Skip to content

fix(computer-use): enforce JSON line limits in UTF-8 bytes #4952

Description

@liuxiaocs7

What happened

decodeJsonLines compares the accumulated unparsed stdout tail with maxBufferBytes using JavaScript string.length:

if (rest.length > handlers.maxBufferBytes) {
  handlers.onOverflow();
}

string.length counts UTF-16 code units, while maxBufferBytes is a UTF-8 byte budget derived from the executor's negotiated limits.maxResponseBytes. Consequently, an unterminated JSON line containing CJK or emoji can consume substantially more memory than the declared limit before the host terminates the executor. For example, four CJK characters have length 4 but occupy 12 UTF-8 bytes.

Expected behavior: the accumulated tail should overflow as soon as its UTF-8 encoded size exceeds maxBufferBytes. ASCII behavior and the inclusive boundary should remain unchanged.

How to reproduce

From the repository root at commit 492ff80f0:

node --experimental-strip-types --input-type=module <<'NODE'
import { decodeJsonLines } from './packages/computer-use/src/stdio-json-rpc.ts';

const cap = 4 * 1024 * 1024;
const text = '中'.repeat(Math.floor(cap / 3) + 1);
let overflow = false;

decodeJsonLines('', text, {
  maxBufferBytes: cap,
  onOverflow: () => { overflow = true; },
  onMessage: () => {},
});

console.log({
  limit: cap,
  characters: text.length,
  utf8Bytes: Buffer.byteLength(text),
  overflow,
});
NODE

Observed output:

{
  limit: 4194304,
  characters: 1398102,
  utf8Bytes: 4194306,
  overflow: false
}

The input exceeds the 4 MiB byte limit, but overflow is not reported. With CJK input the current check can allow roughly three times the intended byte budget before firing.

Environment

  • Maka commit: 492ff80f0
  • OS: macOS 15.7.3
  • Surface: Computer Use / stdio JSON-RPC transport
  • Node.js: v24.14.0

Logs, screenshots, or additional context

The affected comparison is in packages/computer-use/src/stdio-json-rpc.ts. The minimal fix is to measure the accumulated tail with Buffer.byteLength(rest, 'utf8') and add regression coverage for over-limit multibyte input, an exact-limit multibyte input, and unchanged ASCII behavior.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions