fix: reject truncated exec approval commands

pgondhi987 · pgondhi987 · commit 37f3ed50c502 · 2026-05-12T11:12:16.000Z
diff --git a/src/gateway/server-methods/exec-approval.ts b/src/gateway/server-methods/exec-approval.ts
@@ -3,6 +3,7 @@ import { resolveCommandAnalysisSummaryForDisplay } from "../../infra/command-ana
 import {
   resolveExecApprovalCommandDisplay,
   sanitizeExecApprovalDisplayText,
+  sanitizeExecApprovalDisplayTextWithStatus,
   sanitizeExecApprovalWarningText,
 } from "../../infra/exec-approval-command-display.js";
 import type { ExecApprovalForwarder } from "../../infra/exec-approval-forwarder.js";
@@ -248,14 +249,28 @@ export function createExecApprovalHandlers(
         config: runtimeConfig,
         agentId: effectiveAgentId,
       });
+      const sanitizedCommandDisplay =
+        sanitizeExecApprovalDisplayTextWithStatus(effectiveCommandText);
+      if (sanitizedCommandDisplay.truncated || sanitizedCommandDisplay.oversized) {
+        respond(
+          false,
+          undefined,
+          errorShape(ErrorCodes.INVALID_REQUEST, "command exceeds exec approval display limit", {
+            details: {
+              reason: "EXEC_APPROVAL_COMMAND_DISPLAY_LIMIT",
+            },
+          }),
+        );
+        return;
+      }
+      const sanitizedCommandText = sanitizedCommandDisplay.text;
       const commandAnalysis = resolveCommandAnalysisSummaryForDisplay({
         host,
         commandText: effectiveCommandText,
         commandArgv: effectiveCommandArgv,
         cwd: effectiveCwd,
         sanitizeText: sanitizeExecApprovalWarningText,
       });
-      const sanitizedCommandText = sanitizeExecApprovalDisplayText(effectiveCommandText);
       const commandSpans =
         commandHighlighting && sanitizedCommandText === effectiveCommandText
           ? normalizeCommandSpans(p.commandSpans, sanitizedCommandText.length)
diff --git a/src/gateway/server-methods/server-methods.test.ts b/src/gateway/server-methods/server-methods.test.ts
@@ -1005,6 +1005,31 @@ describe("exec approval handlers", () => {
     expectRecordFields(mockCallArg(respond, 0, 2), { message: "command is required" });
   });
 
+  it("rejects approval requests when the command display would be truncated", async () => {
+    const { handlers, broadcasts, respond, context } = createExecApprovalFixture();
+    await requestExecApproval({
+      handlers,
+      respond,
+      context,
+      params: {
+        command: `printf visible # ${"A".repeat(18 * 1024)}\nprintf hidden`,
+        host: "gateway",
+        nodeId: undefined,
+        systemRunPlan: undefined,
+      },
+    });
+
+    expect(mockCallArg(respond)).toBe(false);
+    expect(mockCallArg(respond, 0, 1)).toBeUndefined();
+    expectRecordFields(mockCallArg(respond, 0, 2), {
+      message: "command exceeds exec approval display limit",
+    });
+    expectRecordFields((mockCallArg(respond, 0, 2) as { details?: unknown }).details, {
+      reason: "EXEC_APPROVAL_COMMAND_DISPLAY_LIMIT",
+    });
+    expect(broadcasts).toEqual([]);
+  });
+
   it("returns pending approval details for exec.approval.get", async () => {
     const { handlers, broadcasts, respond, context } = createExecApprovalFixture();
 
diff --git a/src/infra/exec-approval-command-display.ts b/src/infra/exec-approval-command-display.ts
@@ -38,11 +38,21 @@ function escapeInvisibles(text: string, options?: { preserveLineBreaks?: boolean
   );
 }
 
-function truncateForDisplay(text: string): string {
+export type SanitizedExecApprovalDisplayText = {
+  text: string;
+  truncated: boolean;
+  oversized: boolean;
+};
+
+function truncateForDisplay(text: string): SanitizedExecApprovalDisplayText {
   if (text.length <= EXEC_APPROVAL_MAX_OUTPUT) {
-    return text;
+    return { text, truncated: false, oversized: false };
   }
-  return text.slice(0, EXEC_APPROVAL_MAX_OUTPUT) + EXEC_APPROVAL_TRUNCATION_MARKER;
+  return {
+    text: text.slice(0, EXEC_APPROVAL_MAX_OUTPUT) + EXEC_APPROVAL_TRUNCATION_MARKER,
+    truncated: true,
+    oversized: false,
+  };
 }
 
 // Build a boolean bitmap of positions in `text` that ANY redaction pattern would match.
@@ -92,11 +102,15 @@ function buildStrippedView(original: string): { stripped: string; strippedToOrig
 function sanitizeExecApprovalDisplayTextInternal(
   commandText: string,
   options?: { preserveLineBreaks?: boolean; oversizedMarker?: string },
-): string {
+): SanitizedExecApprovalDisplayText {
   if (commandText.length > EXEC_APPROVAL_MAX_INPUT) {
     // Refuse to display inputs above the hard cap; anything larger must be approved through
     // another channel. Running redaction on a multi-megabyte payload would be a DoS vector.
-    return options?.oversizedMarker ?? EXEC_APPROVAL_OVERSIZED_MARKER;
+    return {
+      text: options?.oversizedMarker ?? EXEC_APPROVAL_OVERSIZED_MARKER,
+      truncated: false,
+      oversized: true,
+    };
   }
   const rawRedacted = redactSensitiveText(commandText, { mode: "tools" });
   const { stripped, strippedToOrig } = buildStrippedView(commandText);
@@ -167,14 +181,20 @@ function sanitizeExecApprovalDisplayTextInternal(
 }
 
 export function sanitizeExecApprovalDisplayText(commandText: string): string {
+  return sanitizeExecApprovalDisplayTextInternal(commandText).text;
+}
+
+export function sanitizeExecApprovalDisplayTextWithStatus(
+  commandText: string,
+): SanitizedExecApprovalDisplayText {
   return sanitizeExecApprovalDisplayTextInternal(commandText);
 }
 
 export function sanitizeExecApprovalWarningText(warningText: string): string {
   return sanitizeExecApprovalDisplayTextInternal(normalizeDisplayLineBreaks(warningText), {
     preserveLineBreaks: true,
     oversizedMarker: EXEC_APPROVAL_WARNING_OVERSIZED_MARKER,
-  });
+  }).text;
 }
 
 function normalizePreview(commandText: string, commandPreview?: string | null): string | null {
