Repository navigation
Conversation
dev already caps stdout bytes (GIT_OUTPUT_MAX_BYTES) and NUL fields, but
three gaps remain, all proven by the 2026-10-13 host crashes (twice:
RangeError: Invalid string length at the stdout accumulator, a junction-
forest workspace driving 'git status -uall' to gigabytes):
1. no latch after a byte-cap reject — later chunks kept ACCUMULATING on
the retained strings. On Windows spawn('git') resolves to the cmd
shim, whose grandchild survives child.kill() and keeps feeding the
dead accumulator (measured: the orphan outlived kill() by 20+s). The
fieldCapped guard covered only the row cap; the byte cap had none.
2. kill() reaches only the wrapper — the orphaned grandchild needs its
pipes destroyed (EPIPE) to actually stop. killTree() destroys both
streams and is now used by every kill path (timeout, byte cap, field
cap).
3. stderr was uncapped — a command whose DIAGNOSTICS stream past the
budget is as able to kill the host via string length as its answer;
stderr now shares the same maxBytes budget.
Worst case in a pathological workspace is now one failed SCM refresh,
never a dead host.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR：对 dev 已有的 runGit 输出上限做三点加固（闩锁 / killTree / stderr 预算）。
背景：2026-10-13 两次宿主崩溃（一手证据）
一个含未跟踪 pnpm junction 森林的工作区让
git status --porcelain -z --untracked-files=all产出吉字节级输出，runGit的 stdout 累积器冲破 V8 字符串上限，整个宿主以RangeError: Invalid string length崩溃（栈指向累积行，两次复现）。dev 已有
GIT_OUTPUT_MAX_BYTES字节上限与 NUL 字段计数封顶，但对照崩溃链仍有三个缺口：spawn('git')解析到 cmd shim，其孙进程在child.kill()后存活并继续灌数据（实测孤儿比 kill 多活 20+ 秒）——fieldCapped只护行数封顶，字节封顶没有对应闩锁修复
byteCapped闩锁：字节封顶拒绝后，stdout/stderr 的后续 chunk 一律丢弃（fieldCapped || byteCapped双闸）；killTree()：销毁两条 stdio 流（EPIPE 终止孤儿）+ SIGKILL，超时/字节封顶/字段封顶三条 kill 路径统一使用；maxBytes预算。病态工作区的最坏结果从「宿主死亡」降为「一次 SCM 刷新失败」。
验证