(maka) branch main updated: fix(computer-use): enforce JSON line UTF-8 byte limit (#4953)

[zh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

me2seeks pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/maka.git


The following commit(s) were added to refs/heads/main by this push:
     new a0bc80c8bc fix(computer-use): enforce JSON line UTF-8 byte limit (#4953)
a0bc80c8bc is described below

commit a0bc80c8bc5d43ccb7f7cb565bcb75ba14b17102
Author: Xiao Liu <li...@qq.com>
AuthorDate: Tue Sep 8 09:05:37 2026 +0800

    fix(computer-use): enforce JSON line UTF-8 byte limit (#4953)
    
    Measure the accumulated unparsed stdout tail in UTF-8 bytes so multibyte output cannot exceed the negotiated buffer budget unnoticed. Add boundary coverage for over-limit, exact-limit, and ASCII input across chunks.
    
    Generated-by: Codex
---
 .../src/__tests__/stdio-json-rpc.test.ts           | 69 ++++++++++++++++++++++
 packages/computer-use/src/stdio-json-rpc.ts        |  2 +-
 2 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/packages/computer-use/src/__tests__/stdio-json-rpc.test.ts b/packages/computer-use/src/__tests__/stdio-json-rpc.test.ts
new file mode 100644
index 0000000000..1fcda86bba
--- /dev/null
+++ b/packages/computer-use/src/__tests__/stdio-json-rpc.test.ts
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import { decodeJsonLines } from '../stdio-json-rpc.js';
+
+describe('stdio JSON-RPC framing', () => {
+  it('rejects an unparsed tail that exceeds the UTF-8 byte budget', () => {
+    let overflowed = false;
+
+    const rest = decodeJsonLines('中', '文', {
+      maxBufferBytes: 4,
+      onOverflow: () => {
+        overflowed = true;
+      },
+      onMessage: () => {},
+    });
+
+    assert.equal(rest, '中文');
+    assert.equal(overflowed, true);
+  });
+
+  it('accepts a multibyte tail exactly at the UTF-8 byte budget', () => {
+    let overflowed = false;
+
+    const rest = decodeJsonLines('中', '文', {
+      maxBufferBytes: 6,
+      onOverflow: () => {
+        overflowed = true;
+      },
+      onMessage: () => {},
+    });
+
+    assert.equal(rest, '中文');
+    assert.equal(overflowed, false);
+  });
+
+  it('preserves the existing ASCII boundary behavior', () => {
+    let overflowed = false;
+
+    decodeJsonLines('he', 'llo', {
+      maxBufferBytes: 4,
+      onOverflow: () => {
+        overflowed = true;
+      },
+      onMessage: () => {},
+    });
+
+    assert.equal(overflowed, true);
+  });
+});
diff --git a/packages/computer-use/src/stdio-json-rpc.ts b/packages/computer-use/src/stdio-json-rpc.ts
index 7c512e3f96..1883b4d4c2 100644
--- a/packages/computer-use/src/stdio-json-rpc.ts
+++ b/packages/computer-use/src/stdio-json-rpc.ts
@@ -71,7 +71,7 @@ export function decodeJsonLines(
   handlers: JsonLineDecoderHandlers,
 ): string {
   let rest = buffer + chunk;
-  if (rest.length > handlers.maxBufferBytes) {
+  if (Buffer.byteLength(rest, 'utf8') > handlers.maxBufferBytes) {
     handlers.onOverflow();
     return rest;
   }


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org