Skip to content

fix(limits): treat zero limit values as "use default"#1216

Merged
chaliy merged 5 commits intomainfrom
fix/1181-zero-limit-validation
Apr 11, 2026
Merged

fix(limits): treat zero limit values as "use default"#1216
chaliy merged 5 commits intomainfrom
fix/1181-zero-limit-validation

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented Apr 11, 2026

Summary

Closes #1181

  • Validate all numeric limit builder methods (max_commands, max_loop_iterations, etc.) to treat 0 as "use default" instead of accepting it
  • Applies to ExecutionLimits, SessionLimits, and MemoryLimits builder methods
  • timeout(), parser_timeout(), and capture_final_env() are unchanged (non-numeric)

Test plan

  • test_zero_limit_uses_default — all ExecutionLimits setters with 0 keep defaults
  • test_nonzero_limit_works — nonzero values are applied correctly
  • test_session_limits_zero_uses_default — SessionLimits zero-guard
  • test_memory_limits_zero_uses_default — MemoryLimits zero-guard
  • All 40 limits-related tests pass

chaliy added 5 commits April 11, 2026 17:11
…pting

Passing 0 to any numeric limit setter (max_commands, max_loop_iterations,
etc.) now silently keeps the default value instead of setting the limit to
zero. This prevents misconfiguration where a caller passes 0 intending
"unlimited" but actually disables or over-restricts execution.

Applied to all numeric setters on ExecutionLimits, SessionLimits, and
MemoryLimits. Duration and bool setters are unchanged.

Closes #1181
Tests that used max_stdout_bytes(0) or max_ast_depth(0) now use
small nonzero values since zero is treated as "use default" per #1181.
@chaliy chaliy merged commit 4a88947 into main Apr 11, 2026
27 checks passed
@chaliy chaliy deleted the fix/1181-zero-limit-validation branch April 11, 2026 18:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

sec(js): BashTool constructor accepts maxCommands: 0 and maxLoopIterations: 0 — disabling all limits

1 participant