fix(jev): bound evaluation payloads before serialization

Author: waleedlatif1

apps/sim/lib/memory/bounded-json.test.ts …/sim/lib/core/utils/bounded-json.test.tsapps/sim/lib/memory/bounded-json.test.ts renamed to apps/sim/lib/core/utils/bounded-json.test.ts apps/sim/lib/memory/bounded-json.test.ts renamed to apps/sim/lib/core/utils/bounded-json.test.ts

@@ -1,8 +1,8 @@
 /** @vitest-environment node */
 import { describe, expect, it, vi } from 'vitest'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 
-describe('bounded memory JSON', () => {
+describe('bounded JSON', () => {
   it.each([
     { value: { text: 'hello', values: [1, false, null] } },
     { value: { text: 'é😀\ud800\udc00\ud800' } },
@@ -12,8 +12,8 @@ describe('bounded memory JSON', () => {
   ])('uses the caller byte limit including UTF-8 and escaped JSON bytes', ({ value }) => {
     const json = JSON.stringify(value)
     const bytes = Buffer.byteLength(json, 'utf8')
-    expect(stringifyBoundedMemoryJson(value, bytes)).toBe(json)
-    expect(stringifyBoundedMemoryJson(value, bytes - 1)).toBeUndefined()
+    expect(stringifyBoundedJson(value, bytes)).toBe(json)
+    expect(stringifyBoundedJson(value, bytes - 1)).toBeUndefined()
   })
 
   it('rejects cycles, excessive depth, and excessive nodes', () => {
@@ -27,7 +27,7 @@ describe('bounded memory JSON', () => {
       Array(100_001),
       Object.fromEntries(Array.from({ length: 100_001 }, (_, index) => [index, undefined])),
     ]) {
-      expect(stringifyBoundedMemoryJson(value, 8 * 1024 * 1024)).toBeUndefined()
+      expect(stringifyBoundedJson(value, 8 * 1024 * 1024)).toBeUndefined()
     }
   })
 
@@ -37,7 +37,7 @@ describe('bounded memory JSON', () => {
     const accessor = Object.defineProperty({}, 'secret', { enumerable: true, get: getter })
     const custom = Object.defineProperty({}, 'toJSON', { value: toJSON })
     for (const value of [accessor, custom, { output: new Uint8Array([1, 2, 3]) }]) {
-      expect(stringifyBoundedMemoryJson(value, 1024)).toBeUndefined()
+      expect(stringifyBoundedJson(value, 1024)).toBeUndefined()
     }
     expect(getter).not.toHaveBeenCalled()
     expect(toJSON).not.toHaveBeenCalled()
@@ -47,7 +47,7 @@ describe('bounded memory JSON', () => {
     const value = { output: 'x'.repeat(1025) }
     const serialize = vi.spyOn(JSON, 'stringify')
     try {
-      expect(stringifyBoundedMemoryJson(value, 1024)).toBeUndefined()
+      expect(stringifyBoundedJson(value, 1024)).toBeUndefined()
       expect(serialize).not.toHaveBeenCalled()
     } finally {
       serialize.mockRestore()
@@ -61,7 +61,7 @@ describe('bounded memory JSON', () => {
   ])('rejects escaped bytes before serializing the captured graph', ({ value }) => {
     const serialize = vi.spyOn(JSON, 'stringify')
     try {
-      expect(stringifyBoundedMemoryJson(value, 1024)).toBeUndefined()
+      expect(stringifyBoundedJson(value, 1024)).toBeUndefined()
       expect(serialize).not.toHaveBeenCalled()
     } finally {
       serialize.mockRestore()
@@ -71,21 +71,21 @@ describe('bounded memory JSON', () => {
   it('serializes the admitted descriptors without reading proxy values or toJSON', () => {
     const get = vi.fn(() => 'UNADMITTED')
     const value = new Proxy({ text: 'admitted' }, { get })
-    expect(stringifyBoundedMemoryJson(value, 1024)).toBe('{"text":"admitted"}')
+    expect(stringifyBoundedJson(value, 1024)).toBe('{"text":"admitted"}')
     expect(get).not.toHaveBeenCalled()
   })
 
