What happened
decodeJsonLines compares the accumulated unparsed stdout tail with maxBufferBytes using JavaScript string.length:
if (rest.length > handlers.maxBufferBytes) {
handlers.onOverflow();
}
string.length counts UTF-16 code units, while maxBufferBytes is a UTF-8 byte budget derived from the executor's negotiated limits.maxResponseBytes. Consequently, an unterminated JSON line containing CJK or emoji can consume substantially more memory than the declared limit before the host terminates the executor. For example, four CJK characters have length 4 but occupy 12 UTF-8 bytes.
Expected behavior: the accumulated tail should overflow as soon as its UTF-8 encoded size exceeds maxBufferBytes. ASCII behavior and the inclusive boundary should remain unchanged.
How to reproduce
From the repository root at commit 492ff80f0:
node --experimental-strip-types --input-type=module <<'NODE'
import { decodeJsonLines } from './packages/computer-use/src/stdio-json-rpc.ts';
const cap = 4 * 1024 * 1024;
const text = '中'.repeat(Math.floor(cap / 3) + 1);
let overflow = false;
decodeJsonLines('', text, {
maxBufferBytes: cap,
onOverflow: () => { overflow = true; },
onMessage: () => {},
});
console.log({
limit: cap,
characters: text.length,
utf8Bytes: Buffer.byteLength(text),
overflow,
});
NODE
Observed output:
{
limit: 4194304,
characters: 1398102,
utf8Bytes: 4194306,
overflow: false
}
The input exceeds the 4 MiB byte limit, but overflow is not reported. With CJK input the current check can allow roughly three times the intended byte budget before firing.
Environment
- Maka commit:
492ff80f0
- OS: macOS 15.7.3
- Surface: Computer Use / stdio JSON-RPC transport
- Node.js: v24.14.0
Logs, screenshots, or additional context
The affected comparison is in packages/computer-use/src/stdio-json-rpc.ts. The minimal fix is to measure the accumulated tail with Buffer.byteLength(rest, 'utf8') and add regression coverage for over-limit multibyte input, an exact-limit multibyte input, and unchanged ASCII behavior.
What happened
decodeJsonLinescompares the accumulated unparsed stdout tail withmaxBufferBytesusing JavaScriptstring.length:string.lengthcounts UTF-16 code units, whilemaxBufferBytesis a UTF-8 byte budget derived from the executor's negotiatedlimits.maxResponseBytes. Consequently, an unterminated JSON line containing CJK or emoji can consume substantially more memory than the declared limit before the host terminates the executor. For example, four CJK characters have length 4 but occupy 12 UTF-8 bytes.Expected behavior: the accumulated tail should overflow as soon as its UTF-8 encoded size exceeds
maxBufferBytes. ASCII behavior and the inclusive boundary should remain unchanged.How to reproduce
From the repository root at commit
492ff80f0:Observed output:
The input exceeds the 4 MiB byte limit, but overflow is not reported. With CJK input the current check can allow roughly three times the intended byte budget before firing.
Environment
492ff80f0Logs, screenshots, or additional context
The affected comparison is in
packages/computer-use/src/stdio-json-rpc.ts. The minimal fix is to measure the accumulated tail withBuffer.byteLength(rest, 'utf8')and add regression coverage for over-limit multibyte input, an exact-limit multibyte input, and unchanged ASCII behavior.