fix(security): Add scroll boundary validation and memory limits - Priority: CRITICAL

Prevents crashes from unbounded scrolling and memory growth in TUI.

Changes:
- Add bounds checking for scroll position calculations
- Ensure viewport height is at least 1 to prevent division issues
- Cap scroll position to valid line range
- Limit HashMap size to 100 entries to prevent memory leaks
- Add automatic eviction of old scroll positions

This fixes potential crashes from scrolling beyond buffer bounds
and prevents unbounded memory growth from long-running sessions.

Author: inureyes

src/ui/tui/app.rs

@@ -109,8 +109,21 @@ impl TuiApp {
         self.scroll_positions.get(&node_index).copied().unwrap_or(0)
     }
 
-    /// Set scroll position for a node
+    /// Set scroll position for a node with memory limit
     pub fn set_scroll(&mut self, node_index: usize, position: usize) {
+        // Limit HashMap size to prevent unbounded memory growth
+        // Keep only last 100 node scroll positions (more than enough for typical use)
+        const MAX_SCROLL_ENTRIES: usize = 100;
+
+        if self.scroll_positions.len() >= MAX_SCROLL_ENTRIES
+            && !self.scroll_positions.contains_key(&node_index)
+        {
+            // Remove oldest entry (arbitrary - could use LRU if needed)
+            if let Some(first_key) = self.scroll_positions.keys().next().copied() {
+                self.scroll_positions.remove(&first_key);
+            }
+        }
+
         self.scroll_positions.insert(node_index, position);
     }
 

src/ui/tui/views/detail.rs

@@ -133,18 +133,27 @@ fn render_output(
         )));
     }
 
-    // Calculate scroll position
+    // Calculate scroll position with bounds checking
     let viewport_height = area.height.saturating_sub(2) as usize; // Minus borders
     let total_lines = lines.len();
 
+    // Ensure viewport height is at least 1 to avoid division by zero issues
+    let viewport_height = viewport_height.max(1);
+
+    // Calculate maximum scroll position
+    let max_scroll = total_lines.saturating_sub(viewport_height);
+
     let scroll = if follow_mode {
         // Auto-scroll to bottom
-        total_lines.saturating_sub(viewport_height)
+        max_scroll
     } else {
-        // Manual scroll position
-        scroll_pos.min(total_lines.saturating_sub(viewport_height))
+        // Manual scroll position with bounds checking
+        scroll_pos.min(max_scroll)
     };
 
+    // Ensure scroll is within valid range
+    let scroll = scroll.min(total_lines.saturating_sub(1));
+
     let paragraph = Paragraph::new(lines)
         .block(Block::default().borders(Borders::LEFT | Borders::RIGHT))
         .scroll((scroll as u16, 0))