[Wenjix]

Closes #454

Summary

verifyFiniteCalls already proves the TextTemplate call graph is a DAG — but a DAG can still be a diamond: N levels of two calls each expand 2^N times, and two consumers paid that cost:

• 21 (medium, CWE-407): collectBindings re-walked a definition's subtree at every call site — a 30-level diamond is ~2³⁰ walks. What a definition contributes to the binding set is a pure function of (definition, locals scope), so collection is now memoized on that pair: each (definition, scope) is walked once and its contribution unioned. Semantics preserved, including the lexical-each shadowing test where the same definition contributes different bindings under different scopes.
• 29 (medium, CWE-400): renderExpression expanded every call and each item with no ceiling — diamond call graphs double output per level, and replace/each amplify further. Render now charges every produced string against an 8 MiB budget (textRenderOutputLimit, exported like windowsLockerPasswordLimit) and throws Text render exceeds the …-character output budget past it. The charge counts each returned expression once per nesting level, which bounds total string work, not just final size — that is the resource the attack burns.

Behavior relative to main

Flow	main	this PR
30-level diamond, textTemplateBindingNames	~2³⁰ walks (hang)	~60 walks, ["leaf"]
24-level doubling render (16 MB output)	expands fully	throws output budget
normal templates	render unchanged	render unchanged

Red / green

packages/text/test/text.test.ts: diamondTemplate builds an N-level two-calls-per-level graph — the 30-level binding-collection test returns instantly here (hangs on main), and the 24-level render test hits the budget (on main it produced the full 16 MB). The lexical-each scope test still passes, confirming per-scope memoization is correct.

Verification

• node --import tsx --test packages/text/test/text.test.ts — 9 pass.
• pnpm check — clean.
• All render paths funnel through renderText; all binding collection through textTemplateBindingNames — both are covered.

Merge Danger

• A render whose cumulative produced output exceeds 8 MiB now throws. Generated text (prompts, manifests) is KB-scale; anything larger was already an accident or an attack.

Checklist

• The why is documented in this description.
• Regression tests added; fail on main, pass here.
• TypeScript check clean.

Generated with Devin

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.