redhat-et / redhat-et/docsclaw
feat: add bounded memory protection for session store
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2
- Forks
- 1
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 1
Description
Summary
The in-memory session store (internal/session/store.go) has no limits on the number of sessions or messages per session. A misbehaving client could exhaust server memory.
What to add
- Max sessions: configurable limit (e.g., 1000), reject new sessions with an error when exceeded or evict LRU
- Max messages per session: configurable limit (e.g., 200 messages), trigger compaction or truncation when exceeded
- Session ID validation: currently truncated to 64 chars; consider restricting to alphanumeric + hyphens
Related
- Deferred from PR #51 (Kimi review finding #2)
- Part of #5 (Memory and context persistence)
- Max messages limit is a prerequisite for context compaction (#5 Phase 3)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with internal/session/store.go and trace how sessions and messages are created, stored, and identified. Clarify whether limits should reject or evict sessions, and whether message overflow should compact or truncate. Done means configurable protections cover session count, per-session messages, and the stated session ID validation requirement.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100