Chinesezjc a6678610b8 fix(code-runtime-python): cap the unknown-binding preview before JSON.stringify ...

The reviewer's standing item: the unknown-binding reply ran JSON.stringify on
the WHOLE capped target (global + '.' + name, each up to maxValueBytes code
units), allocating the escaped form — up to ~6x under control-heavy input, a
multi-hundred-MB spike near the maxValueBytes ceiling that no hostile-peer
bound would have admitted. The escaped preview is now built from a 1 KiB
prefix of the target (enough to identify the binding); capMessage still
enforces the reply budget. A forged huge-name case drives the path.

2026-08-31 15:06:50 +08:00

..

boot-write-failure.spec.ts

test(code-runtime-python): cover the boot-ack gate's re-entry guard and run-write failure

2026-08-31 15:00:33 +08:00

protocol-mirror.e2e.ts

docs(code-runtime-python): name the roster aliases by subset direction, align metering prose

2026-08-07 15:37:19 +08:00

protocol.spec.ts

docs(code-runtime-python): trim metering prose and cover encodeJsonPlain depth

2026-08-07 13:27:54 +08:00

residual-detach.spec.ts

docs(code-runtime-python): sync README with the shipped backend

2026-08-31 14:20:00 +08:00

runtime.spec.ts

fix(code-runtime-python): cap the unknown-binding preview before JSON.stringify

2026-08-31 15:06:50 +08:00