* fix(fs): bound getFiles() result size and harden traversal
The recursive filesystem traversal in getFiles() could grow its result
vector without limit, contributing to heap pressure on memory-constrained
devices during client config starts. The implementation also relied on
unbounded strcpy and per-entry String() allocations for dot-suffix
filtering, and leaked the directory handle when the opened path was not
a directory.
Rework the traversal to address all of those at once:
- Add optional maxCount (default 64) and wasLimited out-param. The walk
stops once maxCount entries have been collected and wasLimited is set,
so callers can distinguish a complete listing from a truncated one.
Default arguments preserve backward compatibility for existing callers.
- Extract the recursive walk into a collectFiles() helper in an
anonymous namespace, accumulating into a single caller-owned vector
instead of building and inserting temporary vectors at every recursion
level.
- Replace strcpy with strlcpy so file_name writes are bounded by the
destination buffer.
- Replace String(name).endsWith(".") with a stack-based
pathEndsWithDot() helper to avoid a heap allocation per entry.
- Close the directory handle when the opened path is not a directory,
and close the file in both branches of recursion instead of only the
leaf branch (the previous code leaked the handle when depth was
exhausted).
- Compile-gate the std::bad_alloc reserve probe-down behind
__cpp_exceptions / __EXCEPTIONS so the fallback only compiles where
bad_alloc is actually catchable. No-exception targets (nRF52, RP2040,
STM32, ESP32-C6) skip the probe and rely on the bounded maxCount
alone, which is safe because the default cap is small enough to fit
comfortably in available RAM on every supported platform.
* fix(phone-api): skip manifest scan for node-info-only config requests
A client can request a node-info-only config response by sending
want_config_id with the SPECIAL_NONCE_ONLY_NODES nonce. The manifest
walk in handleStartConfig() ran unconditionally even though
STATE_SEND_FILEMANIFEST short-circuits past the manifest on that path,
so the SPI lock and recursive filesystem traversal were wasted work.
On memory-constrained devices this extra heap pressure was enough to
trigger allocation aborts and spontaneous reboots before the node-info
response could complete.
Gate the manifest call behind config_nonce != SPECIAL_NONCE_ONLY_NODES
so the node-info-only path no longer touches the filesystem at all, and
release any stale manifest storage left over from a previous run.
For normal full-config requests, also tighten the scan limits from
depth 10 / unbounded to depth 3 / max 64 entries via the new getFiles()
parameters. A 10-level recursive listing was never useful for a client
file picker and amplified heap pressure for no benefit. Log a warning
when the listing was truncated so operators can distinguish a bounded
result from a genuinely empty filesystem.
A few small cleanups fall out of the above:
- Replace raw spiLock->lock()/unlock() with a LockGuard so the lock is
released even if getFiles() throws on exception-enabled targets.
- Use a releaseFilesManifest() helper (swap-with-empty idiom) in
close() and the STATE_SEND_FILEMANIFEST drain path instead of the
previous clear()+shrink_to_fit() pair. Equivalent behavior, but the
swap idiom is the canonical vector-freeing pattern and centralizing
it avoids divergence between call sites.
- Use %zu for the size_t log arguments.
* fix(fs): harden bounded directory traversal
Close each child directory entry before recursive descent so bounded manifest scans do not stack file handles on constrained filesystems.
Treat null or overlong paths as truncated listings, handle reserve length failures like allocation failures, and keep manifest constants aligned with repository naming.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Fix esptool detection to use 'version' subcommand instead of no arguments
- Fix device-update.bat to use 115200 bps for flashing, 1200 bps only for reset
- Add missing closing quotes in debug messages
Replace magic numbers with named constants for better maintainability
- Add RESET_BAUD=1200 constant for reset baud rate
- Add UPDATE_OFFSET=0x10000 constant for update flash offset
- Use constants instead of hardcoded values throughout script
Extract magic numbers to constants in shell scripts for consistency
- Add FLASH_BAUD, RESET_BAUD, UPDATE_OFFSET constants to device-update.sh
- Add RESET_BAUD, FIRMWARE_OFFSET constants to device-install.sh
- Replace hardcoded values with named constants throughout
- Maintain consistency with batch script improvements
Fix Python path quoting and remove unreachable code
- Quote Python interpreter paths to handle spaces in paths like 'C:\Program Files\Python\python.exe'
- Remove unreachable GOTO statements after EXIT /B commands
- Improve robustness when custom Python interpreters are specified
Fix esptool detection for pipx installations
- Change from checking ERRORLEVEL GEQ 2 to EQU 9009
- Pipx-installed esptool returns exit code 2 when showing help (normal)
- Only treat Windows 'command not found' error (9009) as truly not found
- Add debug output to show actual exit codes for troubleshooting
* Fix position exchange throttling race condition
Separate tracking of position broadcasts vs replies to fix exchange position functionality.
Previously, allocReply() would refuse to send position replies if any position packet
(broadcast or reply) was sent within the last 3 minutes. This caused the exchange
position feature to fail when a device had recently sent a position broadcast.
Changes:
- Add lastSentReply member to track position reply timestamps separately
- Update allocReply() to only throttle based on previous replies, not broadcasts
- This allows position exchange to work even after recent position broadcasts
The fix maintains the 3-minute throttling for replies to prevent spam while allowing
legitimate position exchange functionality to work properly.
* Remove unused lastSentToMesh variable
Variable was no longer used after separating reply throttling logic.
