無視されます）");
+                    }
                     else if (command == null)
                         command = args[i];
                     else
@@ -137,7 +140,7 @@ private static int UnknownCommand(HookCommandOptions options, JsonSerializerOpti
     {
         if (!options.Json)
             PrintUsage();
-        return WriteResult(options.Json, jsonOptions, "error", $"unknown hooks command: {options.Command}", projectPath, null, null, CommandExitCodes.UsageError);
+        return WriteResult(options.Json, jsonOptions, "error", $"unknown hooks command: {ConsoleUi.FormatBoundedValue(options.Command)}", projectPath, null, null, CommandExitCodes.UsageError);
     }
 
     private static bool IsManagedHook(string content)