   it('does not read inherited numeric accessors in sparse arrays', () => {
     const get = vi.fn(() => 'UNADMITTED')
     const prototype = Object.create(Array.prototype, { 0: { get } })
     const value = Object.setPrototypeOf(Array(1), prototype)
-    expect(stringifyBoundedMemoryJson(value, 1024)).toBe('[null]')
+    expect(stringifyBoundedJson(value, 1024)).toBe('[null]')
     expect(get).not.toHaveBeenCalled()
   })
 
   it('allows repeated references without treating them as a cycle', () => {
     const result = { answer: 42 }
     const value = { rawResponse: result, modelResponse: result }
-    expect(stringifyBoundedMemoryJson(value, 1024)).toBe(JSON.stringify(value))
+    expect(stringifyBoundedJson(value, 1024)).toBe(JSON.stringify(value))
   })
 })

apps/sim/lib/memory/bounded-json.ts apps/sim/lib/core/utils/bounded-json.tsapps/sim/lib/memory/bounded-json.ts renamed to apps/sim/lib/core/utils/bounded-json.ts

@@ -1,5 +1,5 @@
-const MAX_MEMORY_JSON_NODES = 100_000
-const MAX_MEMORY_JSON_DEPTH = 64
+const MAX_JSON_NODES = 100_000
+const MAX_JSON_DEPTH = 64
 
 /** Counts JSON escapes without allocating the escaped string. */
 function quotedStringBytes(value: string, remaining: number): number | undefined {
@@ -22,7 +22,7 @@ function quotedStringBytes(value: string, remaining: number): number | undefined
 }
 
 /** Captures bounded plain JSON once, without executing accessors or serializing the source graph. */
-export function stringifyBoundedMemoryJson(value: unknown, maxBytes: number): string | undefined {
+export function stringifyBoundedJson(value: unknown, maxBytes: number): string | undefined {
   let nodes = 0
   let bytes = 0
   const invalid = Symbol('invalid JSON')
@@ -32,7 +32,7 @@ export function stringifyBoundedMemoryJson(value: unknown, maxBytes: number): st
     return bytes <= maxBytes
   }
   const capture = (item: unknown, depth: number): unknown => {
-    if (++nodes > MAX_MEMORY_JSON_NODES || depth > MAX_MEMORY_JSON_DEPTH) return invalid
+    if (++nodes > MAX_JSON_NODES || depth > MAX_JSON_DEPTH) return invalid
     if (typeof item === 'string') {
       const count = quotedStringBytes(item, maxBytes - bytes)
       if (count === undefined || !addBytes(count)) return invalid
@@ -53,7 +53,7 @@ export function stringifyBoundedMemoryJson(value: unknown, maxBytes: number): st
       : Object.create(null)
     if (isArray) {
       const length = Object.getOwnPropertyDescriptor(item, 'length')?.value
-      if (typeof length !== 'number' || length > MAX_MEMORY_JSON_NODES - nodes) return invalid
+      if (typeof length !== 'number' || length > MAX_JSON_NODES - nodes) return invalid
       for (let index = 0; index < length; index++) {
         const field = Object.getOwnPropertyDescriptor(item, index)
         if (field && !('value' in field)) return invalid
@@ -69,7 +69,7 @@ export function stringifyBoundedMemoryJson(value: unknown, maxBytes: number): st
         if (!field || !field.enumerable) continue
         if (!('value' in field)) return invalid
         if (field.value === undefined) {
-          if (++nodes > MAX_MEMORY_JSON_NODES) return invalid
+          if (++nodes > MAX_JSON_NODES) return invalid
           continue
         }
         const keyBytes = quotedStringBytes(key, maxBytes - bytes)

