fix: bound authentication and skill subprocess output

[GautamSharma99]

Summary

Fixes #130.

Bound the output retained from authentication subprocesses and Codex skill JSONL streams so a verbose, malfunctioning, or compromised child process cannot grow the SDK/CLI process's memory usage without limit.

The change also avoids repeatedly reparsing the complete interactive-login transcript while looking for device-auth instructions.

Changes

Bounded authentication output

Authentication subprocesses now enforce an independent 64 KiB ceiling for stdout and stderr.

For interactive login:

• stdout and stderr are retained only up to their individual limits;
• authentication URLs and user codes are discovered incrementally from a bounded rolling tail;
• discovered instructions are cached, while preserving the existing preference for stdout over stderr;
• exceeding either limit terminates the child and produces an unsuccessful login result with a fixed diagnostic;
• collected child output is cleared on overflow so credential-like content is not included in the result;
• the successful-login callback is not invoked after an output-limit failure.

For noninteractive authentication commands:

• stdout and stderr use the same independent 64 KiB ceilings;
• exceeding either ceiling terminates the subprocess;
• the command rejects with a PluginBootstrapError containing a fixed, redacted message;
• collected output is discarded before the error is reported.

Incremental login instruction parsing

CodexLoginHandle no longer reparses all output collected so far for every incoming chunk.

Instead, each stream keeps a 4 KiB instruction-discovery tail. New chunks are parsed together with that bounded tail, and the first discovered URL and device code are retained. This bounds the parsing work while still recognizing instructions split across normal subprocess chunks.

Bounded skill JSONL parsing

The skill output reader now uses a byte-bounded incremental newline parser instead of readline, which could retain an arbitrarily large unterminated line.

The parser enforces:

• a 1 MiB maximum for each JSONL event;
• a 256 KiB maximum for retained final agent messages and error messages;
• a fixed 1 MiB pending-line buffer, avoiding unbounded chunk accumulation as well as unbounded line content.

When an oversized event is encountered, the remainder of that line is discarded and the stream continues to be drained. After draining, the command fails with a fixed CodexSecurityError that does not echo subprocess content. This prevents a child from being left blocked on a full output pipe while still reporting the boundary violation safely.

The parser continues to support CRLF input, a final event without a trailing newline, chunks split at arbitrary byte boundaries, and split UTF-8 sequences.

Security impact

This prevents untrusted or unexpectedly verbose authentication and skill subprocesses from causing unbounded:

• stdout or stderr retention;
• repeated interactive-login parsing work;
• JSONL line accumulation;
• retained final response or error-message memory.

Overflow diagnostics are constant strings and do not include the offending child output, preserving the existing credential-redaction boundary.

Tests

Added regression coverage for:

• oversized noninteractive authentication stdout;
• oversized noninteractive authentication stderr;
• oversized interactive login output after valid instructions are discovered;
• preservation of the discovered verification URL and device code;
• suppression of credential-like overflow content;
• rejection without invoking the login success callback;
• a JSONL event larger than 1 MiB across many chunks;
• continued stream draining after an oversized event;
• an agent response larger than 256 KiB;
• end-to-end skill command rejection without writing partial output.

Verification

• pnpm run types
• pnpm run format
• pnpm run build
• focused authentication and CLI skill tests
• pnpm run test

Full test result:

• 473 passed
• 6 expected platform/integration skips
• 0 failed

[mldangelo-oai]

Thanks for tackling unbounded authentication and skill subprocess output. Those limits are already in the current code, and this branch now conflicts with main, so it would not add a new fix. I'll close it as superseded. We'd be glad to consider future contributions.