zeekay ee27c12905 shell: a long command is read on a stack its depth fits; npx and uvx take approve ...

The walk recurses with a command's nesting, and a flat chain nests as
deep as it is long, so a hostile command overflowed the caller's stack
and aborted the server (the classifier's own deep-nesting test died
under a debug build). A command over 64 bytes is now read on a thread
with a 256 MiB stack, reserved and not committed, and one over 64 KiB
is refused unread as unparsed.

npx and uvx run through exec, whose classifier asks before a package is
fetched, and they had no way to pass the approval: since the merge
neither could run at all. They take approve as exec does.

The hostile-text bound is 3 s for an optimized build and 15 s for an
unoptimized one on a loaded host; it catches a quadratic read, which
takes minutes. The unified surface lists the kai tool beside the eight
purpose-built ones.

2026-10-14 17:24:56 -07:00

..

examples

feat(rust): hanzo-shell reads exec's command and says allow, ask or deny

2026-10-14 16:32:13 -07:00

src

shell: a long command is read on a stack its depth fits; npx and uvx take approve

2026-10-14 17:24:56 -07:00

tests

shell: a long command is read on a stack its depth fits; npx and uvx take approve

2026-10-14 17:24:56 -07:00

Cargo.toml

feat(rust): hanzo-shell reads exec's command and says allow, ask or deny

2026-10-14 16:32:13 -07:00