apps/sim/lib/memory/agent-turn-session.ts

@@ -6,6 +6,7 @@ import { isRecordLike } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 import { decryptSecret } from '@/lib/core/security/encryption'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import {
   bindDurableSecretProvenanceToValue,
   durableSecretProvenanceFromRegistry,
@@ -24,7 +25,6 @@ import {
 } from '@/lib/memory/application/agent-turns'
 import { MEMORY_DELEGATION_AUDIENCE } from '@/lib/memory/application/authorization'
 import { getMemoryArtifactHandle } from '@/lib/memory/artifact-handle'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
 import {
   decryptMemoryCheckpoint,
   encryptMemoryCheckpoint,
@@ -534,7 +534,7 @@ export async function openAgentTurnSession(
       },
       async prepareResult(result) {
         let requiresArtifact =
-          stringifyBoundedMemoryJson(result, MEMORY.MAX_MESSAGE_CONTENT_BYTES) === undefined
+          stringifyBoundedJson(result, MEMORY.MAX_MESSAGE_CONTENT_BYTES) === undefined
         let safeError: string | undefined
         try {
           const projected = await project(result.modelResponse)
@@ -550,7 +550,7 @@ export async function openAgentTurnSession(
             modelResponse: { ...result.modelResponse, ...projected },
           }
           requiresArtifact ||=
-            stringifyBoundedMemoryJson(prepared, MEMORY.MAX_MESSAGE_CONTENT_BYTES) === undefined
+            stringifyBoundedJson(prepared, MEMORY.MAX_MESSAGE_CONTENT_BYTES) === undefined
           requiresArtifact ||=
             JSON.stringify(prepared.modelResponse).length > MAX_ARTIFACT_PREVIEW_CHARS
           if (requiresArtifact) {

apps/sim/lib/memory/artifacts.ts

@@ -2,13 +2,13 @@ import { dbFor } from '@sim/db'
 import { executionLargeValues, memory, memoryArtifact } from '@sim/db/schema'
 import { and, eq, isNull, sql } from 'drizzle-orm'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import {
   collectLargeValueReferenceKeys,
   registerLargeValueOwner,
 } from '@/lib/execution/payloads/large-value-metadata'
 import { isLargeValueRef, type LargeValueRef } from '@/lib/execution/payloads/large-value-ref'
 import { materializeLargeValueRef, storeLargeValue } from '@/lib/execution/payloads/store'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
 
 export const MAX_MEMORY_ARTIFACT_BYTES = 8 * 1024 * 1024
 export const MAX_MEMORY_ARTIFACT_STORED_BYTES = MAX_MEMORY_ARTIFACT_BYTES * 2 + 1024
@@ -71,7 +71,7 @@ function activeMemoryPredicate(scope: MemoryArtifactScope) {
 export async function storeMemoryArtifact(
   input: StoreMemoryArtifactInput
 ): Promise<StoredMemoryArtifact | undefined> {
-  const json = stringifyBoundedMemoryJson(input.value, MAX_MEMORY_ARTIFACT_BYTES)
+  const json = stringifyBoundedJson(input.value, MAX_MEMORY_ARTIFACT_BYTES)
   if (json === undefined) return undefined
   const execDb = dbFor('exec')
   const [conversation] = await execDb
@@ -183,9 +183,7 @@ export async function readMemoryArtifact(input: ReadMemoryArtifactInput): Promis
     const { decrypted } = await decryptSecret(envelope.encrypted, { logFailure: false })
     if (Buffer.byteLength(decrypted, 'utf8') > MAX_MEMORY_ARTIFACT_BYTES) return undefined
     const value: unknown = JSON.parse(decrypted)
-    return stringifyBoundedMemoryJson(value, MAX_MEMORY_ARTIFACT_BYTES) === undefined
-      ? undefined
-      : value
+    return stringifyBoundedJson(value, MAX_MEMORY_ARTIFACT_BYTES) === undefined ? undefined : value
   } catch {
     return undefined
   }

