Security hardening — round 6: 7 confirmed defects

[REPPL]

Round 6 of the autonomous security-hardening loop (state issue #9). Seven confirmed defects fixed, each surviving an independent adversarial refuter and covered by a reproduction test observed failing before and passing after. Baseline was fully green before any change; the suite is 942 passing (+19 new).

Fixed

1. Collection forced settings permanently overwrote the user's global settings (src/stores/settingsStore.ts, src/context/CollectionDataContext.tsx). A remote settings.json's forced block was written into the user's persisted global settings with no backup, and the only teardown action had zero callers. Viewing one hostile allowlisted-CDN source once — reachable via a single unconfirmed /gh/<user>/ link that auto-adds and activates the source — rewrote the visitor's display config across reloads and source switches, several keys unrecoverable without a full reset. Now snapshots the user's own value per forced key (source-scoped, so a refetch cannot clobber it), restores on source change via a dedicated effect (a source with no settings.json never reaches the apply path), and rolls back on rehydration for crash recovery — mirroring _mechanicOverridesBackup. The dead clearCollectionForcedSettings is repurposed into restoreCollectionForcedSettings.

2. Object-typed entity fields crashed the whole collection view (src/hooks/useCollection.ts). summary and the resolved platform title/shortTitle/summary/year were cast, not coerced. The .loose() schema lets an object through, which is truthy and reaches JSX as a child, so React throws "Objects are not valid as a React child" — the device-badge sink fires on first paint in the default grid. Coerced with a shared helper, matching the existing title/year/videos guards.

3. collectionStats min/max spread crashed on large collections (src/utils/collectionStats.ts). Math.min(...values)/Math.max(...values) over a per-card array throws RangeError past the engine argument limit (~125k), and CollectionToast renders outside the collection error boundary, so the app blanks. Replaced with a single-pass loop.

4. Uncapped entity-type fan-out (src/loaders/collectionLoader.ts). loadCollection mapped the untrusted entityTypes record into a Promise.all, each type fanning out into several probe fetches — a collection with tens of thousands of empty types amplified one load into ~80k CDN requests plus GitHub-quota exhaustion. Capped and pooled, always retaining the primary type. (The round-5 caps only covered the per-directory id path.)

5. Uncapped discovery fan-out (src/hooks/useMyPlausibleMeDiscovery.ts). Discovery ran a Promise.all over every collection.json in the GitHub tree; the username is attacker-controlled and discovery auto-runs on the startup picker with no click, so a /gh/<user>/ link to a repo listing thousands of collections turned one page load into a CDN flood. Capped the count and pooled the metadata fetches.

6. Unbounded media per card (src/hooks/useCollection.ts). card.imageUrls (images + videos) was uncapped and feeds the gallery dot buttons and the load-time preloader, so a hostile entity could mount tens of thousands of nodes / requests. Capped the combined list at the data layer.

7. Hard reset silently left data behind or hung (src/lib/clearPersistedData.ts, src/db/index.ts). The three IndexedDB cleanups ran sequentially and only the first (deleteDB) was failure-intolerant, and deleteDB had no onblocked handler. A blocked or failed app-DB delete either hung the reset dialog or aborted the remaining steps, leaving cached collections and the plugin DB on disk while the UI reported "delete everything" complete. Added an onblocked handler and ran the cleanups independently via Promise.allSettled.

Considered and rejected (refuted)

• applyMechanicOverrides second-activation backup clobber — unreachable: the Start Game overlay is gated on !activeMechanic, so overrides only apply when no mechanic is active, and every deactivation restores the backup first.
• Write-only collectionForcedSettings mid-session revert — the claimed spontaneous-revert mechanism is false: TanStack Query's structural sharing keeps data.settings identity stable across refetches, so the apply effect does not re-fire. Folded into fix 1 (wire up / remove the dead state).

Deferred (nitpick / out of scope)

TruffleHog pre-commit --since-commit HEAD empty-range scan; gitleaks checksum not provenance-anchored; build:analyse writing stats.html into the deploy root; forced cardBackStyle/titleDisplayMode enum mismatch vs the store types; getDB() in-flight dedup (the root cause that makes the delete-blocked path reachable). No dependency changes (0 npm-audit findings on production deps).

Verification

npm run build, npm run typecheck, npm run lint (0 errors), and npm test (942 passing, +19 new) all green.