youngkermit8-coder opened a new issue, #2040: URL: https://github.com/apache/rocketmq-dashboard/issues/2040
## Problem `ClaudeCodeAgentProvider.stream()` drains the Claude CLI's stdout and stderr without an output-size limit. Stdout is consumed through `BufferedReader.readLine()`, so one unbounded stream-json line can grow in memory before parsing, while stderr is collected with `readAllBytes()`. The fallback result text can also retain an arbitrarily large payload. A misbehaving or compromised upstream reached through the Claude CLI can therefore make the Studio process buffer unbounded child-process output and exhaust the JVM heap. The non-streaming CLI path has separate bounded-output work, but the Claude streaming implementation does not use that path. ## Expected behavior Bound the combined stdout/stderr bytes consumed from a Claude streaming process. If the limit is exceeded, terminate the child process and return a structured `llm.provider.output_too_large` error. Normal stream-json parsing and output below the limit should remain unchanged. ## Suggested verification - oversized stdout is rejected and the process is terminated - oversized stderr is rejected and the process is terminated - existing large-but-bounded stderr draining still succeeds - regular streamed/fallback result handling is unchanged -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
