artifactSearch (artifact.go:130) scans each artifact with scanner.Buffer(make([]byte, 4096), 1024*1024) and never checks scanner.Err() after the loop (it ends with _ = f.Close()). A single line over 1 MiB triggers bufio.ErrTooLong, silently aborting the scan for that artifact with no error and no truncation signal — the search reports a clean "no match".
This is reachable and load-bearing: audit.events_tail and agent.messages_tail spill single-line JSON blobs to artifacts, and those lines routinely exceed 1 MiB, so searching the audit/message history can silently return false negatives. (The same class of bug was fixed for file.search in #37 by iterating the in-memory buffer.)
Fix: adopt the unified scanner pattern (8 MiB buffer aligned with events.go/agent.go and a checked scanner.Err()), or iterate the bounded in-memory content directly.
artifactSearch(artifact.go:130) scans each artifact withscanner.Buffer(make([]byte, 4096), 1024*1024)and never checksscanner.Err()after the loop (it ends with_ = f.Close()). A single line over 1 MiB triggersbufio.ErrTooLong, silently aborting the scan for that artifact with no error and no truncation signal — the search reports a clean "no match".This is reachable and load-bearing:
audit.events_tailandagent.messages_tailspill single-line JSON blobs to artifacts, and those lines routinely exceed 1 MiB, so searching the audit/message history can silently return false negatives. (The same class of bug was fixed forfile.searchin #37 by iterating the in-memory buffer.)Fix: adopt the unified scanner pattern (8 MiB buffer aligned with events.go/agent.go and a checked
scanner.Err()), or iterate the bounded in-memory content directly.