[deanrie]

What

cloneRepo in lib/plugins/scan.ts caps the GitHub tarball download at REPO_ARCHIVE_MAX_BYTES (100 MB). The comment above the constant says why: "Cap how much of the repo archive we materialize on the function's tmpfs", since /tmp is shared and has a ~500 MB limit. Only the compressed bytes are counted, though. The .tar.gz written to disk and the tree tar.x extracts from it are unbounded.

gzip compresses low-entropy data at up to ~1000:1, so a public repo with a few 100 MB files of zeros (GitHub's per-file limit) produces a tarball of a few hundred KB that passes the download cap and the content-length check, then writes hundreds of MB to tmpfs. The ENOSPC that follows is a plain Error, which runSecurityAgent treats as transient and rethrows, so the drain route lets pgmq redeliver the scan up to MAX_ATTEMPTS (5), each attempt filling /tmp again and failing whatever other scan shares the instance. Anyone can submit a plugin that points at such a repo.

Measured with a standalone replica of the pipeline (same stages in the same order) against a local HTTP server:

archive	download	unpacks to	tar 7.5.15 (bun.lock)	tar 7.5.22
300 MB of zeros	306 KB	300 MB	extracted, 300 MB on disk	refused, ratio exactly 1000
300 MB, 3 random bytes per KiB (144:1)	2.1 MB	300 MB	extracted, 302 MB on disk	extracted, 302 MB on disk

The maxDecompressionRatio guard in later 7.5.x releases is relative, so a 95 MB download at 500:1 would still unpack to ~47 GB. An absolute cap is needed either way.

Fix

The download is decompressed inside the pipeline (createGunzip) under a second byte budget, REPO_UNPACKED_MAX_BYTES (100 MB), and the file written to disk is the plain repo.tar, so extraction cannot grow past it. Peak tmpfs use is at most the two caps together. Exceeding either budget raises UnscannableRepoError, which already maps to the suspicious / repository_clone_failed verdict for manual review, so the scan is not retried. archiveSizeGuard became byteBudget, used for both stages, with the same log line per stage.

With the change, both archives above stop at exactly 100 MB of decompressed bytes with Repository archive unpacks to more than the 104857600-byte scan limit. and the scratch dir is cleaned up. Real tarballs of cursor/plugin-template and xai-org/grok-build-plugin-cc extract with the same file list as before.

The repo has no test runner, so the replica script is not committed, as with #467. tsc --noEmit -p apps/cursor/tsconfig.json shows the same single pre-existing error on this file (platform in AgentOptions, already noted in the source) and nothing new; biome check on the file is clean.

[vercel]

@deanrie is attempting to deploy a commit to the Anysphere Team on Vercel.

A member of the Team first needs to authorize it.