Description

During a whole-channel reload (startChannelInternal(channelId) with no accountId), the new evictStaleChannelAccountState() function deletes stored lifecycle state for any accountId not returned by plugin.config.listAccountIds(cfg).

This eviction clears two safety controls:

• restartAttempts (used to enforce backoff / max restart attempts)
• manuallyStopped (used to prevent auto-restart after a manual stop)

If listAccountIds(cfg) is influenced by config changes, transient plugin failures, or returns an incomplete/empty list temporarily, an attacker/admin (or buggy plugin) can cause state for real accounts to be evicted and then reintroduced, effectively resetting restart throttling and clearing manual-stop protections. This can enable:

• restart loops and resource exhaustion (DoS)
• unexpected restarts of accounts that were intentionally manually stopped

Vulnerable code:

store.runtimes.delete(id);
restartAttempts.delete(restartKey(channelId, id));
manuallyStopped.delete(restartKey(channelId, id));

Recommendation

Avoid clearing throttling/manual-stop state purely based on a transient listAccountIds() result.

Options:

• Keep restartAttempts and manuallyStopped entries for a grace period (TTL) after an account disappears from listAccountIds.
• Only evict store.runtimes (UI snapshot state) but do not clear restartAttempts / manuallyStopped unless there is an explicit administrative action confirming removal.
• If eviction is required, persist safety state keyed by accountId in durable storage, or track an evictedAt timestamp and require time-based expiration.

Example (preserve safety state):

​// only evict runtime snapshot; preserve safety controls
store.runtimes.delete(id);
​// DO NOT delete restartAttempts/manuallyStopped here

Or with TTL:

const rKey = restartKey(channelId, id);
evictedAt.set(rKey, Date.now());
​// clear manuallyStopped/restartAttempts only if evictedAt is older than TTL