[agent] feat: per-project caps on variable count and plaintext size

Two new settings, enforced by `envx set` before upload:

  settings.max_variables_per_project   (default 256)
  settings.max_project_bytes            (default 100 * 1024 * 1024)

Pre-flight check uses the variable list already fetched for the
overwrite-detection step (no extra network call). Computes the final
state after the upload would land — `existing - overwrites + new` for
both count and plaintext bytes — and bails with a clear message if either
cap would be breached, naming the exact `envx config set` command to
raise the limit.

Bytes are plaintext (key + value), not ciphertext. The user-facing
mental model is "how much did I type", which matches what they can
control. Ciphertext tracks plaintext closely (PGP adds ~constant
per-recipient overhead) so the cap still bounds server-side storage.

**Caveat for abuse prevention:** these are client-side caps. A modified
CLI can bypass them. For real abuse defense, the server needs to enforce
the same limits.

New FieldKind::Number variant in the field registry handles u32/u64
parsing for the two new settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: alexng353

src/commands/config/fields.rs

@@ -8,6 +8,7 @@ pub enum FieldKind {
     Password,
     StringList,
     KeyringExpiry,
+    Number,
 }
 
 pub struct Field {
@@ -61,6 +62,20 @@ pub const FIELDS: &[Field] = &[
         format_hint: "true | false",
         can_unset: true,
     },
+    Field {
+        path: "settings.max_variables_per_project",
+        kind: FieldKind::Number,
+        description: "Reject `envx set` that would push a project over this many variables",
+        format_hint: "positive integer (default 256)",
+        can_unset: true,
+    },
+    Field {
+        path: "settings.max_project_bytes",
+        kind: FieldKind::Number,
+        description: "Reject `envx set` that would push a project over this many bytes of plaintext",
+        format_hint: "positive integer in bytes (default 104857600 = 100MB)",
+        can_unset: true,
+    },
 ];
 
 pub fn find(path: &str) -> Result<&'static Field> {
@@ -126,6 +141,18 @@ pub fn current_display(config: &Config, field: &Field) -> String {
             .and_then(|s| s.loud)
             .map(|b| b.to_string())
             .unwrap_or_else(|| "false".to_string()),
+        "settings.max_variables_per_project" => config
+            .settings
+            .as_ref()
+            .and_then(|s| s.max_variables_per_project)
+            .map(|n| n.to_string())
+            .unwrap_or_else(|| "<unset>".to_string()),
+        "settings.max_project_bytes" => config
+            .settings
+            .as_ref()
+            .and_then(|s| s.max_project_bytes)
+            .map(|n| n.to_string())
+            .unwrap_or_else(|| "<unset>".to_string()),
         _ => "?".to_string(),
     }
 }
@@ -157,6 +184,17 @@ pub fn current_json(config: &Config, field: &Field) -> serde_json::Value {
             serde_json::to_value(config.settings.as_ref().and_then(|s| s.loud))
                 .unwrap()
         }
+        "settings.max_variables_per_project" => serde_json::to_value(
+            config
+                .settings
+                .as_ref()
+                .and_then(|s| s.max_variables_per_project),
+        )
+        .unwrap(),
+        "settings.max_project_bytes" => serde_json::to_value(
+            config.settings.as_ref().and_then(|s| s.max_project_bytes),
+        )
+        .unwrap(),
         _ => serde_json::Value::Null,
     }
 }
@@ -202,6 +240,22 @@ pub fn set(config: &mut Config, field: &Field, raw: &str) -> Result<()> {
             s.loud = Some(v);
             config.settings = Some(s);
         }
+        "settings.max_variables_per_project" => {
+            let v: u32 = raw.trim().parse().map_err(|_| {
+                anyhow!("Expected positive integer, got '{}'", raw.trim())
+            })?;
+            let mut s = config.settings.clone().unwrap_or_default();
+            s.max_variables_per_project = Some(v);
+            config.settings = Some(s);
+        }
+        "settings.max_project_bytes" => {
+            let v: u64 = raw.trim().parse().map_err(|_| {
+                anyhow!("Expected positive integer, got '{}'", raw.trim())
+            })?;
+            let mut s = config.settings.clone().unwrap_or_default();
+            s.max_project_bytes = Some(v);
+            config.settings = Some(s);
+        }
         _ => bail!("Field not handled in setter"),
     }
     Ok(())
@@ -229,6 +283,16 @@ pub fn unset(config: &mut Config, field: &Field) -> Result<()> {
                 s.loud = None;
             }
         }
+        "settings.max_variables_per_project" => {
+            if let Some(s) = config.settings.as_mut() {
+                s.max_variables_per_project = None;
+            }
+        }
+        "settings.max_project_bytes" => {
+            if let Some(s) = config.settings.as_mut() {
+                s.max_project_bytes = None;
+            }
+        }
         _ => bail!("Field not handled in unsetter"),
     }
     Ok(())

