tju-yxq opened a new pull request, #2539: URL: https://github.com/apache/rocketmq-dashboard/pull/2539
## Summary - add one UTF-8 byte-budget guard for chat messages, command fields/context, tool invocations, selectors, identifiers, and outbound provider/CLI prompts - reject oversized values before gateway, tool registry, HTTP provider, or CLI execution with stable request error semantics - apply the existing 5 MiB provider response budget to successful SSE streams, not only non-streaming bodies and streaming error responses - validate the effective configured model when no per-request override is present ## Why Successful OpenAI-compatible SSE responses currently use an unbounded input stream, while every other provider/CLI response path is capped. AI request DTOs and structured tool inputs also have no centralized size checks before serialization or process/provider execution. This makes the streaming path inconsistent and lets a single request or provider response retain unnecessarily large payloads. ## Implementation notes - text limits are measured in UTF-8 bytes and stop counting as soon as the limit is exceeded - structured context/tool limits use their serialized JSON size - a limited stream reads at most one byte beyond the response budget before raising `llm.provider.response_too_large` - payloads at the configured boundary remain accepted ## Tests - focused AI package suite: 106 tests passed - full backend suite: 1,561 tests passed - Checkstyle: 0 violations - `git diff --check`: passed Production changes: 237 additions / 5 deletions. The size comes from the central guard and bounded SSE implementation, not test padding. Closes #2538 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