apps/sim/lib/memory/conversation-store.ts

@@ -3,14 +3,14 @@ import { agentMemoryTurn, memory, memoryItem, memorySecretProvenance } from '@si
 import { generateId } from '@sim/utils/id'
 import { and, asc, desc, eq, gt, inArray, isNull, lt, type SQLWrapper, sql } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 import {
   type DurableSecretProvenance,
   EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
   hashDurableSecretProvenanceValue,
   mergeDurableSecretProvenance,
 } from '@/lib/execution/durable-secret-provenance'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
 import { lockMemoryConversationInTx } from '@/lib/memory/locks'
 import { MAX_RICH_MEMORY_PAGE_BYTES, PlainMemoryReadBudget } from '@/lib/memory/read-budget'
 import {
@@ -98,7 +98,7 @@ interface PlainMemoryWriteInput {
 
 /** Both storage versions persist the same admitted snapshot of each new history item. */
 function captureMemoryItem(value: unknown): unknown {
-  const encoded = stringifyBoundedMemoryJson(value, MAX_MEMORY_ITEM_BYTES)
+  const encoded = stringifyBoundedJson(value, MAX_MEMORY_ITEM_BYTES)
   if (encoded === undefined)
     throw new OrchestrationError(
       'payload_too_large',

apps/sim/lib/memory/retrieval-prefix.ts

@@ -1,9 +1,9 @@
 import { dbFor } from '@sim/db'
 import { memory, memorySecretProvenance } from '@sim/db/schema'
 import { and, eq, isNull, sql } from 'drizzle-orm'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import type { MemoryArtifactScope } from '@/lib/memory/artifacts'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
 import { readBoundMemorySecretProvenance } from '@/lib/memory/secret-provenance'
 
 export const MAX_MEMORY_RETRIEVAL_PREFIX_BYTES = 1024 * 1024
@@ -45,7 +45,7 @@ export async function readMemoryRetrievalPrefix(
     return { status: 'oversized' }
   if (
     !Array.isArray(row.data) ||
-    stringifyBoundedMemoryJson(row.data, MAX_MEMORY_RETRIEVAL_PREFIX_BYTES) === undefined
+    stringifyBoundedJson(row.data, MAX_MEMORY_RETRIEVAL_PREFIX_BYTES) === undefined
   )
     return { status: 'unavailable' }
   const provenance = readBoundMemorySecretProvenance(row)

apps/sim/lib/memory/retrieval.ts

@@ -3,6 +3,7 @@ import { isRecordLike } from '@sim/utils/object'
 import { escapeRegExp } from '@sim/utils/string'
 import { z } from 'zod'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import {
   type DurableSecretProvenance,
   EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
@@ -17,7 +18,6 @@ import {
   type MemoryArtifactScope,
   readMemoryArtifactByHandle,
 } from '@/lib/memory/artifacts'
-import { stringifyBoundedMemoryJson } from '@/lib/memory/bounded-json'
 import { readConversationItems } from '@/lib/memory/conversation-store'
 import { readMemoryRetrievalPrefix } from '@/lib/memory/retrieval-prefix'
 import type { ExecutionContext } from '@/executor/types'
@@ -187,7 +187,7 @@ async function projectText(
   provenance: DurableSecretProvenance,
   provenanceValue: unknown
 ): Promise<string | undefined> {
-  if (stringifyBoundedMemoryJson(value, MAX_MEMORY_ARTIFACT_BYTES) === undefined) return undefined
+  if (stringifyBoundedJson(value, MAX_MEMORY_ARTIFACT_BYTES) === undefined) return undefined
   const current = input.projection.resolvedSecretTraceRegistry
   const registry = current?.forkForToolCall() ?? new ResolvedSecretTraceRegistry([])
   if (!(await importDurableSecretProvenance(registry, provenance, provenanceValue)))
@@ -198,7 +198,7 @@ async function projectText(
   const safe = redaction?.enabled
     ? await redactObjectStrings(projected.value, { ...redaction, onFailure: 'throw' })
     : projected.value
-  return stringifyBoundedMemoryJson(withOpaqueHandles(safe), MAX_MEMORY_ARTIFACT_BYTES)
+  return stringifyBoundedJson(withOpaqueHandles(safe), MAX_MEMORY_ARTIFACT_BYTES)
 }
 
