Chinesezjc a6678610b8 fix(code-runtime-python): cap the unknown-binding preview before JSON.stringify ...

The reviewer's standing item: the unknown-binding reply ran JSON.stringify on
the WHOLE capped target (global + '.' + name, each up to maxValueBytes code
units), allocating the escaped form — up to ~6x under control-heavy input, a
multi-hundred-MB spike near the maxValueBytes ceiling that no hostile-peer
bound would have admitted. The escaped preview is now built from a 1 KiB
prefix of the target (enough to identify the binding); capMessage still
enforces the reply budget. A forged huge-name case drives the path.

2026-08-31 15:06:50 +08:00

..

index.ts

fix(code-runtime-python): cap the unknown-binding preview before JSON.stringify

2026-08-31 15:06:50 +08:00

invariant.ts

docs(code-runtime-python): correct the claims the new backend invalidated

2026-08-31 14:28:26 +08:00

protocol.ts

fix(code-runtime-python): merge a flushed unterminated line into the next log entry

2026-08-31 15:03:20 +08:00