fix: keep record diff dimensions unrestricted, bound only hash work

Sessions may be created or resized to any positive dimensions, so the
side schema must not narrow the public contract. Drop the cols/rows
cap and instead skip the pre-event blank-hash equality check above a
100k-row work bound, keeping safeParse cost bounded without rejecting
contract-valid results.

Author: ThomasK33

src/protocol/schemas.ts

@@ -501,20 +501,20 @@ export const RecordDiffLineSchema = z.discriminatedUnion('op', [
 ]);
 export type RecordDiffLine = z.infer<typeof RecordDiffLineSchema>;
 
-// Generous ceiling on diffable screen dimensions; real terminals are far
-// below it. Bounding rows keeps validation-time work (e.g. hashing the
-// blank pre-event screen) proportional to a schema-checked limit instead of
-// attacker-controlled input.
-const MAX_RECORD_DIFF_DIMENSION = 100_000;
+// Work bound for validation-time blank-screen hashing only. Dimensions are
+// deliberately NOT capped (the session contract accepts any positive size);
+// above this row count the pre-event blank-hash equality check is skipped so
+// safeParse never performs unbounded work on attacker-controlled input.
+const MAX_BLANK_HASH_ROWS = 100_000;
 
 export const RecordDiffSideSchema = z
   .object({
     sessionId: NonEmptyStringSchema,
     // -1 mirrors ReplayInput.targetSeq for an empty event log: the side is
     // the pre-event blank screen and no event sequence was replayed.
     capturedAtSeq: z.number().int().gte(-1),
-    cols: PositiveIntSchema.lte(MAX_RECORD_DIFF_DIMENSION),
-    rows: PositiveIntSchema.lte(MAX_RECORD_DIFF_DIMENSION),
+    cols: PositiveIntSchema,
+    rows: PositiveIntSchema,
     screenHash: Sha256HexSchema,
   })
   .strict();
@@ -558,11 +558,14 @@ export const RecordDiffResultSchema = z
     }
 
     // capturedAtSeq -1 marks the pre-event blank screen, so such a side must
-    // hash to `rows` empty canonical lines.
+    // hash to `rows` empty canonical lines. Skipped above the work bound so
+    // validation cost stays bounded for arbitrarily large (but contract-
+    // valid) dimensions.
     for (const sideKey of ['a', 'b'] as const) {
       const side = value[sideKey];
       if (
         side.capturedAtSeq === -1 &&
+        side.rows <= MAX_BLANK_HASH_ROWS &&
         side.screenHash !== sha256Hex('\n'.repeat(side.rows - 1))
       ) {
         ctx.addIssue({

test/unit/protocol/messages.test.ts

@@ -846,23 +846,27 @@ describe('RPC message schemas', () => {
     ).toBe(false);
   });
 
-  it('bounds record diff side dimensions', () => {
+  it('accepts huge session dimensions without unbounded validation work', () => {
+    // Dimensions accepted by the session contract must validate here too;
+    // above the work bound the blank-hash equality check is skipped, so this
+    // parses quickly regardless of the declared hash.
     const side = {
       sessionId: 'session-01',
       capturedAtSeq: -1,
       cols: 80,
-      rows: 100_001,
+      rows: 1_000_000_000,
       screenHash: 'a'.repeat(64),
     };
-    // Oversized rows fail schema validation before any blank-screen hashing.
+    const started = Date.now();
     expect(
       RecordDiffResultSchema.safeParse({
         identical: true,
         a: side,
         b: side,
         diff: [],
       }).success,
-    ).toBe(false);
+    ).toBe(true);
+    expect(Date.now() - started).toBeLessThan(1_000);
   });
 
   it('requires pre-event record diff sides to hash to a blank screen', () => {