 function textChunk(text: string, offset: number, args: MemoryRetrievalArguments) {

apps/sim/providers/typesafe/transport.ts

@@ -1,10 +1,12 @@
 import { interruptibleSleep } from '@sim/utils/helpers'
 import { backoffWithJitter, parseRetryAfter } from '@sim/utils/retry'
+import { stringifyBoundedJson } from '@/lib/core/utils/bounded-json'
 import { consumeOrCancelBody, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { PROVIDER_HEADERS_TIMEOUT_MS, PROVIDER_MAX_RETRIES } from '@/providers/transport'
 import type { buildJevBody } from '@/providers/typesafe/schema'
 
 const MAX_EVALUATION_RESPONSE_BYTES = 10 * 1024 * 1024
+export const MAX_EVALUATION_REQUEST_BYTES = 10 * 1024 * 1024
 
 class TypeSafeHttpError extends Error {
   constructor(
@@ -21,7 +23,10 @@ export async function requestJevEvaluation(
   apiKey: string,
   abortSignal?: AbortSignal
 ): Promise<unknown> {
-  const payload = JSON.stringify(body)
+  const payload = stringifyBoundedJson(body, MAX_EVALUATION_REQUEST_BYTES)
+  if (payload === undefined) {
+    throw new Error('TypeSafe evaluation request exceeds the size or JSON complexity limit')
+  }
   for (let attempt = 0; ; attempt++) {
     abortSignal?.throwIfAborted()
     const timeout = AbortSignal.timeout(PROVIDER_HEADERS_TIMEOUT_MS)

apps/sim/providers/typesafe/typesafe.test.ts

@@ -5,6 +5,7 @@ import { PROVIDER_MAX_RETRIES } from '@/providers/transport'
 import type { ProviderRequest } from '@/providers/types'
 import { typesafeProvider } from '@/providers/typesafe'
 import { buildJevBody, parseJevResponse } from '@/providers/typesafe/schema'
+import { MAX_EVALUATION_REQUEST_BYTES, requestJevEvaluation } from '@/providers/typesafe/transport'
 import type { JevEvaluationResult, JevQuestion } from '@/providers/typesafe/types'
 import { getProviderFromModel, shouldBillModelUsage } from '@/providers/utils'
 
@@ -211,6 +212,28 @@ describe('TypeSafe provider', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
+  it.each([
+    { label: 'ASCII values', character: 'x', bytes: 1, key: false },
+    { label: 'UTF-8 values', character: '😀', bytes: 4, key: false },
+    { label: 'control-character values', character: '\u0000', bytes: 6, key: false },
+    { label: 'control-character keys', character: '\u0000', bytes: 6, key: true },
+    { label: 'lone-surrogate values', character: '\ud800', bytes: 6, key: false },
+    { label: 'lone-surrogate keys', character: '\ud800', bytes: 6, key: true },
+  ])('rejects oversized $label before serialization or HTTP', async ({ character, bytes, key }) => {
+    const text = character.repeat(Math.ceil(MAX_EVALUATION_REQUEST_BYTES / bytes))
+    const body = {
+      model: REQUEST.model,
+      state: key ? { [text]: null } : text,
+      questions: QUESTIONS,
+    }
+    const serialize = vi.spyOn(JSON, 'stringify')
+    await expect(requestJevEvaluation(body, 'test-key')).rejects.toThrow(
+      'size or JSON complexity limit'
+    )
+    expect(serialize).not.toHaveBeenCalled()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it('honors cancellation before network access', async () => {
     await expect(
       typesafeProvider.executeRequest({ ...REQUEST, abortSignal: AbortSignal.abort() })