src/commands/config/set.rs

@@ -103,8 +103,9 @@ fn read_value(field: &Field, config: &Config) -> Result<String> {
             let v = prompt_confirm_with_default(&prompt, current)?;
             Ok(v.to_string())
         }
-        FieldKind::Url | FieldKind::StringList | FieldKind::KeyringExpiry => {
-            prompt_text(&prompt)
-        }
+        FieldKind::Url
+        | FieldKind::StringList
+        | FieldKind::KeyringExpiry
+        | FieldKind::Number => prompt_text(&prompt),
     }
 }

src/commands/set.rs

@@ -11,6 +11,7 @@ use crate::{
         kvpair::KVPair,
         // partial_variable::ToParsed,
         prompt::prompt_confirm,
+        variable::DecryptedVariable,
     },
 };
 
@@ -110,6 +111,8 @@ pub async fn command(args: Args, config: &mut Config) -> Result<()> {
         })
         .collect::<Vec<_>>();
 
+    enforce_project_caps(config, &variables, &existing_keys, &kvpairs)?;
+
     if !existing_keys.is_empty() {
         println!("The following variables already exist:");
         for key in &existing_keys {
@@ -157,3 +160,57 @@ pub async fn command(args: Args, config: &mut Config) -> Result<()> {
 
     Ok(())
 }
+
+fn kvpair_bytes(key: &str, value: &str) -> u64 {
+    (key.len() + value.len()) as u64
+}
+
+fn enforce_project_caps(
+    config: &Config,
+    existing: &[DecryptedVariable],
+    overwrites: &[&DecryptedVariable],
+    incoming: &[KVPair],
+) -> Result<()> {
+    let settings = config.get_settings();
+    let max_count = settings.get_max_variables_per_project() as usize;
+    let max_bytes = settings.get_max_project_bytes();
+
+    let final_count = existing
+        .len()
+        .saturating_sub(overwrites.len())
+        .saturating_add(incoming.len());
+    if final_count > max_count {
+        bail!(
+            "Variable count cap exceeded: this `envx set` would put the project at {} variable(s) (cap: {}).\n\
+             Raise it with `envx config set settings.max_variables_per_project <n>`.",
+            final_count,
+            max_count,
+        );
+    }
+
+    let existing_bytes: u64 = existing
+        .iter()
+        .map(|v| kvpair_bytes(&v.value.key, &v.value.value))
+        .sum();
+    let overwrite_bytes: u64 = overwrites
+        .iter()
+        .map(|v| kvpair_bytes(&v.value.key, &v.value.value))
+        .sum();
+    let new_bytes: u64 = incoming
+        .iter()
+        .map(|kv| kvpair_bytes(&kv.key, &kv.value))
+        .sum();
+    let final_bytes = existing_bytes
+        .saturating_sub(overwrite_bytes)
+        .saturating_add(new_bytes);
+    if final_bytes > max_bytes {
+        bail!(
+            "Project size cap exceeded: this `envx set` would put the project at {} bytes of plaintext (cap: {}).\n\
+             Raise it with `envx config set settings.max_project_bytes <bytes>`.",
+            final_bytes,
+            max_bytes,
+        );
+    }
+
+    Ok(())
+}

src/utils/settings.rs

@@ -6,11 +6,16 @@ pub enum KeyringExpiry {
     Days(u32),
 }
 
+pub const DEFAULT_MAX_VARIABLES_PER_PROJECT: u32 = 256;
+pub const DEFAULT_MAX_PROJECT_BYTES: u64 = 100 * 1024 * 1024;
+
 #[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct Settings {
     pub warn_on_short_passwords: bool,
     pub keyring_expiry: Option<KeyringExpiry>,
     pub loud: Option<bool>,
+    pub max_variables_per_project: Option<u32>,
+    pub max_project_bytes: Option<u64>,
 }
 
 impl Default for Settings {
@@ -19,6 +24,8 @@ impl Default for Settings {
             warn_on_short_passwords: false,
             keyring_expiry: Some(KeyringExpiry::Days(30)),
             loud: None,
+            max_variables_per_project: None,
+            max_project_bytes: None,
         }
     }
 }
@@ -32,4 +39,13 @@ impl Settings {
     pub fn is_loud(&self) -> bool {
         self.loud.unwrap_or(false)
     }
+
+    pub fn get_max_variables_per_project(&self) -> u32 {
+        self.max_variables_per_project
+            .unwrap_or(DEFAULT_MAX_VARIABLES_PER_PROJECT)
+    }
+
+    pub fn get_max_project_bytes(&self) -> u64 {
+        self.max_project_bytes.unwrap_or(DEFAULT_MAX_PROJECT_BYTES)
+    }
 }