Skip to content

fix(cursor): avoid quadratic replay cost by tracking entry index and bounding replay window - #348

Closed
luvs01 wants to merge 8 commits into
Devfrom
codex/fix-quadratic-cpu-exhaustion-vulnerability-9grcuk
Closed

luvs01 wants to merge 8 commits into
Devfrom
codex/fix-quadratic-cpu-exhaustion-vulnerability-9grcuk

Conversation

@luvs01

@luvs01 luvs01 commented Aug 28, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The external-model Cursor replay deduper performed entries.indexOf(...) for every duplicate, creating attacker-controlled O(k·r) CPU behavior that could stall the server event loop.
  • The replay traversal processed the full rawMessages before pruning, so large attacker-controlled histories could trigger the quadratic path before any size limits applied.

Description

  • Replace array search with a tracked index: lastReplayEntry is replaced by lastReplayEntryIndex and duplicate replacements update the known index directly to make each dedupe operation O(1).
  • Introduce CURSOR_EXTERNAL_REPLAY_MESSAGE_LIMIT = 4096 and limit the synchronous replay construction to the newest bounded suffix for external wire models so replay processing is bounded before later wire-size pruning.
  • Reset the tracked index on user/developer turns to preserve the same-collapse semantics and keep the existing repetition-marking behavior intact.
  • Add a unit test bounds replay construction before processing an oversized history to tests/cursor-repetition-breaker.test.ts that verifies oversized histories outside the bounded replay window do not trigger the severe repetition note.

Testing

  • Ran the focused tests with bun test tests/cursor-repetition-breaker.test.ts and all 6 tests passed.
  • Ran bun run typecheck (TS check) which completed without errors.
  • Attempted a full bun run test; the repository-wide suite ran many tests and reported unrelated failures/timeouts in other subsystems, so only the focused regression and typecheck were relied on to validate this scoped fix.

Codex Task

lidge-jun and others added 8 commits August 25, 2026 10:36
release: promote dev into main for v2.32.1
# Conflicts:
#	package.json
[WRONG BRANCH] merge dev into main for the v2.33.0 release
Promotes the dev integration line onto main. The resulting tree is byte-identical
to origin/dev, including package.json at 2.34.0.

The package.json conflict is resolved to dev's side, NOT to main's stale 2.33.0.
Earlier promotions (lidge-jun#2553, lidge-jun#2507) kept the target's version so the release bump
would land on its own "release: vX.Y.Z" commit. That is no longer legal: this very
delta adds tests/release-version-line.test.ts, which fails when the in-tree version
sits behind the highest release tag. With v2.34.0-preview.20260827 now published,
2.33.0 orders behind it, so a promotion carrying the stale line turns CI red on
every shard that runs the suite.

The consequence for the release step is that scripts/release.ts skips the bump
(release.ts:568, currentVersion === version), so v2.34.0 gets tagged on this merge
commit rather than on a separate release commit. The workflow creates the tag itself
after publishing and validates expected-sha against the checked-out commit, so the
tag still names exactly the audited tree.
[WRONG BRANCH] promote dev onto main for v2.34.0
@github-actions

Copy link
Copy Markdown

✅ Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Aug 28, 2026
@coderabbitai

coderabbitai Bot commented Aug 28, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: a74803f2-49b3-40f9-94cd-eaa8867b6ada


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot changed the title fix(cursor): avoid quadratic replay cost by tracking entry index and bounding replay window [WRONG BRANCH] fix(cursor): avoid quadratic replay cost by tracking entry index and bounding replay window Aug 28, 2026
@github-actions

github-actions Bot commented Aug 28, 2026 •

Copy link
Copy Markdown

✅ READY

  • all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

@github-actions
github-actions Bot marked this pull request as draft August 28, 2026 02:37

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d16b150861

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +260 to +262
const replayStart = externalModel
? Math.max(0, replayEnd - CURSOR_EXTERNAL_REPLAY_MESSAGE_LIMIT)
: 0;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align the capped replay window to a complete turn

When more than 4,096 messages follow the most recent historical user message, this cutoff starts on an assistant/tool-result entry. The later complete-turn selector requires a user root, so with the history constructed by the new test (old turn, 4,101 assistant messages, then the active user), it rejects the orphaned suffix and sends only the system root; the external model receives the active “continue” action with none of the conversation being continued. Anchor the bounded suffix at a user/developer boundary, or explicitly retain the preceding user message, so limiting construction cannot erase all replay context.

Useful? React with 👍 / 👎.

@luvs01 luvs01 changed the title [WRONG BRANCH] fix(cursor): avoid quadratic replay cost by tracking entry index and bounding replay window fix(cursor): avoid quadratic replay cost by tracking entry index and bounding replay window Sep 3, 2026
@luvs01
luvs01 changed the base branch from main to dev September 3, 2026 06:23
@github-actions
github-actions Bot marked this pull request as ready for review September 3, 2026 06:33
@luvs01 luvs01 closed this Sep 7, 2026
@luvs01
luvs01 deleted the codex/fix-quadratic-cpu-exhaustion-vulnerability-9grcuk branch September 20, 2026 06:42
@luvs01

luvs01 commented Sep 21, 2026

Copy link
Copy Markdown
Owner Author

Closing evidence (retroactive): this PR was closed without a rationale comment, and the fix was never landed — \�ntries.indexOf(previous.entry)\ is still live on current upstream dev. The change has been re-ported onto current dev as #608 (tests: 9 + 335 pass) and will be submitted upstream when PR creation is permitted again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants